AI Control Library / CF-07: Human Oversight & Escalation
Designation: Core | Control types represented: Operational
Control requirement
Train and assess personnel responsible for AI oversight on the specific system, limitations, evidence, intervention authority and response procedures. Verify competence through practical tasks before assigning consequential responsibility.
Why this matters
Attendance at a general AI course does not establish that an operator can recognize a relevant failure or stop the actual system. Training must support the decisions the role is expected to make.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
Reviewers, approvers, supervisors and responders assigned to consequential AI workflows, including deputies and outsourced operators.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The process owner defines competence with domain and training specialists; managers authorize duties based on demonstrated ability.
Implementation guidance
- Identify role-specific skills, known failure modes, required evidence and intervention tasks.
- Provide instruction using actual interfaces and safe scenarios, addressing overreliance, uncertainty and limits of generated explanations.
- Assess review, override, escalation and stopping through practical exercises with recorded feedback.
- Refresh after material changes or observed gaps, providing support and coverage while personnel build required competence.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Present a relevant erroneous result | The operator identifies the issue and applies the appropriate review or escalation. |
| Exercise an intervention | The person can use their actual authority and interface. |
| Inspect a training record | Competence evidence supports assignment rather than attendance alone. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Role competency specification
- Training materials and system versions
- Practical assessment results
- Authorization and refresher records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unmet competence needs to the process owner and manager. Restrict unsupervised oversight responsibility until training, support or reassignment resolves the gap.
Example in practice
Hypothetical example: A reviewer passes a model-awareness quiz but cannot locate the refund hold control. Practical assessment identifies the gap before the reviewer is assigned to a live payment workflow.
Related controls
- CF07-003: Human-in-the-Loop Configuration & Adequacy
- CF07-004: AI Escalation Paths & Triggers
- CF07-S11: AI Security Awareness Training
Framework mappings
- CSA AICM (HRS-14)
- NIST AI RMF (GOVERN 5.2)
- EU AI Act (Art. 14(4))
- ISO 42001 (Cl. 7.2, A4.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0