European UnionAI Act, Article 14 (human oversight)
Regulation (EU) 2024/1689, Article 14
Amended by Regulation (EU) 2026/1744, which moved its start date from to for a high-risk AI system classified under Article 6(2) and Annex III.
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment, Place of effect
- Obligation class
- Governance, Biometric
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are the provider of a high-risk AI system, design and develop it, including its human-machine interface, so that a natural person can effectively oversee it while it is in use.NIST AI RMFMAP 3.5
- Build oversight measures proportionate to the system's risks, autonomy and context of use, either into the system itself before it is placed on the market or put into service, or as measures you identify for the deployer to implement.NIST AI RMFMAP 3.5
- Provide the system to the deployer so that the natural persons assigned to oversee it can understand its capacities and limitations and duly monitor its operation, including detecting and addressing anomalies, dysfunctions and unexpected performance.NIST AI RMFMAP 2.2
- Provide the system so the assigned overseers can remain aware of the tendency to automatically rely or over-rely on its output, in particular where the system informs a decision a person will make.NIST AI RMFMAP 3.4
- Provide the system so the assigned overseers can correctly interpret its output.NIST AI RMFMEASURE 2.9
- Provide the system so the assigned overseers can decide, in a particular situation, not to use it, or can disregard, override or reverse its output.NIST AI RMFMANAGE 4.1
- Provide the system so the assigned overseers can intervene in its operation or interrupt it through a stop button or similar procedure that brings it to a halt in a safe state.NIST AI RMFMANAGE 2.4
- For a remote biometric identification system (Annex III point 1(a)), build your oversight measures so that no action or decision is taken on the identification result unless it has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority, except where the system is used for law enforcement, migration, border control or asylum and Union or national law treats that two-person requirement as disproportionate.NIST AI RMFMAP 3.5
- If you are a deployer of a high-risk AI system, assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.NIST AI RMFGOVERN 3.2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 3.2Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.
- MAP 2.2Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.
- MAP 3.4Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.
1 more
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.1.4-3Where oversight is a risk control, the technical measures behind it are built, verified and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(a): non-compliance with the obligations of providers under Article 16 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 16, point (a), requires a provider to ensure its high-risk AI system complies with the Section 2 requirements this row states; brought in by Article 16, point (a)'s reference to Section 2, which covers the Article 14 human oversight requirement; Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- What oversight measures are 'commensurate with the risks, level of autonomy and context of use' of a high-risk AI system under Article 14(3), for a system whose output a person reviews only after a decision has been drafted?
What it makes you log
Logging duty
Article 14 requires human oversight to be designed into a high-risk AI system and assigned by its deployer to competent people; it does not itself require a record of that oversight. The one place this chain names a record of an oversight act is Article 12(3)(d): for a remote biometric identification system, the identity of the natural persons who carried out the two-person verification Article 14(5) requires is what Article 12(3)(d) records, and Recital 73 adds that it could be sufficient for the separate verifications by the different persons to be automatically recorded in the logs the system generates.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Providers of a high-risk AI system must design and develop it, including its human-machine interface, so that a natural person can effectively oversee it while it is in use. Human oversight must aim to prevent or minimise the risks to health, safety or fundamental rights that may emerge when the system is used as intended or under reasonably foreseeable misuse, in particular where those risks persist despite the other Section 2 requirements.
The oversight measures must be commensurate with the system's risks, level of autonomy and context of use, built into the system before it is placed on the market or put into service, identified for the deployer to implement, or both, and the system must be provided to the deployer so that the assigned overseers can understand its capacities and limitations, monitor its operation, remain aware of the tendency to over-rely on its output, correctly interpret that output, decide not to use it or to disregard, override or reverse it, and intervene in or halt its operation through a stop mechanism.
For a remote biometric identification system under Annex III point 1(a), the oversight measures must ensure that no action or decision is taken on the identification result unless it has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority, except where the system serves law enforcement, migration, border control or asylum and Union or national law treats the two-person requirement as disproportionate.
A deployer of a high-risk AI system must separately assign that human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.
Article 14 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 14 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .