{
 "slug": "eu-ai-act-article-14-human-oversight-playbook",
 "topic_id": "TOPIC-052",
 "cluster": "Regulatory & Sovereign AI",
 "tier": "Tier A",
 "title": "Article 14 asks who the natural person was. Your logs do not know.",
 "summary": "The EU AI Act requires that high-risk systems be overseen by natural persons and that records identify who verified what. Conventional logging records system state and stops there.",
 "lede": "An oversight obligation phrased around natural persons meets a logging stack designed around events. The gap is not subtle: one asks who a person was, the other records that a field changed.",
 "date": "2026-05-05",
 "category": "Compliance",
 "author_id": "elias-vanterpool-osei",
 "tags": [
  "EU AI Act",
  "Article 14",
  "human oversight",
  "record keeping",
  "compliance",
  "governance"
 ],
 "image_title": "Article 14 Natural Person Records",
 "schema": "Article",
 "key_takeaways": [
  "Article 14 is about a natural person's capacity to oversee; Article 12 is about records that make oversight demonstrable. They work together.",
  "Typical application logs record a decision outcome and an account identifier, which does not identify a natural person or what they were shown.",
  "A signed statement recording the rendered output, the reviewer's credential and its verification state closes the gap with a small change to the review path."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Reading the two articles together"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "The gap, in one line",
   "caption": "The log ends where the obligation begins.",
   "nodes": [
    {
     "label": "Input received",
     "note": "logged"
    },
    {
     "label": "Model output produced",
     "note": "logged"
    },
    {
     "label": "Rendered to a person",
     "note": "not logged",
     "bad": true
    },
    {
     "label": "Person formed a view",
     "note": "not logged",
     "bad": true
    },
    {
     "label": "Action taken",
     "note": "logged, with a user id",
     "bad": true
    }
   ]
  },
  {
   "type": "table",
   "head": [
    "Provision",
    "Substance"
   ],
   "rows": [
    [
     "Article 14 — human oversight",
     "High-risk systems are designed so natural persons can effectively oversee them during use"
    ],
    [
     "Article 14 — capacity",
     "Oversight persons must be able to understand output, interpret it correctly, decide not to use it, and intervene or halt"
    ],
    [
     "Article 12 — record-keeping",
     "Systems technically allow automatic recording of events over their lifetime, enabling traceability"
    ],
    [
     "Together",
     "Oversight must be real, and there must be records that make it demonstrable"
    ]
   ]
  },
  {
   "type": "p",
   "html": "An organisation can satisfy Article 14's design requirements — a person can intervene — while having no records that show anyone did. That is the common posture today."
  },
  {
   "type": "h2",
   "text": "What a typical log holds"
  },
  {
   "type": "code",
   "text": "{\n  \"ts\": \"2026-09-11T14:22:01Z\",\n  \"event\": \"decision.reviewed\",\n  \"model\": \"risk-scorer-v4\",\n  \"case_id\": \"C-88213\",\n  \"outcome\": \"accepted\",\n  \"user_id\": \"u_4471\"\n}\n\n# Establishes: a request reached the service with a session\n#              associated with account u_4471.\n# Does not establish: a natural person was present,\n#              what they were shown, or that they read it."
  },
  {
   "type": "p",
   "html": "Three specific deficiencies. <code>user_id</code> is an account, not a person. <code>outcome</code> is a field, not a decision anyone attested to. And nothing records the rendered output the reviewer supposedly interpreted."
  },
  {
   "type": "h2",
   "text": "What a record that answers the question contains"
  },
  {
   "type": "code",
   "text": "{\n  \"statement\": {\n    \"system\": \"risk-scorer-v4\",\n    \"case\": \"C-88213\",\n    \"model_output\": {\n      \"score\": 0.83, \"band\": \"decline\",\n      \"top_factors\": [\"payment_history\", \"debt_ratio\", \"tenure\"]\n    },\n    \"rendered_text_digest\": \"sha256:9c1f...a83e\",\n    \"reviewer_decision\": \"override_to_approve\",\n    \"reviewer_rationale\": \"[free text entered by the reviewer]\",\n    \"reviewed_at\": \"2026-09-11T14:22:01Z\"\n  },\n  \"signature\": \"...\",\n  \"credential\": { \"id\": \"...\", \"user_verified\": true,\n                  \"enrolled\": \"2025-11-04\" },\n  \"issuer_countersignature\": \"...\"\n}"
  },
  {
   "type": "p",
   "html": "The <code>rendered_text_digest</code> is the element that is almost always missing and the one that matters for Article 14's interpretation requirement. It binds the record to what was actually on screen, which is what a person could have interpreted."
