{"slug":"human-oversight-and-override","id":"AIPT-CTL-0016","title":"Human oversight design and override procedure","kind":"process","kind_label":"Process","purpose":"Ensures that competent people can understand, question, correct, stop or decline to use an AI system's output, and that the degree of human involvement is chosen deliberately for each decision point.\n","description":"For every decision point the system influences, the owner records whether a person decides with the system's help, reviews after the fact, or is only alerted on exceptions, and why that level is proportionate to the harm at stake. The interface exposes confidence, limitations and the reasons for an output where feasible, and includes a documented way to override, pause or shut the system down. Overseers are named, trained against automation bias and given the time and authority to intervene. Override events are logged and reviewed so that the oversight design can be tightened if interventions are rare or ineffective.\n","owner_role":"AI system owner","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["5.1","5.2","7.3"],"evidence":[{"type":"procedure","title":"Human oversight and override procedure","description":"Named overseers, the involvement level per decision point, escalation and stop mechanisms."},{"type":"approval_record","title":"Human-involvement design rationale","description":"Signed record of the oversight level chosen for each decision point and the reasoning."},{"type":"training_record","title":"Overseer training completion","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.5, A.9.2, A.9.3","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 3.2; MAP 3.5; MANAGE 2.4","note":null,"confidence_level":"high"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.2 Human-centred values and fairness","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM06 Excessive Agency","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","relationship":"supports","note":"Assigning trained natural persons to oversee the system.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"australia-vaiss-testing-human-control-transparency","title":"Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)","relationship":"supports","note":"Guardrail 4: meaningful human control.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","relationship":"supports","note":"No adverse decision solely on the system's output.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","title":"Deployers must disclose deepfakes and AI-generated text published on matters of public interest","relationship":"supports","note":"Editorial control that lifts the text-disclosure duty.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure"},{"slug":"uk-ico-automated-decision-safeguards","title":"Apply safeguards to solely automated decisions with significant effects","relationship":"supports","note":"Meaningful human intervention design.","confidence_level":"medium","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards"},{"slug":"eu-ai-act-human-oversight","title":"Enable and assign effective human oversight","relationship":"satisfies","note":"Oversight roles, interface measures, stop mechanism and override paths per deployment.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight"},{"slug":"us-colorado-admt-human-review","title":"Offer meaningful human review of an adverse consequential decision","relationship":"satisfies","note":"A reviewer with authority to change the outcome.","confidence_level":"high","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-human-review"},{"slug":"uae-pdpl-automated-decision-objection","title":"Respect the right to object to automated decision-making without human intervention","relationship":"supports","note":"Design of the human intervention step.","confidence_level":"medium","is_binding":true,"policy":"uae-personal-data-protection-law","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection"},{"slug":"singapore-mgf-human-involvement","title":"Determine the appropriate level of human involvement in AI decisions","relationship":"satisfies","note":"Records the in-the-loop, over-the-loop or out-of-the-loop choice and rationale.","confidence_level":"high","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-human-involvement"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","title":"Operators of high-impact AI must ensure human management and supervision","relationship":"satisfies","note":"Named supervisors with monitoring and override capability.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight"},{"slug":"us-new-york-city-local-law-144-alternative-process-request","title":"Employers and employment agencies must let candidates request an alternative selection process or accommodation","relationship":"supports","note":"Human-run alternative where one is offered.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request"},{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","relationship":"supports","note":"Human oversight and operator arrangements.","confidence_level":"medium","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices"}],"related_controls":["ai-risk-assessment","decision-explanation-and-appeal-route","ai-literacy-and-role-based-training","record-keeping-and-logging"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/human-oversight-and-override","context_url":"https://aipolicytracker.org/controls/human-oversight-and-override.md"}