AI Control Library / CF-07: Human Oversight & Escalation
Designation: Supplemental | Control types represented: Operational
Control requirement
Define reviewed personnel agreement content addressing AI role duties, acceptable use, information handling, reporting and relevant continuing obligations. Keep terms clear, proportionate and consistent with applicable requirements.
Why this matters
Generic terms may omit responsibility for generated information, credentials or delegated agents. Content should explain the person’s actual duties without making unsupported legal demands or conflicting with protected reporting.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
Employment and contractor agreements or acknowledgements related to organizational AI responsibilities.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
Legal and HR approve content with AI program, security and privacy input; managers identify role-specific needs.
Implementation guidance
- Identify the duties and information risks that the agreement needs to address for each relevant role.
- Define clear terms on approved tools, data, output use, authority, reporting and handling of organizational assets.
- Review enforceability, fairness, privacy and permitted disclosures through qualified legal processes, separating agreements from training instructions where needed.
- Version approved content and update it after material role, technology or requirement changes, coordinating acceptance through the agreement process.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Compare content with a role’s duties | Material AI responsibilities and limits are covered. |
| Inspect a conflict with another policy | The approved documents give coherent instructions. |
| Review changed capabilities | Relevant terms are updated through controlled approval and communication. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Content requirements and role analysis
- Legal and HR approval
- Versioned terms
- Change and consistency reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate ambiguous, conflicting or inappropriate terms to legal and HR. Correct the content before relying on it to assign consequential duties or restrict lawful activity.
Example in practice
Hypothetical example: An agent operator agreement specifies approval limits and incident reporting duties. It does not imply that accepting terms grants the operator technical authority outside the separately approved access role.
Related controls
- CF07-S07: AI Personnel Agreement Process
- CF07-S02: AI Personnel Acceptable Use Policy
- CF07-S09: AI Personnel Roles & Responsibilities Documentation
Framework mappings
- CSA AICM (HRS-08)
- NIST AI RMF (GOVERN 5.2)
- ISO 42001 (Cl. 7.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0