EU AI Act Articles 14 and 26: human oversight, who builds it and who staffs it

Why this page: “human in the loop” appears in almost every AI supplier’s pitch. The AI Act turns it into two separate duties: one on the provider who builds the system, one on the deployer who runs it. The site compares human-machine teaming in DoD and NATO guidance but had no page on the EU text. This page quotes the Service Desk version, based on the EUR-Lex consolidated text as at 27 July 2026. It applies only to systems that are high-risk under Article 6 and in scope. It is not legal advice; see the EU AI Act explainer.

Provider duty: Article 14

Article 14(1) says high-risk systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are in use. Oversight measures shall be commensurate with the risks, level of autonomy and context of use of the high-risk AI system, and can be built into the system by the provider or identified by the provider for the deployer to implement.

Paragraph 4 lists what the people assigned to oversight must be enabled to do. Among the items:

• to properly understand the relevant capacities and limitations of the high-risk AI system and be able to duly monitor its operation, including in view of detecting and addressing anomalies, dysfunctions and unexpected performance;
• to remain aware of the possible tendency of automatically relying or over-relying on the output produced by a high-risk AI system (automation bias);
• to decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the output of the high-risk AI system;
• to intervene in the operation of the high-risk AI system or interrupt the system through a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state.

Deployer duty: Article 26

Article 26(2) says deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. Paragraph 1 requires measures to use systems in accordance with the instructions for use accompanying the systems.

Deployers must also monitor the operation of the high-risk AI system on the basis of the instructions for use. If they have reason to think the system presents a risk, they shall without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Paragraph 6 requires keeping automatically generated logs under their control for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless other law says otherwise.

Where a deployer controls input data, it shall ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system.

The training link

The Commission’s AI literacy Q&A notes that after the Digital Omnibus the obligation to ensure that their staff is trained to ensure human oversight remains in place for deployers of high-risk systems. See Article 4 AI literacy.

Reading the two together (editorial judgment)

This section is the site’s judgment, not the Commission’s.

• Split the evidence. A provider’s evidence is a design record: the interface, the stop function, the stated limits. A deployer’s evidence is an operating record: who is assigned, what they were trained on, the log-retention setting.
• A “human in the loop” claim is incomplete without both. A supplier who says oversight is built in should show the Article 14(4) capabilities, and a buyer should show it has staffed the role under Article 26(2).
• Automation bias is named in the text. Test plans that only measure model accuracy miss that the Act asks about how people rely on the output. See AI risk management in Articles 9 and 15.

Questions

Does a stop button have to be physical?

The text says a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state. It does not specify a physical control.

Does this apply to military systems?

Scope is decided by Article 2, not by these articles. See AI Act scope for defense and aviation.