AI Control Library / CF-07: Human Oversight & Escalation
Designation: Core | Control types represented: Operational
Control requirement
Establish human oversight policy and procedures defining which AI decisions and actions require review, who may intervene, what information they need and how to override, escalate or stop activity.
Why this matters
Human responsibility is nominal if reviewers lack authority, information or a usable intervention route. Policy must translate oversight into work that can be performed under realistic operating conditions.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
AI-supported decisions and actions where human oversight is required by risk, organizational policy or applicable obligations.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The accountable business owner approves oversight with AI risk and domain specialists; operations maintains procedures and coverage.
Implementation guidance
- Identify consequential workflows and the review or intervention needed before, during and after AI activity.
- Define authority, competence, coverage, information access and acceptable review conditions, including absence and emergencies.
- Provide documented review, override, escalation and stopping procedures linked to technical enforcement.
- Exercise representative cases and revisit policy after material changes, overload, incidents or ineffective interventions.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a consequential workflow | Required human decisions and authority are explicit. |
| Exercise an unexpected case | An equipped and authorized person can act through the defined route. |
| Inspect a coverage gap | The system follows a safe restriction rather than silently proceeding. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Oversight policy and workflow scope
- Roles and coverage
- Intervention procedures
- Exercises and review records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate ineffective or unowned oversight to the business owner. Restrict consequential activity until authority, staffing and intervention capability support the intended use.
Example in practice
Hypothetical example: An agent prepares customer refunds. Policy identifies when a reviewer must authorize payment and what happens when no reviewer is available, rather than relying on a statement that staff supervise the system.
Related controls
- CF07-002: Human Review Gates for Consequential Decisions
- CF07-004: AI Escalation Paths & Triggers
- CF07-009: Human Oversight Adequacy Monitoring
Framework mappings
- CSA AICM (GRC-15)
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14)
- ISO 42001 (Cl. 5.2, A6.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0