Human Oversight Procedure for AI Systems

How to use this document

• What it is for. This is a base procedure to make human oversight of AI systems real rather than symbolic: it defines when a person must step in, with what skills, authority, time and information, how they review outputs (including adverse outputs and the cases the tool screens out), when they may stop the system and what evidence is kept.
• Who should own it. Usually operations or the owner of the process that uses AI, with the AI committee validating. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide which systems are in scope (Section 2), which oversight mode each one gets (Section 5), what share of screened-out or adverse cases is reviewed (Section 8), who may stop a system without prior approval (Section 9) how input data are controlled (Section 10) and which indicators reveal rubber-stamp oversight (Section 11).
• Fields to complete. Replace the bracketed fields, such as [ORGANIZATION NAME], [AI COMMITTEE], [REVIEW FREQUENCY] and [COMPLETE]. Complete one configuration sheet (aid A) for each AI system. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This document has no country variants. The authority positions cited in Section 4 serve as a common reference; use "Related regulatory references" to identify which laws apply to your organization and adjust Sections 8, 12 and 13 if any of them requires something more.
• Review. Have internal or external counsel review the adapted version, especially its interaction with rights regarding automated decisions, information to workers and their representatives, and retention periods.
• Approval and publication. Have it approved by the AI committee or management, record the approval in "Version history," give it to every oversight person together with the training in aid G, and tell system owners which sheets they must complete.

Human Oversight Procedure for AI Systems

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Procedure owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 This procedure sets out when, how and with what evidence a person intervenes in processes of [ORGANIZATION NAME] that are supported by AI systems.

1.2 Its aim is effective human oversight: the people who oversee have a real ability to understand, question, correct, override or stop the outputs of an AI system, and that ability is exercised and documented.

1.3 This procedure supplements the responsible AI use policy, the impact assessment of each system, the procedure for reviewing automated decisions at the request of affected people and the AI incident response plan.

2. Scope

2.1 Human oversight under this procedure is mandatory, at a minimum, when an AI system:

a) decides, recommends, scores, classifies or ranks people in recruiting, hiring, evaluation, promotion, task allocation, discipline or dismissal;
b) influences access to credit, insurance, housing, education, healthcare, benefits or essential services, or their price or terms;
c) is used in activities that the organization or applicable law classifies as high risk;
d) processes sensitive data or data about people in vulnerable situations, such as minors;
e) can restrict, suspend or close a person's account or access to a service or platform;
f) takes actions on its own (AI agents) with effects on people, critical systems or confidential information;
g) does not yet have enough evidence of stable performance, or its outputs are hard to explain or verify at a glance.

2.2 For other AI systems, the output review required by the responsible AI use policy is enough, unless the AI committee decides to apply this procedure.

2.3 It applies to systems developed in-house and to those acquired from vendors. When the vendor provides oversight features (thresholds, alerts, a stop function, explanations), the organization configures and uses them according to the vendor's instructions for use; when it does not, the organization puts equivalent controls in place within its own process.