  },
  {
   "type": "h2",
   "text": "Where this bites in practice"
  },
  {
   "type": "p",
   "html": "Not at deployment. At the first supervisory request or the first contested decision, when someone asks to see the oversight records for a specific case."
  },
  {
   "type": "ul",
   "items": [
    "A data subject contests an automated decision and asks what human review occurred",
    "A supervisory authority requests records for a sample of decisions",
    "An incident occurs and the question is whether oversight was operating at the time",
    "A conformity assessment examines whether the oversight design functions in use"
   ]
  },
  {
   "type": "p",
   "html": "In each case the answer \"our logs show the decision was accepted by account u_4471\" is unlikely to satisfy the person asking."
  },
  {
   "type": "h2",
   "text": "Scoping this so it stays workable"
  },
  {
   "type": "p",
   "html": "High-risk systems can produce large decision volumes, and requiring a signature on every one would collapse throughput and produce reflexive approval — which would itself undermine Article 14's effectiveness requirement."
  },
  {
   "type": "table",
   "head": [
    "Decision type",
    "Record"
   ],
   "rows": [
    [
     "Automated, within configured bounds, no human review",
     "System log; the oversight design is the control"
    ],
    [
     "Human confirms the system's output",
     "Lightweight attestation"
    ],
    [
     "Human overrides the system",
     "<strong style=\"font-weight:600\">Signed record with rendered digest and rationale</strong>"
    ],
    [
     "Decision with legal or significant effect on a person",
     "<strong style=\"font-weight:600\">Signed record with rendered digest and rationale</strong>"
    ],
    [
     "Human halts or intervenes",
     "<strong style=\"font-weight:600\">Signed record</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The overrides and interventions are the cases that get examined, and they are a small fraction of volume. That is what makes this tractable."
  },
  {
   "type": "h2",
   "text": "Sequencing before the obligations bite"
  },
  {
   "type": "ol",
   "items": [
    "Identify which of your systems are high-risk under the classification rules. This is a legal exercise and it gates everything else.",
    "For each, find the points where a natural person can override, halt or confirm.",
    "Determine what is currently recorded at those points. In most cases it is an account identifier and an outcome field.",
    "Add the rendered digest first — it is the cheapest change and the most commonly missing element.",
    "Add signatures on overrides, interventions and significant-effect decisions."
   ]
  },
  {
   "type": "p",
   "html": "Step four alone materially improves the record and requires no change to authentication. It is a reasonable first move for organisations still working out their classification."
  },
  {
   "type": "p",
   "html": "This describes regulatory structure at a general level and is not legal advice. Classification, applicability and timing are specific to your systems and deployment; take them to counsel."
  },
  {
   "type": "h2",
   "text": "A worked example: what a sufficient record contains"
  },
  {
   "type": "table",
   "caption": "Field by field",
   "head": [
    "Field",
    "Why it is there"
   ],
   "rows": [
    [
     "Identity of the natural person",
     "The Article asks who, not which account"
    ],
    [
     "Hash of what was rendered to them",
     "Establishes what they actually saw"
    ],
    [
     "The decision taken",
     "Approve, reject, or escalate"
    ],
    [
     "Timestamp from an external source",
     "So sequence survives challenge"
    ],
    [
     "<strong style=\"font-weight:600\">Signature from a credential bound at enrolment</strong>",
     "<strong style=\"font-weight:600\">Converts a claim into evidence</strong>"
    ],
    [
     "Issuer countersignature",
     "Ties it to your organisation, verifiable offline"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Rows two and five are the ones missing from every logging system in ordinary use, and they are the two the obligation actually turns on."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our audit log already has a user id.”</strong> A user id records which session executed an action. It does not record that a person saw the output, and session hijack, shared accounts and automation all break the inference."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“This means approving everything.”</strong> No. Scope it to the high-risk decisions with irreversible effect. For most systems that is a small fraction of the volume, and scoping it badly is the main way these programmes fail."
  },
  {
   "type": "p",
   "html": "This is a general reading of the structure, not legal advice. Classification and obligations depend on the system and the facts."
