Assigning Human Oversight to People With Authority and Training
Article 26 requires more than following instructions; it mandates that deployers assign human oversight to individuals with appropriate competence and authority. Human oversight is not a checkbox on a form. It is an active responsibility held by named individuals who can override, halt or correct system decisions in real time. The regulation recognises that high-risk AI systems are not infallible and that humans must be able to intervene.
The human oversight requirement has three components. First, the individuals responsible must have the authority to override the system’s decision. If a loan officer can recommend loan denial based on an AI score but cannot actually refuse the loan without approval from a senior manager, that loan officer is not exercising meaningful oversight. The authority must be real and documented. Second, those individuals must be competent. Competence means they understand how the system works, what its limitations are, what decisions it recommends, and when intervention is necessary. A bank cannot assign a junior cashier to oversee a high-risk lending system; they must assign someone with lending knowledge and authority to make credit decisions. Third, the individuals must actually be trained and reminded regularly of their role.
Consider a hiring team using an AI system to rank job applicants. The regulation does not allow the team to simply sort candidates by the AI’s score and interview the top-ranked applicants. Instead, the team must assign specific people to review the AI’s recommendations before they are acted upon. Those people must have the authority to reject the system’s recommendation if they believe a candidate should be interviewed despite a low score. They must understand the system’s limitations and any known biases. They must be trained annually on the system’s capabilities and their accountability. This is what meaningful human oversight looks like in practice.
Competence is technical and contextual
Competence is not defined precisely in the regulation, which places the burden on deployers to determine what competence means for their specific system and context. For a healthcare organisation deploying a diagnostic assistance system, competent oversight means clinicians with relevant medical knowledge, not administrative staff. For a public authority using an AI system to assess benefit eligibility, competent oversight means case workers with knowledge of social security rules, not generalists. For a financial institution using a credit scoring system, competent oversight means loan officers or credit analysts, not call centre staff.
Competence involves understanding not just the domain but the specific system. A competent loan officer does not automatically understand a particular credit scoring system without training. The officer must know how to read the system’s output, what the score ranges mean, what factors drive the score, and what overrides are possible. A competent healthcare professional using a diagnostic system must know what conditions the system was trained to detect, what its accuracy rates are, and how to interpret its recommendations in context of the patient’s specific history and presentation.
Organisations often struggle with the tension between scale and competence. A large bank might process thousands of loan applications per day. It is impractical to have senior loan officers review every decision. The regulation allows for tiered approaches. A junior loan officer can make the first pass, but their decisions must be spot-checked by a senior loan officer on a regular basis. Algorithms can flag applications that deserve scrutiny. The key is that genuine human review and decision-making authority must exist at some point in the workflow, not just a ceremonial sign-off.
Training and documentation
Competence requires training. Deployers must document what training is provided to people who exercise oversight. Training must cover the system’s intended use, its limitations, known sources of error or bias, and the process for escalation or override. Training must be refreshed regularly, particularly when the system is updated or when performance monitoring reveals new limitations. Organisations should keep records of training completion and test results to evidence competence.
Consider a specific example. A healthcare organisation deploys an AI diagnostic system. Radiologists who use the system must receive training covering the following: the diseases the system was trained to detect, the types of imaging data it expects, the accuracy rates on different patient populations, common false positives and false negatives, how to interpret a system output, and when to trust the system’s recommendation versus clinical judgment. This training should occur before radiologists use the system and should be refreshed annually or when the system is updated.
The human oversight duty is not delegable. If you contract with a third party to exercise oversight, you remain accountable if that party fails. Many organisations use outsourced loan officers, call centre agents or case workers. The regulation makes clear that the deployer, not the third party, is responsible for ensuring those outsourced staff have appropriate oversight responsibilities and training.