Under the AI Act, human oversight is a capability, not a duty

The review step nobody tested

A company building an AI feature puts a person in front of the output. Sometimes because a model vendor’s terms ask for it, sometimes because the EU AI Act is coming and human oversight is the part everyone has heard of, mostly because it seems obviously right: the machine proposes, a person decides, the risk is answered.

Two questions to ask before that person is put in the path of a decision. Does the law require that the review actually do anything, that the reviewer read, weigh, disagree, refuse? And does the arrangement work, in the sense that a person reviewing machine output produces better decisions than the better of the two parts working alone? We answered both from primary sources, then sent six findings to six readers whose job was to refute them. Not one survived unchanged.

The short answers are no, and on average not — though against the person working alone the pair does better, and both figures are below. Article 14 is a specification for a product, addressed to whoever builds the system, and it requires nothing at all of the person doing the overseeing. The instrument that reaches a review which decides nothing is data protection law, not the AI Act. The law buys a capability, and whether it helps is a question about your own task rather than one the law answers.

Article 14 is a product specification, not a duty to oversee

Article 14 is addressed to whoever builds and sells the system, and once it binds — 2 December 2027 for Annex III uses, 2 August 2028 for AI in products covered by Annex I — it is enforced against that party through Article 16, point (a), the duty to ensure a high-risk system is “compliant with the requirements set out in Section 2”. Paragraph 1 is a design duty: the system must be built, “including with appropriate human-machine interface tools”, so that it can be “effectively overseen by natural persons during the period in which they are in use”.

Then the grammar does the work. Article 14(4) is a delivery condition: the system “shall be provided to the deployer in such a way” that the “natural persons to whom human oversight is assigned are enabled, as appropriate and proportionate” to do five things. The obligation is to enable, not to ensure. Nothing requires that any of the five ever happen.

Three qualifiers loosen it further. “As appropriate and proportionate” sits in paragraph 4’s chapeau, before the list, so it governs points (a) to (e) alike, the stop button included. And paragraph 3’s measures “shall be ensured through either one or both of the following types of measures”, built in or identified for the deployer, where only the in-product limb carries “when technically feasible”: a provider can put the weight of paragraph 3 on the deployer’s side, and paragraphs 1 and 4 are what still ask something of the system itself.

Article 14(4), consolidated text of 27 July 2026. The right-hand column is our reading of what the text omits.

Nobody has to intervene

That is half the finding. The other half is that no provision of the Act is addressed to the person doing the overseeing.

The phrase human oversight appears nine times in the consolidated text. Six are operative provisions — Article 13(3)(d), 14(2), 14(4), 26(2), 26(3) and 27(1)(e) — and the other three are the heading of Article 14 itself and two mentions in Annex IV, a provider’s technical documentation. In none of the six is it a duty on the person doing it. Paragraph 2’s “Human oversight shall aim to prevent or minimise the risks” comes closest, and it states what the oversight is for: like the rest of Section 2, it will be enforced against the provider through Article 16, point (a). The Act’s duties fall on the provider and the deployer, whoever they are, and not on the individual reviewer: Article 14(4) says what the assigned person is enabled to do, and Article 26(2) gives authority, which is permission rather than obligation.

Article 26(2) is where the people come from, a deployer duty in a different Section: “Deployers shall assign human oversight to natural persons” who have “the necessary competence, training and authority, as well as the necessary support”. It is the only sentence in the Act that makes a buyer put specific people behind an AI system, and it is unqualified, where Article 14 is qualified three times. It requires no record of the assignment, no name given to anyone, and no intervention.

Read in half, Article 26(3) says the opposite of what it says whole. It preserves “the deployer’s freedom to organise its own resources and activities”, and does not stop there: it continues “for the purpose of implementing the human oversight measures indicated by the provider”. Cut at the first half it reads as discretion over what oversight to do; read whole it is discretion over how to resource measures somebody else specified.

Nothing in the Act compels the assigned overseer to act. Three provisions bar acting on an output without a human, and strictly none is addressed to that person either: Article 14(5), the two-person rule below; Article 26(10), which stops a law enforcement authority deciding adversely on a post-remote biometric identification alone; and Article 5(3), the parallel bar for real-time identification. Two reach law enforcement only, and none reaches a commercial deployer of a hiring, credit or education system. Only one of the three is law today: Article 5(3) sits in Chapter II and has applied since 2 February 2025, where 14(5) and 26(10) sit in Chapter III, Sections 2 and 3, and wait for December 2027 and August 2028.

