Human oversight

Human oversight is the requirement most often satisfied on paper and failed in production, because it is about capability rather than presence. A reviewer who cannot see why the system produced an output, or who has three seconds per case and a target that punishes disagreement, is not exercising oversight in the Article 14 sense. It also splits across the contract: the provider must build the affordances — explanations, confidence signals, a working stop control — and the deployer must assign people with the competence, training and authority to use them.

A content-moderation system flags posts for removal. Oversight that satisfies Article 14 means the reviewer sees which policy was matched and how confidently, can reverse the decision without escalation, and works under a queue design and performance target that make genuine review possible. Oversight that fails means a queue of 900 items a shift with an approve button — the human is present, but the design has removed the ability to disagree.

Equating human-in-the-loop with human oversight. Rubber-stamping is not oversight: the Act requires the person to be able to understand, interpret and actually override the output, which is a statement about interface design, training and authority — not about whether a human clicked something.

Who is responsible for human oversight, the provider or the deployer?

Both. The provider must design and build in oversight measures under Article 14 before the system is placed on the market. The deployer must assign natural persons with the necessary competence, training, authority and support to exercise that oversight under Article 26(2).

Does human oversight mean a human approves every decision?

No. It means a human must be able to understand, monitor, interpret and override the system's output appropriately to the risk. The intensity of oversight scales with the risk and the system's degree of autonomy.

What is the four-eyes rule for biometric identification?

For high-risk remote biometric identification systems in certain contexts, Article 14(5) requires that no action or decision be taken on the basis of an identification unless it has been separately verified and confirmed by at least two natural persons with the necessary competence and authority.