EDPS turns human oversight of automated decisions into testable requirements

The European Data Protection Supervisor published a checklist on 18 May 2026 that turns human oversight of automated decision-making into testable requirements: recorded roles and escalation, training against automation bias, genuine override and stop options, logging of interventions and periodic audits. A formal 'human in the loop' only counts once you can demonstrate per workflow that the reviewer understands, can intervene and that this is recorded.

The European Data Protection Supervisor (EDPS) is the EU data protection supervisor for the EU institutions, bodies, offices and agencies addressed by the checklist. Unlike the EDPB, which is a separate EU body with a coordinating role for national data protection authorities, the EDPS exercises its own supervisory mandate.; with this the supervisor makes the question practical: not is a human involved, but does that human have demonstrable oversight. That distinction touches every organisation that uses AI in sensitive or high-trust decisions, from credit assessment to medical triage and legal case handling.

What exactly does the EDPS checklist say about human intervention?

The EDPS translates human intervention into concrete organisational and technical controls. According to the checklist of the European Data Protection Supervisor, the checklist calls for documented responsibilities and escalation procedures, training for reviewers on system limitations and failure scenarios, logging of overrides and decisions, and reassessment after system updates. The document is formally addressed to EU institutions, bodies, offices and agencies, but can also serve as a practical reference framework for other organisations.

The most important elements at a glance:

• Roles, responsibilities and escalation routes are formally recorded.
• Reviewers receive training on system limitations, failure scenarios and automation bias, the tendency to follow a machine outcome too readily.
• For high-impact decisions, the checklist identifies review by more than one person as a control that may be appropriate.
• Overrides, audit trails and decision logs are kept.
• Periodic audits are conducted, with reassessment after system updates.

The checklist is a guideline and not a new law. It may be relevant alongside applicable rules on data protection and automated decision-making, but the concrete GDPR rights and obligations depend on the system, the context and the applicable framework. For high-risk AI it aligns in parts with the requirements for human oversight in Article 14 of the EU AI Act; the concrete legal application depends on the system, the context and the applicable framework.

Why is the presence of a human not in itself effective oversight?

Because a reviewer without understanding, time or authority corrects nothing in practice. A peer-reviewed study in AI and Ethics on designing meaningful human oversight describes why formal involvement is insufficient: without room for judgement, organisational embedding and awareness of automation bias, the human becomes a rubber stamp rather than a brake.

In our assessment this is an important point at which human-in-the-loop arrangements can fail. Our analysis: a reviewer who has to approve hundreds of outcomes a day may in practice have insufficient room for a substantive assessment; the oversight may then exist on paper without functioning effectively within the workflow.

How does the checklist align with Article 14 of the EU AI Act?

Article 14 of the AI Act requires that high-risk AI systems can be effectively overseen by natural persons. According to the explanation of the European Commission's AI Act Service Desk on Article 14, the overseer must understand the capabilities and limitations of the system, recognise automation bias, interpret the output correctly, be able to disregard or override it and be able to safely interrupt the system.

In our analysis the EDPS checklist touches the same themes as Article 14, but from its own reference framework: it does not ask whether the requirements are on paper, but how you demonstrate that a reviewer can genuinely intervene, with what authority, after what training and with what recording. Note: not every AI decision falls under Article 14; the provision applies to high-risk systems. In our analysis, however, the checklist is more broadly applicable than Article 14 and is also useful outside the category of high-risk systems as a reference framework for demonstrable human oversight.

What does this mean for executives, lawyers and CISOs who deploy AI in sensitive decisions?

Our analysis: because the EDPS translates human oversight into time, authority and recording, the deploying organisation must be able to demonstrably substantiate its oversight process; therefore you record per workflow who may take the decision, at which threshold a second assessor is required and along which route escalation happens. Because a reviewer without room to choose effectively corrects nothing, in our assessment a high decision speed is a governance risk for lawyers and compliance; therefore you set a maximum review load per person and build the workflow so that deviating and stopping are genuine, permitted actions, not exceptions that cost face. Our analysis: when a model change is not recognised in time, earlier control measures may no longer be appropriate or demonstrably effective. Therefore you couple change management to a reassessment of the control measures before a new version goes live. Our analysis: without a log of overrides and decisions it is harder afterwards to reconstruct and explain the oversight procedure followed; therefore you now record which model output, which source evidence, which reviewer and which authority belong to each decision, in line with the independent check between AI analysis and formal decision and with recording AI actions for later reconstruction.

As a summary of that analysis, to be recorded per workflow before a system is put into use:

• The decision authority: who may take the decision and who may not.
• The review threshold: at which impact a second assessor is required.
• The required expertise and training, including awareness of automation bias.
• The escalation route and the concrete stop procedure in case of doubt.
• The logging: output, source evidence, reviewer, authority and outcome.
• The reassessment after each model update, coupled to change management.

For a separate discussion of automated decision-making and human intervention, see our related analysis of automated deactivation workflows. For a broader placement of these requirements, our topic hub on AI governance and human oversight is the starting point. Those who design human oversight in advance as a testable process are, in our assessment, in a stronger position if that oversight is later called into question.

Sources: The article draws on the EDPS checklist on human intervention, a study in AI and Ethics and the European Commission's explanation of Article 14 of the EU AI Act.