EU AI Act Article 14: Human Oversight and Stop Buttons
Article 14 requires high-risk AI systems to allow effective human oversight. This guide covers the abilities overseers need, the stop button and common oversight patterns.
Providers of high-risk AI systems must design them so that people can oversee them effectively while they are in use (Article 14).
Overseers must be able, as appropriate and proportionate, to understand the system, monitor it, override its output and stop it. This applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) to systems placed on the EU market or put into service. Fines reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: list the controls your system gives its overseers.
Overseers must be able to understand, monitor, override and stop the system
Article 14(4) lists five abilities that the system must enable, as appropriate and proportionate. The provider builds some measures into the system and identifies others for the deployer to implement (Article 14(3)).
Understand and monitor
Overseers can properly understand the system’s capacities and limitations and monitor its operation, including detecting and addressing anomalies, dysfunctions and unexpected performance (Article 14(4)(a)).
Stay aware and interpret correctly
Overseers stay aware of automation bias, the tendency to rely too much on the system’s output, and can interpret the output correctly (Article 14(4)(b) and (c)).
Override and stop
Overseers can decide not to use the system, or to disregard, override or reverse its output. They can also intervene in the operation of the system, or interrupt it through a ‘stop’ button or similar procedure that lets it come to a halt in a safe state (Article 14(4)(d) and (e)).
Two-person check for remote biometric identification
For Annex III point 1(a) systems, the deployer may act on an identification only after at least two people have verified it separately (Article 14(5)). These people need the necessary competence, training and authority. The rule does not apply to law enforcement, migration, border control and asylum where Union or national law finds it disproportionate.
Overseers must be able to bring the system to a safe halt
Article 14(4)(e) requires a ‘stop’ button or similar procedure that lets overseers interrupt the system and bring it to a halt in a safe state. The Act does not prescribe how; the three points below are design choices.
Emergency stop
Provide a control that halts the system in a safe state, and test that it works during system errors. One design: stop accepting new requests and let in-flight ones finish.
Fallback mode
Decide what happens after a stop: route cases to human reviewers, use rule-based defaults or pause entirely. Document and test the fallback.
Log of stops and overrides
Record each stop and override with time, operator, reason and system state. This is a design choice that gives you evidence of how oversight worked.
Oversight measures must match risk, autonomy and context
Article 14(3) requires oversight measures that fit the system’s risks, level of autonomy and context of use. The three patterns below are common design terms, not terms of the Act.
Human-in-the-Loop
A person approves each decision before it takes effect. It suits decisions with serious consequences.
Human-on-the-Loop
The system runs on its own; a person monitors it and can intervene at any time.
Human-in-Command
A person sets the limits and conditions of use and can override any decision or shut the system down.
Article 14 applies to high-risk AI systems only
A system is high-risk if it falls into an Annex III area, unless an Article 6(3) exemption applies. A system that profiles natural persons is always high-risk. A system is also high-risk if it is, or is a safety component of, an Annex I product needing third-party conformity assessment (Article 6). Providers are covered when they place a system on the EU market or put it into service in the EU, wherever they are established (Article 2(1)(a)). Providers and deployers in a third country are also covered when the system’s output is used in the EU (Article 2(1)(c)). High-risk systems tied to products under the Annex I Section B laws are outside Article 14 (Article 2(2)). For Annex I Section A products, some requirements may be limited (Article 2(13)). This concerns Articles 9 to 15 and 17 to 25, where sector law gives equivalent or higher protection. Delegated acts due by 2 August 2027 will specify which. The Act excludes military, defence and national security uses, systems developed solely for scientific research, and research and testing before market placement (Article 2(3), (6) and (8)). Systems already on the market or in service before the application date are covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).
Common questions: overseers, dashboards, responsibility and fines
Who qualifies as a human overseer?
A natural person with the necessary competence, training and authority, plus the support they need. The deployer assigns oversight to such people (Article 26(2)), and the system must enable them to understand it, override it and stop it (Article 14(4)).
Is a dashboard enough?
No. A dashboard supports monitoring (Article 14(4)(a)), but overseers must also be able to override or reverse output and to stop the system (Article 14(4)(d) and (e)). Add controls next to the dashboard.
Who is responsible, the provider or the deployer?
Both. The provider identifies the oversight measures before placing the system on the market or putting it into service. It builds them in where technically feasible, identifies them for the deployer to implement, or does both (Article 14(3)). The deployer assigns competent people and uses the system in line with the instructions (Article 26(1) and (2)).
What are the fines, and is the cap lower for SMEs?
Fines for providers (Article 16) and deployers (Article 26) reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs, including start-ups, and small mid-caps, the cap is the lower of the two amounts (Article 99(6) and (6a)). Member States lay down the penalty rules (Article 99(1)).
Read next: risk management, record-keeping and deployer duties
Article 9: Risk Management
Oversight aims to prevent or minimise risks to health, safety and fundamental rights, in particular where they persist despite the other requirements (Article 14(2)).
Article 12: Record-Keeping
Logs support monitoring of the system; remote biometric identification systems must log who verified results.
Article 26: Deployer Obligations
Deployers assign oversight to competent people and use the system in line with its instructions.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.