AI Vocabulary

Human oversight: at what point does someone actually review?

Human oversight means a person's involvement in the operation of an automated system. European regulation requires it for high-risk systems and leaves each organisation to define the level. Yet three very different levels go by the same name.

The three levels

Oversight in principle: a person can intervene, they have the technical means, and they do not do so systematically. It is the weakest level, and it is often what exists in practice when nothing has been decided.

Oversight by sampling: a person checks part of the output, according to a criterion set in advance. This level has value only if the criterion is objective and the sample is genuinely drawn.

Effective oversight: a person examines each result before it takes effect, with the means to correct or discard it. That is the only level at which the decision can be said to remain human.

What distinguishes the three in practice

Not intention, which is always good, but the trigger. An arrangement where control depends on the availability of whoever controls belongs to the first level, whatever the professional conscientiousness of the people involved.

An objective trigger — the nature of the deliverable, its recipient, the exposure of the matter — moves it to the second. Systematic prior control moves it to the third.

This is why a verification regime decided in the cold is worth more than an undertaking of vigilance: the first can be checked, the second is observed only after an incident.

The applicable level is also not uniform within an organisation. The same firm may fall under the third level for its court filings and the first for its internal notes, without inconsistency: it is the exposure of the deliverable that governs, not the status of the tool used.

What it does not solve

Oversight does not compensate for work the reviewer cannot assess. On a uniform text emitting no signal, an attentive review bears on everything and therefore on nothing in particular.

Nor is it strengthened by doubling it. Two reviewers facing a text that signals nothing produce no more information: the cost doubles, the yield does not.

And it does not protect against habituation. A control exercised 1,000 times without ever finding anything relaxes, which is documented in every profession where verification is routine.

What the regulation leaves to you

The text requires oversight measures to exist and to be proportionate to risk; it does not say which of the three levels applies to which output. That is for the organisation to define, and to be able to document.

A page suffices: which deliverables fall under which level, on what trigger, and who answers for it. That document also protects whoever reviews — they applied the prescribed regime, they did not exercise solitary judgement at eight in the evening.

A note on the regulation's own wording, which speaks of effective human oversight. The adjective is not decorative: it excludes precisely the first level, where the possibility of intervening exists without being exercised.

Why it matters to a lawyer

Because this is where regulatory compliance and professional responsibility meet. The regulation asks that someone supervise; your bar and your client ask that someone answer.

The same page addresses both, provided it describes a regime triggered by facts rather than by each person's residual vigilance.