Reliability and control · Layer 5
Human oversight
The real ability of a competent person to understand, correct or stop what an AI proposes, before it takes effect.
A way to picture itThe co-pilot reading the checklist: useful if they have the time, the skills and the authority to say “we’re not taking off”. If they sign without looking, it is just a rubber stamp.
In practiceIf the person cannot say no in practice, data protection authorities still treat the decision as automated.
An HR department uses an AI to shortlist job applications. Recruiters see the ranking, but also the full CVs and the criteria applied, and can bring back a rejected candidate. Every quarter, the team compares recruiters’ choices with the tool’s: systematic agreement would trigger a review of the set-up. Any candidate can ask for a person to re-examine their application.
For high-risk systems, the AI Act requires effective human oversight: understanding the system’s limits, guarding against relying on it by reflex, being able to disregard or reverse its output, and stopping it (EU · AI Act, art. 14). Deployers assign this oversight to people with the necessary competence, training and authority (EU · AI Act, art. 26), from 2 December 2027 for Annex III systems. Separately from the AI Act, a person has the right not to be subject to a decision based solely on automated processing that significantly affects them and, where such a decision is allowed, to obtain human intervention and contest it (EU · GDPR, art. 22). According to European guidelines, that intervention must be meaningful rather than a token gesture (EU · EDPB).
“What evidence does the reviewer rely on, how much time do they have per case, and what share of the AI’s proposals do they change or reject?”
Only if it is real: the person must have the authority and competence to change the decision, and actually use them. Bulk approval without review leaves the decision solely automated.
The tendency to trust a machine’s output too readily. The AI Act requires that people overseeing a high-risk system be able to remain aware of it (EU · AI Act, art. 14).
Yes. On 21 August 2026, the Dutch data protection authority fined Uber €824,990,000 for automatically deactivating drivers’ accounts without informing them adequately (Netherlands · AP). Uber has appealed.
Educational explainer, not legal advice. Up to date as of 29 October 2026.