For high-risk systems, the AI Act does not require people to make every decision themselves. It requires people to be able to stay in control. That distinction often blurs in implementation: a person who confirms every recommendation of a system unchecked exercises no oversight.
What providers must enable
Under Art. 14 AI Act, providers design high-risk systems so that the people overseeing them understand the system’s capabilities and limitations, remain aware of the tendency to over-rely on automatically produced output, interpret outputs correctly, can decide in an individual case not to use the system or to disregard its output, and can intervene in operation or halt it through a stop function. For certain remote biometric identification uses, the AI Act also requires a result to be confirmed by at least two people before action is taken.
What deployers must organise
Deployers assign oversight to people with the necessary competence, training and authority, and give them the necessary support. In practice this means oversight is a named role with time and decision-making authority, not a side task. The competence requirements overlap with the measures for AI literacy.
Forms of oversight
Human-in-the-loop means a person checks every result before it takes effect — sensible for consequential individual decisions. Human-on-the-loop means a person monitors operation and intervenes when anomalies arise — sensible for many similar transactions. Human-in-command means people decide on use, limits and shutdown. Which form fits depends on risk and decision volume.
Automation bias
The biggest risk to effective oversight is not missing technology but habituation. Someone who sees a hundred correct recommendations confirms the hundred-and-first unchecked. Countermeasures are reasons and sources for every result, sample checks with feedback, a workload that allows genuine review, and metrics on how often recommendations are overridden. An override rate of zero is a warning sign, not a success.
Timing and evidence
The obligations apply to Annex III high-risk systems from December 2027. Oversight can be evidenced through interface design, the role description, training records and an audit trail recording overrides and interventions. For the bigger picture, see our article on high-risk obligations.