  }
 ],
 "faq": [
  {
   "q": "Does Article 14 require a signature?",
   "a": "It does not specify a mechanism. It requires effective oversight by natural persons, and Article 12 requires records enabling traceability. A signature is one way to make the record demonstrable."
  },
  {
   "q": "Why does the rendered digest matter?",
   "a": "Article 14 requires that the person can correctly interpret the output. A record that does not capture what was displayed cannot show what there was to interpret."
  },
  {
   "q": "Do all decisions need signed records?",
   "a": "No, and requiring it would undermine effectiveness by producing reflexive approval. Overrides, interventions and significant-effect decisions are the cases that get examined."
  },
  {
   "q": "What should we do first?",
   "a": "Capture the rendered digest at oversight points. It is the cheapest change, requires no authentication work, and is the element most commonly absent."
  },
  {
   "q": "Is a user id enough?",
   "a": "No. It records which session acted. Shared accounts, session hijack and automation all break the link to a person."
  },
  {
   "q": "Does this mean approving every output?",
   "a": "No. Scope it to high-risk decisions with irreversible effect — usually a small fraction of volume."
  },
  {
   "q": "Why must records verify offline?",
   "a": "So an authority can check them without calling your systems, years later, possibly after the vendor is gone."
  }
 ],
 "sources": [
  {
   "t": "Regulation (EU) 2024/1689 (AI Act) — consolidated text",
   "u": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"
  },
  {
   "t": "Regulation (EU) 2024/1689 — Article 6 and Annex III",
   "u": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"
  },
  {
   "t": "ISO/IEC 42001 — AI management systems",
   "u": "https://www.iso.org/standard/81230.html"
  },
  {
   "t": "Published supervisory authority commentary on automated decision oversight."
  }
 ],
 "related": [
  {
   "slug": "annex-22-ai-oversight-receipt",
   "title": "EU GMP Annex 22",
   "category": "Developer"
  },
  {
   "slug": "ccpa-admt-regulations-californias-automated-decision-making-rules",
   "title": "California's automated decision-making rules",
   "category": "Compliance"
  },
  {
   "slug": "nist-ai-rmf-1-0-vs-cryptographic-reality",
   "title": "Mapping NIST AI RMF to real controls",
   "category": "Comparison"
  },
  {
   "slug": "global-sovereign-ai-oversight-repository-open-source",
   "title": "Tracking human-oversight mandates across jurisdictions",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Article%2014%20Natural%20Person%20Records/1500_900/blog.jpg",
 "wordcount": 1044,
 "url": "/blog/eu-ai-act-article-14-human-oversight-playbook.html",
 "reading_time": "5 min read",
 "seo_title": "EU AI Act Article 14: who was the natural person?",
 "meta_description": "The EU AI Act requires that high-risk systems be overseen by natural persons and that records identify who verified what.",
 "hub": {
  "slug": "topics/ai-oversight-regulation",
  "title": "AI oversight and regulation"
 },
 "answer": "The natural person. High-risk systems must be effectively overseen by people, and records must let you identify who verified what. Conventional logs record system state, model version and a user id — none of which establishes that an identified human saw the output and formed a view.",
 "answer_q": "What does Article 14 need that your logs do not have?",
 "glossary": [
  {
   "term": "Natural person",
   "def": "A human being, as distinct from an account, role or organisation."
  },
  {
   "term": "Effective oversight",
   "def": "Oversight with real authority and real information — the ability to intervene, not just observe."
  },
  {
   "term": "Rendered effect",
   "def": "What the system will actually do, shown to the overseer in terms they can judge."
  }
 ],
 "checklist": {
  "title": "Sequencing before the obligations bite",
  "id": "article14",
  "desc": "Five steps.",
  "steps": [
   {
    "name": "Classify which systems are high-risk.",
    "text": "The scoping decision drives everything."
   },
   {
    "name": "Identify the oversight point in each.",
    "text": "Where a person could actually intervene."
   },
   {
    "name": "Render the effect, not the prompt.",
    "text": "The person must see what will happen."
   },
   {
    "name": "Capture a signature at that point.",
    "text": "From a credential bound at enrolment."
   },
   {
    "name": "Keep records verifiable offline.",
    "text": "So an authority can check without calling you."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav captures exactly what Article 14 asks for: an identified natural person's signature over the rendered effect, countersigned and verifiable offline.",
  "href": "../docs.html",
  "label": "See oversight records"
 }
}