Summary
The short answer
Under Article 14 of Regulation (EU) 2024/1689 a human oversight measure must let a named person do four things: understand the system's capacity and limits, notice automation bias, disregard, override or reverse the output, and interrupt the system. An oversight step that can only record a comment satisfies none of them.
The checklist, mapped to the statute
Each row is a capability the text requires, followed by the design decision it constrains. Work down it against a system you already run.
| Required capability | Source | What it constrains |
|---|---|---|
| The overseer understands the system's capacities and limitations | Art. 14(4)(a) | Documentation and training, not tooling |
| The overseer stays aware of automation bias, especially where output informs a human decision | Art. 14(4)(b) | Interface design; do not pre-select the accept action |
| The overseer can correctly interpret the output | Art. 14(4)(c) | Show inputs and confidence, not just the result |
| The overseer can decide not to use the output, or disregard, override or reverse it | Art. 14(4)(d) | The gate must block, and reversal must be a real code path |
| The overseer can intervene or interrupt the system, including by a stop function | Art. 14(4)(e) | A stop control that halts in-flight work, not only new work |
| Oversight is assigned to natural persons with the competence, training and authority to do it | Art. 26(2) | Named individuals and real authority, not a shared mailbox |
Two adjacent points that are routinely missed. Whether any of this binds you at all is decided by Article 6 together with Annex III, so classification comes before design. And the high-risk obligations apply from 2 August 2026, while the Regulation itself entered into force on 1 August 2024, so a system in build today is in scope on delivery.
Where the other two frameworks agree
Two further published frameworks describe the same control from different angles, and citing them is useful where a counterparty has adopted one rather than the Regulation.
- NIST AI Risk Management Framework 1.0 (AI 100-1, released January 2023) organises the work under four functions, GOVERN, MAP, MEASURE and MANAGE, and treats accountability as something designed in rather than added. Available at nist.gov/itl/ai-risk-management-framework. It is voluntary guidance, not law.
- ISO/IEC 42001:2023, the first AI management system standard, requires defined roles and documented control over AI-assisted processes, and is certifiable, which is what makes it useful in procurement. Catalogued at iso.org/standard/81230.html.
None of the three asks whether a person saw the output. All three ask whether a person could have changed it.
Three things this checklist cannot tell you
Stated plainly, because a checklist that implies completeness is worse than one that admits its edges.
- Whether you are in scope. Article 6 and Annex III decide that, and the classification turns on your use case rather than on your architecture. This checklist assumes the answer is yes.
- How much latency an interruption may take. Article 14(4)(e) requires the capability and does not quantify it. If your system acts in milliseconds, the enforceable reading of a stop function is unsettled and you should take advice rather than infer one.
- Whether an agent may review another agent's output. The text speaks of natural persons. An agent-to-agent check is a quality control and, on the face of Article 14, does not discharge the oversight obligation.
FAQ
Does an approval email count as human oversight?
Only if it gates the action. Article 14(4)(d) of Regulation (EU) 2024/1689 requires the ability to disregard, override or reverse the output, so a message sent after the action has completed is a notification and not an oversight measure.
When do the high-risk obligations start to apply?
2 August 2026. The Regulation entered into force on 1 August 2024, with obligations phased after that, so systems being built now are in scope by the time they ship.
Can one person oversee many automated workflows?
Article 26(2) requires competence, training and authority rather than a ratio, so the text sets no numeric limit. The practical constraint is that oversight decays into rubber-stamping as volume rises, which is a design problem the statute leaves to you.
Is a stop button enough on its own?
No. Article 14(4) lists the capabilities together, so interruption without interpretability, or override without authority, leaves the measure incomplete.
How does this relate to Dave by voolama?
Dave by voolama (hellodave.ai) is an AI workflow orchestration platform, so these are the obligations that shape where a review step belongs in a workflow built on it. The checklist above is drawn from the published texts and applies whatever platform you use.