The Act does compel the deployer — “Deployers shall monitor the operation of the high-risk AI system” “on the basis of the instructions for use”, and suspend its use where following those instructions may still leave the system “presenting a risk within the meaning of Article 79(1)” — but none of that is a personal duty of the reviewer. Recital 73 confirms the design: the system should help the assigned person “to make informed decisions if, when and how to intervene”. The if is the finding.

The one compelled human act, and the log entry that satisfies it

Article 14(5) is the single place where the Act regulates the human act itself. For systems under point 1(a) of Annex III, remote biometric identification — which excludes one-to-one verification, so a sign-in is outside it — the provider’s measures must ensure that “no action or decision is taken by the deployer” on an identification unless it has been “separately verified and confirmed by at least two natural persons” “with the necessary competence, training and authority”. It is the one provision that conditions a decision on an act of verification having happened, which is the shape a rule against a nominal review has to take.

Then recital 73 softens it twice. “Those persons could be from one or more entities” and may “include the person operating or using the system”, so one of the two separate verifiers may be the operator. And, in the same breath as saying the requirement “should not pose unnecessary burden or delays”, it adds that “it could be sufficient that the separate verifications” by the different persons “are automatically recorded in the logs generated by the system”.

A recital interprets rather than amends, and the operative words still require separate verification by competent persons. But read as the legislature’s own account of what the paragraph is for, it tells a buyer what the paragraph really buys. Our reading is that the Act’s one compelled human act can be discharged by two automatic log entries, one of them the operator’s own. Our note on what an AI agent should log sets out what a record has to answer to be worth reading back, and a line saying a confirmation occurred is not that.

Then the provision carves itself out. Its second subparagraph disapplies separate verification for high-risk systems “used for the purposes of law enforcement, migration, border control or asylum”, “where Union or national law considers the application of this requirement to be disproportionate”, and those are among the Annex’s highest-stake uses.

A court has already held that an artefact of that kind was not shown to be human intervention

Before anyone builds a logged confirmation step and calls it oversight: a court has looked at an artefact of that kind and held it was not shown to be human intervention. Not under the AI Act, which did not apply, but under the GDPR. Gerechtshof Amsterdam, 4 April 2023, ECLI:NL:GHAMS:2023:793. Four Uber drivers whose accounts had been deactivated asked to be told how the decisions had been made, under Article 15(1)(h), a right written by reference to Article 22(1) and so turning on whether the decision was based solely on automated processing.

For appellants sub 1, sub 2 and sub 4, Uber had “onvoldoende hard weten te maken” that there had been genuine human intervention: it had not made it out. Its exhibits showed one, two or three members of its Risk team making a note after a fraud signal, but in no way showed, in the court’s words, that “die handeling veel meer is geweest dan een louter symbolische handeling” — that the act was much more, on our rendering, than a merely symbolic one — nor that those staff had taken all the relevant data into their analysis “zoals de EDPB richtsnoeren voorschrijven”, as the guidelines prescribe.

Two features of the reasoning matter more than the result. It counted against Uber that it had not made clear “wat de kwalificaties en het kennisniveau van de betreffende medewerkers zijn”, the qualifications and knowledge level of the staff concerned — which is what the guidelines ask of a reviewer: someone “who has the authority and competence to change the decision”. Our reading: that is the same quality Article 26(2) will ask a deployer to put behind a high-risk system, tested here under another instrument and before that duty exists. And a heightened duty to substantiate rested on the controller, “er een verzwaarde motiveringsplicht rust op Uber”, because the information lay largely in its own domain. That is a Dutch procedural doctrine rather than a rule of the Regulation, so it does not travel to another Member State’s courts on its own; the practical point does. A controller that cannot document what its reviewers did will lose the argument about whether they did anything.

Appellant sub 3 is the one it is easiest to get backwards. For him the court held the deactivation was not solely automated, because Uber had “onbetwist gesteld”, asserted uncontested, that “een persoonlijk gesprek heeft plaatsgevonden” before it: somebody had spoken to him first. He is the driver who lost on this point. The judgment says nothing about the software or the team in his case, and the four cases differ on dates, allegations and letters, so the framing of one company, one system and four otherwise identical drivers is not available.

Two things about our own use of it. This is a failure of substantiation under a heightened duty, not a finding that no human decided. And the judgment’s status is unverified: no cassation appears in the judiciary’s record for the ECLI, read on 4 November 2026, which is absence from a register rather than proof none was lodged.

