Human oversight

In plain English

Think of autopilot on a passenger jet. The aircraft can fly itself for hours. But the pilots understand the system, watch the instruments, notice when it is out of its depth and can take over at any moment. Human oversight of AI means the same thing: real people with the knowledge, time and authority to intervene.

A person who clicks "approve" on every screen without thinking is not oversight. The EU High-Level Expert Group's 2019 guidelines describe three approaches: human-in-the-loop, human-on-the-loop and human-in-command. The more severe and irreversible the possible harm, the closer the human should be. See human-in-the-loop vs human-on-the-loop.

Example

Kessler Mutual, a fictional insurer, uses a high-risk AI system to help assess life insurance applications. Life and health insurance pricing is an Annex III use. Its oversight design:

• Underwriters see the risk score with its main factors and a confidence level, not just a verdict.
• Low-confidence cases and every proposed decline go to a senior underwriter. That underwriter records an independent view before seeing the score.
• Any underwriter can override a score, and the operations lead can suspend the system.
• Override rates are reviewed monthly.

After three months, overrides fall to 0.5%. An investigation finds reviewers rubber-stamping under time pressure. Kessler cuts case quotas and retrains reviewers on automation bias. A near-zero override rate was a warning sign, not a success.

Why it matters

Under the EU AI Act, the duty is split between provider and deployer:

• Provider design, Art. 14. High-risk systems must be built so people can oversee them effectively. Oversight aims to prevent or minimize risks to health, safety and fundamental rights, including under foreseeable misuse. Art. 14(4) lists five abilities. Overseers must understand limits and monitor operation, stay alert to automation bias, interpret outputs, override or disregard them, and stop the system.
• Remote biometric identification, Art. 14(5). A match must be separately verified by at least two people before the deployer acts on it, with narrow exceptions.
• Deployer staffing, Art. 26(2). Deployers must assign oversight to people with the necessary competence, training and authority, and give them support.
• Dates. After the Digital Omnibus, these apply from 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems.

Outside the AI Act, GDPR Art. 22 requires human intervention as a safeguard for solely automated decisions with legal or similarly significant effects.

How the AIGP exam tests it

Oversight design is a Domain III topic (lesson III.A.4), and Art. 14 is a Domain II topic (lesson II.C.4).

Common traps:

• "A human must approve every output." Art. 14 requires effective, proportionate oversight, not blanket sign-off.
• The doubled rubber stamp. Adding a second reviewer who also sees the AI's answer first does not fix automation bias. Independent judgment before exposure and override tracking do.
• Audits as controls. A periodic audit is assurance after the fact. Operational controls are built into the running system: stop buttons, fallbacks, confidence-based escalation and logging.
• Oversight changes the risk class. It never does. A high-risk system with a human in the loop is still high-risk.

The tell: match the oversight model to the stakes, and check that overseers have competence, authority and time.