Art. 26.2 EU AI Act: human oversight of high-risk AI

Updated: June 2026

Introduction: the meaning of human oversight

Art. 26.2 requires deployers to "ensure that the natural persons to whom human oversighthuman oversightDesigned-in human ability to monitor, intervene in, override or shut down an AI system — meaningful only when the human has authority, information and time to act.Open full entry → of high-risk AI systems is assigned have the necessary competence, training, and authority to perform that oversight." This is the legal anchor for what is commonly called the "four-eyes principle" in AI governance.

Human oversight is not a bureaucratic formality. It is the mechanism through which the EU AI Act maintains human agency in high-stakes automated decision-makingautomated decision-makingDecisions based solely on automated processing with legal or similarly significant effects — restricted by GDPR Article 22 to three exception grounds, with human-intervention safeguards.Open full entry →. An oversight process that is nominally in place but substantively ineffective, because the overseer lacks the competence to evaluate AI output, does not satisfy Art. 26.2.

Three requirements for valid oversight

1. competence

The overseer must understand the AI systemAI systemA machine-based system that, for explicit or implicit objectives, infers from input how to generate outputs — predictions, content, recommendations or decisions — that can influence physical or virtual environments. The OECD-style definition followed by the EU AI Act.Open full entry → sufficiently to critically evaluate its outputs. This is a substantive requirement, not a formal one. A manager who rubber-stamps AI credit decisions without understanding the scoring model's methodology does not provide qualified oversight.

Competence is assessed relative to the risk level: a higher-risk system (e.g. AI used in criminal justice) requires deeper technical understanding than a lower-risk high-risk system. The supervisory authority will evaluate whether the competence of the oversight function matched the complexitycomplexityThe governance-challenging characteristic where risk lives in the interactions of many components, suppliers and environments that no one can reason about whole — answered by system-level assessment and end-to-end testing.Open full entry → and risk level of the system.

2. training

Oversight requires formal training covering: the AI system's functioning and limitations, the types of errors the system is known to make, the interpretation of AI outputs and confidence scores, the process for overriding AI outputs, and the procedure for escalating concerns and reporting incidents.

Training must be documented (connecting to Art. 4 literacy obligations) and must be refreshed when the AI system is updated or when performance data reveals new failure modes.

3. authority

The overseer must have genuine decision-making authority. If an organisation's process requires AI output to be approved by a junior analyst whose recommendations can be overridden by a system automatically, there is no effective human oversight. The person with oversight responsibility must have the organisational authority to accept, reject, or modify AI-generated outputs.

Practical implementation

The four-eyes principle in HR selection

For CV screening AI (Annex IIIAnnex IIIThe EU AI Act's list of high-risk use-case areas — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice.Open full entry →, point 4), a compliant oversight process might look like: AI generates a ranked shortlist → HR officer (trained, documented) reviews each shortlisted and excluded candidate → HR officer approves final shortlist with written confirmation → manager independently reviews before interview invitation.

Non-compliant process: AI generates shortlist → system automatically sends interview invitations to top 5 candidates without human review.

Oversight logging

Art. 26.2 compliance requires documentation of oversight decisions. For each significant AI-assisted decision, log: the AI output, the overseer's assessment, whether the overseer agreed or overrode the output, and the rationale for override if applicable. This log is subject to the Art. 26.6 retention requirements.

Compliance checklist

1. Is there a named oversight function for every high-risk AI system?
2. Does the oversight function have documented competence in the AI system?
3. Has the oversight function received and documented training on the system?
4. Does the oversight function have organisational authority to override AI outputs?
5. Is there a log of oversight decisions with rationale for overrides?
6. Is oversight training refreshed when the AI system is updated?