In short
- Article 14 requires high-risk systems to be designed so that oversight is effective in practice, not merely available in principle.
- Article 14(4) names 5 capabilities the overseer must have, from correctly interpreting the output under point (c) to interrupting the system through a stop function under point (e).
- Automation bias is named in the text. Article 14(4)(b) requires the design to remain aware of the tendency to over-rely on output.
- For the remote biometric identification systems in Annex III point 1(a), Article 14(5) requires that an identification be separately verified by at least 2 natural persons before a deployer acts on it.
- Oversight obligations apply from 2 December 2027 for Annex III systems, after Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved that date from 2 August 2026.
Human oversight is the control most often claimed and least often designed. A reviewer exists, therefore the system is overseen.
Article 14 asks a harder question, and it asks it of the design rather than of the org chart.
01What does the text actually ask for?
That oversight be possible, not that a person be present.
Article 14 requires high-risk systems to be designed and developed, including with appropriate human machine interface tools, so that they can be effectively overseen by natural persons during the period in which they are in use. The obligation lands on the system’s design first and on the deployer’s arrangements second.
That ordering matters in procurement. A deployer cannot supply, by policy, an oversight capability the product does not expose, which is why it belongs in the questions asked before signing.
02Which capabilities must the overseer have?
| Capability | Provision | How it fails in practice |
|---|---|---|
| Understand capacities and limitations | Article 14(4)(a) | No documentation reaches the reviewer |
| Remain aware of automation bias | Article 14(4)(b) | Interface presents output as fact |
| Correctly interpret the output | Article 14(4)(c) | Score shown with no basis or confidence |
| Decide not to use, disregard, override or reverse the output | Article 14(4)(d) | Override exists but is never used |
| Intervene, or interrupt through a stop function | Article 14(4)(e) | Stopping needs a ticket to the vendor |
The fourth row deserves a metric. If Article 14(4)(d) is satisfied on paper and the override rate across twelve months is zero, either the system is perfect or the control is decorative. Both explanations are testable and one of them is far more likely.
The fifth deserves a test rather than a metric. Article 14(4)(e) asks for intervention or a stop, and a stop that only the provider can trigger is not a capability the overseeing person holds. That is a procurement question before it is an operations one, and it sits close to the boundary work described in least privilege for autonomous agents.
03Why is automation bias named in the law?
Because the drafters expected the control to fail this way.
Article 14(4)(b) requires oversight measures that keep the person aware of the tendency to over-rely on output, particularly where the system produces information or recommendations for a decision a human then takes. It is unusual for a regulation to name a cognitive effect. Here it does, because the failure mode is not a person refusing to look. It is a person looking, and agreeing.
Interface design carries most of this obligation. A recommendation displayed as a single confident number invites agreement. The same recommendation displayed with its basis, its confidence and the cases where it is known to be weak invites a decision.
04What is the two person rule?
A narrow requirement with a wide reputation.
| Use | Verification required | Basis |
|---|---|---|
| Remote biometric identification, Annex III point 1(a) | 2 natural persons | Article 14(5) |
| Other Annex III high-risk uses | 1 overseer, effective | Article 14(1) and 14(4) |
| Non high-risk systems | 0 required | Article 14 does not apply |
Article 14(5) requires that, for the remote biometric identification systems in Annex III point 1(a), no action or decision be taken by the deployer on the basis of the identification unless it has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority. The same paragraph disapplies the rule for law enforcement, migration, border control and asylum uses where Union or national law considers it disproportionate, so the count of required verifiers depends on the purpose and not only on the technology.
It does not generalise. Applying a two person rule to every high-risk decision is a choice, not a requirement, and one that usually collapses into two people clicking.
05How should this be evidenced?
With numbers that would embarrass a decorative control.
Record the override rate per system per quarter, the median time a reviewer spends before deciding, and the proportion of decisions where the reviewer consulted the underlying basis. Article 14 of Regulation (EU) 2024/1689 requires none of those three metrics. All of them answer the question a market surveillance authority will ask under that article, which is not whether oversight existed but whether it was effective.
An organisation that can produce an override rate of a few percent, with examples, has a control, and an audit will ask for exactly that artefact. One that produces a policy document has a description of a control that was never tested.
06Frequently asked questions
What does the AI Act require for human oversight?
Article 14 requires that high-risk systems be designed and developed so that natural persons can effectively oversee them during use. Article 14(4) lists the capabilities that design has to enable: understanding capacities and limitations, monitoring operation, staying aware of automation bias, interpreting the output correctly, deciding not to use or to disregard, override or reverse it, and interrupting the system through a stop function.
Is a human approval step enough to satisfy Article 14?
Not by itself. The text asks whether oversight is effective, and an approval that a person cannot meaningfully refuse, because they lack the information or the authority to refuse it, is a step in a workflow rather than oversight.
What is automation bias in the AI Act?
It is the tendency to over-rely on output produced by an automated system. Article 14(4)(b) requires that oversight measures enable the person to remain aware of that tendency, particularly where the system informs decisions taken by humans.
When do the human oversight obligations start applying?
For standalone Annex III high-risk systems, 2 December 2027. For AI embedded in Annex I regulated products, 2 August 2028. Both dates were set by Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force on 27 July 2026.
07References and method
- Regulation (EU) 2024/1689, Article 14, for the oversight design obligation, the capabilities listed in Article 14(4), the automation bias provision and the two person verification rule in Article 14(5).
- Regulation (EU) 2024/1689, Annex III point 1(a), for the remote biometric identification systems to which the two person rule in Article 14(5) attaches.
- Regulation (EU) 2024/1689, Article 4, for the AI literacy obligation that underpins effective oversight in practice.
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force 27 July 2026, for the application dates of 2 December 2027 and 2 August 2028. It defers the dates and leaves Article 14 itself unchanged.