Human Oversight Requirements Under The EU AI Act

Drew & AI Comply HQ™ Team · June 19, 2026

High-risk AI can shape decisions about people's jobs, loans, and safety. The EU AI Act says people must be able to watch it, correct it, and stop it. The Act calls this human oversight (Article 14).

The company that builds the system designs the oversight in. The Act calls that company the provider. A business that uses the system (called a deployer) puts trained people in charge of it.

These requirements apply from December 2, 2027 for listed uses, like hiring and credit scoring (Annex III). For AI built into products like medical devices (Annex I, Section A), they apply from August 2, 2028.

Why does the Act ask for this?

AI gets things wrong, and people tend to trust its output too much. The Act names that habit automation bias (Article 14(4)(b)). A person who can step in can catch an error before it hurts someone.

Oversight aims to prevent or reduce risks to health, safety, and fundamental rights (Article 14(2)). That covers foreseeable misuse, not only normal use.

Which AI systems need human oversight?

Only high-risk AI systems. There are two ways in (Article 6):

A listed use (Annex III). Examples are hiring, credit scoring, school admissions, and access to public benefits. Biometrics, critical infrastructure, law enforcement, migration, and justice are on the list too.
A regulated product (Annex I). The AI is a product, or a safety part of a product, that already needs an outside safety check. Medical devices, toys, and lifts are examples.

An Annex III system can fall outside the high-risk group. That happens when it poses no significant risk of harm, for example because it does not meaningfully change the outcome of a decision. It must also fit one of four cases, like doing only a narrow or preparatory task (Article 6(3)). A system that profiles people is always high-risk. If you rely on this, write down why before launch and register the system in the EU database (Articles 6(4) and 49(2)). Our guide Is your AI system high-risk? walks through the test.

Chatbots and other AI that is not high-risk have no Article 14 duty. Every provider and deployer still has to support their staff's AI literacy (Article 4).

What must a person be able to do?

The provider must deliver the system so the people overseeing it can, as fits the situation (Article 14(4)):

Understand it. Know what the system can and cannot do, and watch for odd or unexpected results.
Resist over-trust. Stay aware of the pull to accept its output without thinking.
Read the output correctly. Use the tools and methods available to interpret it.
Say no. Decide not to use the system, or ignore, override, or reverse its output.
Stop it. Step in, or halt the system safely with a stop button or a similar procedure.

The measures must fit the risks, how much the system acts alone, and where it is used (Article 14(3)). The provider can build controls into the system before launch, where that is technically feasible. The provider can also name steps the deployer must take. It can do one or both.

The instructions for use must describe these measures (Article 13(3)(d)). So must the technical documentation (Annex IV, points 2(e) and 3).

Are there stricter rules for biometrics?

Yes. Some AI identifies people from a distance using their face or other body features (called remote biometric identification). Here the deployer must not act on a match until 2 people have separately checked and confirmed it (Article 14(5)). Both need the right skills, training, and authority.

EU or national law can drop the 2-person check for law enforcement, migration, border control, or asylum. That only happens where the law finds it disproportionate.

Who does what?

Role	What they must do	Where in the Act
Provider (builds the system)	Design the system so people can oversee it. Build in controls, name the steps for deployers, and explain both in the instructions for use.	Articles 13 and 14
Deployer (uses the system)	Use the system as the instructions say. Give oversight to people with the skills, training, and authority to do it, and back them up.	Article 26(1) and (2)

Deployers have a few more duties that touch oversight:

Watch the system. Monitor how it runs and tell the provider about problems. If it presents a risk, tell the provider or distributor and the national authority, then stop using it (Article 26(5)).
Tell people. Let people know when a listed high-risk system helps make decisions about them (Article 26(11)).
Explain on request. A person affected by a significant decision can ask the deployer to explain the AI's role (Article 86).
Assess the impact first. Some deployers must assess the impact on people's rights before first use. They include public bodies, private firms providing public services, and firms that score credit or price life and health insurance. The assessment describes how oversight will work (Article 27(1)(e)).

Does a person have to approve every decision?

No. Article 14 is about design and supervision. It does not make a person sign off on every output. The one exception is the 2-person check for remote biometric identification (Article 14(5)).

The GDPR has a separate rule. It limits decisions made only by a machine that have legal or similarly big effects on people (Article 22 GDPR). Both laws can apply at once. Our guide to the EU AI Act and the GDPR shows how they fit together.

When does Article 14 apply?

December 2, 2027 for Annex III systems
August 2, 2028 for Annex I, Section A systems. Machinery, vehicles, and other Section B products get their AI rules through their own EU laws (Article 2(2)).

Both dates come from the Digital Omnibus on AI (Regulation (EU) 2026/1744). It moved them in July 2026 (Article 113).

Systems already on the market before your date follow a different rule. They only have to comply if their design changes significantly after that date. AI used by public authorities must comply by August 2, 2030 either way (Article 111(2)).

Frequently asked questions

Can a fully autonomous system skip human oversight?

No. The more a system acts on its own, the more oversight it needs. Article 14(3) ties the measures to the system's level of autonomy.

We use an AI system from a vendor. Who is responsible?

Both of you. The vendor, as provider, designs the oversight tools. Your business, as deployer, staffs and runs them (Article 26(2)).

You become the provider if you put your name on the system or change it in a big way. The same goes if you change its purpose so it becomes high-risk (Article 25(1)). Our deployer obligations checklist lists your duties.

What training do the people in charge need?

The Act does not set a course or a certificate. It says they need the necessary competence, training, and authority, plus support (Article 26(2)). Every provider and deployer must also take steps to support staff AI literacy (Article 4). Our AI literacy guide covers that duty.

Is there an exemption for small companies?

No. Small and medium-sized companies (SMEs) can simplify parts of their quality paperwork (Article 63(1)). That does not lift the human oversight duty (Article 63(2)).

What happens if we get it wrong?

Breaking these duties can cost up to 15 million EUR or 3% of worldwide annual turnover (Article 99(4)). The higher of the two is the cap. For SMEs, the cap is whichever is lower (Article 99(6)).

Since July 2026, the same applies to companies just above SME size. The Act calls them small mid-caps, or SMCs (Article 99(6a)). Our guide to EU AI Act fines and penalties has the full picture.

Update: the Digital Omnibus is now law (October 7, 2026)

In July 2026 the EU changed some AI Act dates. The change is called the Digital Omnibus on AI (Regulation (EU) 2026/1744). It has been law since July 27, 2026. The dates in this article follow it.

What changed for human oversight:

High-risk rules start later (Article 113). AI used for hiring, credit scoring, education, and the other listed uses (Annex III) must comply from December 2, 2027. AI built into products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. Machinery, vehicles, drones, and other Section B products get their AI rules through their own EU laws (Article 2(2)).
The AI literacy duty changed (Article 4). You must take steps to support your team's AI literacy. The law no longer asks for a set level of skill.
Small mid-caps get SME help (Article 99). They get the lower fine cap, except for the banned practices.

What did not change: the oversight rules in Articles 14 and 26 are the same as before.

To see which dates apply to you, run the free risk check.

Sources

This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.