AI Control Library / CF-07: Human Oversight & Escalation
Designation: Supplemental | Control types represented: Operational
Control requirement
Apply proportionate, role-related personnel screening before granting sensitive AI responsibilities, using authorized processes that respect applicable employment, privacy and fair-treatment requirements. Record decisions and protect screening information.
Why this matters
Access to training data, model deployment or agent credentials can create significant exposure. Screening should address relevant trust needs without becoming an indiscriminate search or an unsupported automatic exclusion.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
Personnel and contractors proposed for sensitive AI roles; qualified HR and legal review determines permissible checks and required procedures.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
HR owns the screening process with legal and security input; role owners define access-related requirements.
Implementation guidance
- Define screening needs from the role and sensitivity, using consistent, job-related criteria and qualified review.
- Establish required notice, authorization, provider handling and decision procedures for the applicable jurisdiction.
- Evaluate results through authorized personnel, providing required correction or review routes rather than relying on an unreviewed automated flag.
- Restrict access to screening records, apply retention rules and review changes in role or relevant requirements.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Inspect a screening decision | Checks and criteria are authorized, relevant and consistently applied. |
| Review an adverse or disputed result | The appropriate human and required review process operate. |
| Inspect record access | Sensitive findings are limited to authorized recipients. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Role screening criteria
- Reviewed process and authorization
- Protected decisions and review records
- Access and retention evidence
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate uncertain authority, inaccurate results or inappropriate screening to HR and legal. Delay sensitive assignment where required checks remain unresolved without imposing unsupported exclusion.
Example in practice
Hypothetical example: A contractor requests model-deployment authority. HR applies the approved role-related process and reviews a disputed report rather than allowing a vendor’s automated flag to make the final employment decision.
Related controls
- CF07-S09: AI Personnel Roles & Responsibilities Documentation
- CF07-S06: AI Role Change Access Revocation
- CF01-S15: AI Information Security Program
Framework mappings
- CSA AICM (HRS-01)
- NIST AI RMF (GOVERN 5.2)
- ISO 42001 (Cl. 7.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0