Human oversight of AI: what does the law require, and how do you do it?
Short answer
Human oversight means that a person with the right competence and authority understands the AI's strengths and weaknesses, spots errors, doesn't trust it blindly, and can override or stop it. The EU AI Act requires it for high-risk AI (Article 14 for providers, Article 26 for deployers). Article 22 GDPR already requires today that decisions with significant effects on people are not solely automated. In practice: one case at a time, a real option to say no, a reason and a log.
Try it yourself
Here are three fictional cases. The AI has made a recommendation; you decide. Choose a different decision and see that you have to give a reason.
Case facts
Louise Brennan
- Current title
- Senior controller
- Experience
- 12 years
- CV
- Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
The AI’s recommendation
Invite to interview
Reasoning: 12 years' experience in budgeting and reporting, has implemented an ERP system and comes from a manufacturing company.
The AI is unsure about:
Audit log
- Decisions are saved here with the time and a timestamp.
Fictional data. Your decisions are only stored in your browser.
Why one case at a time?
When lots of cases are shown at once, it's tempting to approve them all. One case at a time, with the facts and the recommendation shown separately, makes it easier to think for yourself – and that is exactly what the law is after.
Why a log?
Without a log, you cannot show that oversight took place. GoalCube stores every decision with the time, the reason and a chain of checksums, so the log cannot be quietly altered, and with independent timestamps.
What to do
- Choose the right people.Someone with expertise and the authority to say no – not just whoever has time.
- Show the facts and the recommendation separately.The human must be able to see the basis, not just the AI's conclusion.
- Make it easy to say no.Three choices: approve, choose a different decision or ask for more information.
- Require a reason when the human disagrees.It documents that the assessment was real.
- Keep the log.Who decided what, when and why – stored so it cannot be changed afterwards.
What the law says
- Article 14 AI Act – human oversight
- High-risk AI must be designed so that humans can oversee it effectively, including guarding against automation bias.
- Article 26(2) AI Act
- The deployer must assign oversight to people with the necessary competence, training and authority.
- Article 22 GDPR
- The right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.
Questions and answers
Is it enough for an employee to click 'approve'?
No. Oversight must be real. If the person always clicks approve without reading, that is automation bias – not human oversight.
Does a human need to see every case?
For high-risk AI and decisions about people: yes, every case. For low-risk uses, automated rules may be enough.
What is automation bias?
The tendency to rely too much on a machine's suggestions. The EU AI Act mentions it directly in Article 14.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.