When it binds, and the fine with nothing to attach to

In the words our note for companies outside the EU already uses: after the Digital Omnibus on AI, Regulation (EU) 2026/1744, the heavy high-risk rules start on 2 December 2027 for Annex III uses and 2 August 2028 for AI in products covered by Annex I. Article 113’s third paragraph, point (c), defers “Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5)” to those dates. Article 14 sits in Section 2, and the Omnibus moved its date without changing a word of it. Two traps run in opposite directions: Article 14 does not bind today, and the Act is not waiting to apply, since Article 113’s second paragraph says “It shall apply from 2 August 2026” and only Chapter III Sections 1 to 3 are deferred.

The penalties arrived first. Chapter XII has applied since 2 August 2025, Article 101 excepted, so today there is a tier and nothing for it to attach to. Article 14 is named nowhere in Article 99: a provider reaches a fine through Article 16, point (a), a deployer through the “obligations of deployers pursuant to Article 26”, both deferred on the same clock, and Article 14 imposes no duty on a deployer as such. It can still land on one: under Article 25(1) a deployer that puts its name on a high-risk system, modifies it substantially or changes its intended purpose is “considered to be a provider” and takes on Article 16 with it.

The tier is up to “EUR 15 000 000” or, “if the offender is an undertaking”, up to “3 % of its total worldwide annual turnover”, whichever is higher. For an SME, Article 99(6) caps every fine in the article at “whichever thereof is lower”; for a small mid-cap, Article 99(6a), which the Omnibus added, caps only the Article 99(4) and 99(5) tiers, so a prohibited practice is not capped. Our note for companies outside the EU publishes the same split. Article 99(1) as it stands provides that a Member State’s rules “may also include administrative fines”, so availability turns on national implementation.

Article 113 of the consolidated AI Act, Article 99(2) of the GDPR. The last row is the only one here whose duty is owed to the person decided about; where the Act turns on a human step today it does so to buy an exemption (Article 50(4)) or to bar one use of one output (Article 5(3)).

What already binds you, today

Three layers reach a commercial build today, and none is Article 14. The first reaches only one kind of output, and it is worth knowing whether yours is it.

Article 50(4), second subparagraph. A deployer of a system that generates or manipulates text “published with the purpose of informing the public on matters of public interest” must “disclose that the text has been artificially generated or manipulated”, unless the content “has undergone a process of human review or editorial control” and a person “holds editorial responsibility for the publication of the content”. Two conditions, not one, and review is the price of an exemption rather than a duty. In force since 2 August 2026, fineable under Article 99(4), point (g), and bounded by Article 50(6): paragraphs 1 to 4 “shall not affect the requirements and obligations set out in Chapter III”.

Article 4. In force since 2 February 2025, and weaker since 27 July 2026 than it was: the duty to “ensure, to their best extent, a sufficient level of AI literacy” became measures “to support the development of AI literacy”, with a new sentence that it “does not require providers or deployers to guarantee any specific level of AI literacy”. The Act defines the standard, in Article 3(56), and requires nobody to reach it.

The GDPR, which is the real answer. Article 22 gives a data subject “the right not to be subject to a decision based solely on automated processing” with legal or similarly significant effect. An infringement of “the data subjects’ rights pursuant to Articles 12 to 22” sits in Article 83(5)’s upper tier, “administrative fines up to 20 000 000 EUR” or, “in the case of an undertaking, up to 4 %” of worldwide turnover, whichever is higher. “It shall apply from 25 May 2018.”

So of the two, the bigger number is the one in force, and it belongs to the instrument that does not require the review at all. That contrast is about Article 14 and this audience rather than the Act at large. Since 2 February 2025 Article 5(3) has barred a decision producing an adverse legal effect taken solely on the output of a real-time remote biometric identification system, a bar that sits inside a paragraph governing law-enforcement use in publicly accessible spaces under prior judicial authorisation, so it reaches no commercial deployer. Article 99(3) fines non-compliance with the Article 5 prohibitions at up to EUR 35 000 000 or, “if the offender is an undertaking”, 7 % of worldwide turnover, above the GDPR’s top tier. Article 26(10) carries the parallel bar for post-remote identification by law enforcement authorities, but it sits in Section 3 and arrives on Article 14’s own clock.

