AI Control Library / CF-07: Human Oversight & Escalation
Designation: Supplemental | Control types represented: Operational
Control requirement
Document AI personnel roles, responsibilities, authority limits, required skills and escalation routes in a form available to the people who perform and supervise the work. Maintain alignment with access and actual operations.
Why this matters
An organizational responsibility matrix may not tell a particular operator what they can approve or when they must seek help. Personnel documentation turns program-level accountability into usable role instructions.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
AI developers, operators, reviewers, approvers and responders, including deputies, contractors and shared teams.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The role owner maintains documentation with managers, HR, security and relevant domain specialists.
Implementation guidance
- Describe each role’s assigned tasks, decision limits, required evidence and relationship to other roles.
- Specify competency, coverage, reporting and emergency authority, identifying what remains outside the role.
- Communicate the instructions and align access, training and agreements with the approved duties.
- Review after staffing, system or workflow changes, preserving accountable handover of open work.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Ask an operator about a consequential action | Documented authority and escalation match the expected response. |
| Compare access with duties | Privileges support the role without unnecessary authority. |
| Review a handover | Outstanding tasks and coverage remain owned. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Role descriptions and authority
- Access and training alignment
- Communication and coverage
- Handover and review records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unowned work or authority conflicts to the manager and accountable process owner. Limit affected actions until role and access boundaries are clear.
Example in practice
Hypothetical example: A support reviewer can correct a proposed answer but cannot authorize a financial adjustment. The role instructions show the escalation route and access reflects the distinction.
Related controls
- CF01-005: AI Governance Responsibility Model
- CF07-008: AI Oversight Competency Training
- CF07-S06: AI Role Change Access Revocation
Framework mappings
- CSA AICM (HRS-09)
- NIST AI RMF (GOVERN 5.2)
- ISO 42001 (Cl. 5.3)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0