The human oversight duty

Several regimes converge on the same requirement. The EU AI Act obliges high-risk systems to be designed so they can be effectively overseen by natural persons, able to understand the system, intervene, and stop it, and it explicitly targets automation bias, meaning the operator who rubber-stamps whatever the machine proposes. Employment uses including recruitment, promotion decisions, and task allocation are classed high-risk.

ISO/IEC 42001 provides a certifiable AI management system. The NIST AI Risk Management Framework organizes practice around govern, map, measure, and manage. CMMC governs the US defense base. The word doing the work across all of them is effective: oversight that is nominal, retrospective only, or impossible because the system runs too fast does not satisfy it.

Timelines have moved. High-risk obligations under the EU AI Act have been subject to deferral under the Digital Omnibus, so confirm current dates with counsel before building compliance claims on them.