The test matters more than the tier, and it is not in the Regulation’s own words: Article 22(3) gives “at least the right to obtain human intervention on the part of the controller”, after the fact, on request, and only on the contract-necessity and explicit-consent bases. What closes the gap is WP251rev.01, the Article 29 Working Party guidelines, endorsed by the European Data Protection Board in Endorsement 1/2018 and applied as the test by the Amsterdam court. “The controller cannot avoid the Article 22 provisions by fabricating human involvement.” The controller must ensure that “any oversight of the decision is meaningful, rather than just a token gesture”; the guidelines add that it should be “carried out by someone who has the authority and competence to change the decision”. Guidance rather than law, but endorsed and tested on facts. Said in our own voice: the instrument that reaches a review which decides nothing is data protection law, not the AI Act.

Two caveats. Our GDPR text is EUR-Lex’s consolidation of 4 May 2016, which cannot date itself to today. And Article 22 is under a live proposal, a second Digital Omnibus still in negotiation: the Council’s mandate document ST 14756/26 of 22 October 2026 carries its position “as agreed by the Permanent Representatives Committee at its meeting on 21 October 2026”, a “Mandate for negotiations with the European Parliament”, so no act has been adopted; and its Annex would replace Article 22. It marks the Council’s changes to the Commission’s proposal. The Commission would add to the contract-necessity limb “regardless of whether the decision could be taken otherwise than by solely automated means”, absent from the GDPR as it stands; the Council strikes those words and keeps the point in recital 38: that a decision “could also be taken by a human” is no bar. So the proposal runs toward permitting a solely automated decision where a human alternative exists, which the Council keeps only in a recital. Article 22 stands unamended, with a mandate to rewrite it agreed on 21 October 2026.

Two limits, because the right is routinely overstated. In SCHUFA, C-634/21, the Court held that a credit-reference agency’s “automated establishment of a probability value” about a person’s ability to meet future payments is itself Article 22(1) decision-making where a third party to which the value is transmitted “draws strongly on that probability value to establish, implement or terminate a contractual relationship”; it did not decide whether a token review inside one organisation takes a decision out of Article 22, which is the question the Amsterdam court reached on the facts. And there is no general right to a human decision, only to intervention afterwards, with a high threshold: “only serious impactful effects will be covered by Article 22”. The guidelines say it is difficult to be precise, and give as decisions that could cross it “decisions that affect someone’s financial circumstances, such as their eligibility to credit”, access to health services, the denial of an employment opportunity and access to education. For credit scoring bought in from an agency, SCHUFA has now settled it. Nor is we only sell to businesses an answer by itself, since personal data is “any information relating to an identified or identifiable natural person”.

Does review work? What is actually known

Across the experiments that have been run, the answer turns on which of the two is the better judge of the task. The largest synthesis we read is a “preregistered systematic review and meta-analysis of 106 experimental studies reporting 370 effect sizes” (Vaccaro, Almaatouq and Malone, Nature Human Behaviour, 2024).

Relative standing decides the sign. Where the human alone beat the system, the pair beat both (g = 0.46, 95% CI 0.28 to 0.66); where the system alone beat the human, the pair did worse than the system (g = −0.54, 95% CI −0.71 to −0.37), since “when AI outperformed humans alone, we found losses”. That is a finding and not a pre-ship rule: it comes from separate meta-analytic models fitted on the two subsets where each side was the better performer, and the paper’s results “only apply to the tasks, processes and participant pools” the researchers chose.

Both headline numbers, with the caveat on the flattering one. On average “human–AI combinations performed significantly worse than the best of humans or AI alone” (g = −0.23, 95% CI −0.39 to −0.07). And “The human–AI systems performed significantly better than humans alone” (g = 0.64, 95% CI 0.53 to 0.74). Different baselines, not two framings of one comparison, and neither figure may be given without the other. The caveat belongs to the second: on the primary synergy outcome “Egger’s regression did not indicate evidence of publication bias in the sample”, while on the human-augmentation outcome it “does point to publication bias in the sample” (β = 1.96, P = 0.002) and the authors state “we did not try to correct for potential publication bias”.

Where an oversight step sits, the pooled result is negative. The paper reports that “the vast majority (about 85%) of the effect sizes were for decision-making tasks”, defined as “those in which participants decided between a finite set of options” — what a reviewer approving or refusing an output does. That share is of the 370 effect sizes, not of the 106 experiments, and it is not one half of a split: the same sentence records “only about 10% of the effect sizes researchers studied were for creation tasks”. Among decision tasks “the pooled effect size for human–AI synergy was significantly negative” (g = −0.27, 95% CI −0.44 to −0.10).

The strongest negative is our own arrangement, at scale. Digital screening mammography in US community practice: 625,625 mammograms read for 323,973 women by 271 radiologists at 66 facilities, from 2003 to 2009. “Screening performance was not improved with computer-aided detection on any metric assessed”, and among the 107 radiologists who read both ways sensitivity was significantly lower with the aid (odds ratio 0.53, 95% CI 0.29 to 0.97).

An average of zero can hide opposite effects. A re-analysis of 50 readers and 180 mammograms found that “CAD helped the less discriminating readers but hindered the more discriminating readers”: sensitivity up 0.016 (95% CI 0.003 to 0.028) for the 44 least discriminating readers on 45 relatively easy, mostly machine-detected cancers, and down 0.145 (95% CI 0.034 to 0.257) for the 6 most discriminating on 15 relatively difficult ones, “despite the original study detecting no significant average effect”. The split is the paper’s method as much as its result: the thresholds that put 44 readers in one group and 6 in the other, and sorted the cancers by difficulty, were derived by stepwise regression from the same data after the fact, and the authors call the analysis exploratory. Nor does expertise protect a reviewer: of 265 physicians, “Physicians across expertise levels often failed to dismiss inaccurate advice regardless of its source”.

What to build, and what to tell the buyer

The research does name conditions a build controls. Every row comes from a source, with its limit beside it.

So: build Article 14(4)’s five capabilities now, because they are a good specification of what an interface owes a reviewer and not because they bind. And measure relative standing before shipping rather than assume the pair beats the parts: the person alone, the system alone and the two together, on the client’s task with the client’s people.

Then write the reviewer’s task into the instructions for use, not only into a policy. That is our reading, and it is conditional. From the same two dates, Article 26(1) will oblige a deployer to “take appropriate technical and organisational measures to ensure” it uses the system “in accordance with the instructions for use accompanying the systems”, so where the provider’s Article 14(3)(b) measures and its Article 13 instructions require the reviewer to do something a nominal approval does not, departing from them will breach the deployer’s own duty, fineable then through Article 99(4), point (e). Where the instructions ask nothing of the kind, the penalised text will not reach the conduct. We found no case law testing it, and the inversion is worth saying out loud: a provider who writes weak instructions lowers its customer’s exposure while raising the real risk.

What is not known

There is no published figure for how often a human reviewer catches a machine error in production. The 2012 review pools four clinical studies, in which a support system that was itself wrong “increased the risk of an incorrect decision being made by 26%” against a control group with no support (risk ratio 1.26, 95% CI 1.11 to 1.44), and the review calls that pooling “a small, indicative meta-analysis”; the 2024 meta-analysis reports effect sizes rather than catch rates; and NIST’s framework says the degree to which “humans are empowered and incentivized to challenge AI system output requires further studies”. Anyone quoting a percentage for what review catches is quoting nothing. We also found no assessment by an audit office, a parliament or an EU institution of whether oversight works: a gap in what we searched rather than a finding of absence.

No harmonised standard covering human oversight has its reference in the Official Journal either. The Commission asked CEN and Cenelec for ten “by 31 August 2025”, one on “human oversight of AI systems”, whose specifications “shall comprehensively cover all elements referred to in Article 14”. One reference has reached the Official Journal, EN 18286:2026, “Artificial intelligence – Quality management system for EU AI Act regulatory purposes”, which answers point 9 of the request, “quality management systems for providers of AI systems, including post-market monitoring processes”. Human oversight is point 5, and it has not arrived. Article 40(1)’s presumption runs only “to the extent that those standards cover those requirements or obligations”, so it confers nothing here, and the standard is sold rather than published: we have not read a clause of it.

One negative we can state exactly. Across the five model-provider policies we read — the four our note on what already binds your AI build names, plus OpenAI’s, which that note could not reach — a normalised search for automation bias, over-reliance, undue reliance, rubber-stamping and their cognates returns no hit, and the only use of rely in any of them is the affected individual’s rather than the reviewer’s. That is a statement about those five documents and those search terms, nothing wider, and it is narrower still than it looks: Anthropic’s Commercial Terms of Service, the contract rather than the usage policy and effective since 17 June 2025, require that “Outputs are appropriate for Customer’s use case, including where human review is appropriate”, and AWS’s Responsible AI Policy says “Outputs should be evaluated for accuracy and appropriateness for your use case”. What none asks for is the capability Article 14(4)(b) names. Two of the five had not taken effect when we read them on 4 November 2026.