RK-008HighProvider & DeployerDetective
Human Oversight Decision Logging
Where human oversight decisions are made in connection with the AI system's outputs, providers must log these decisions and their rationale to enable review of the effectiveness of human oversight measures.
Articles:Article 12(1)Article 14(4)
Evidence Examples
- Oversight decision log format
- Human review record samples
- Override decision audit trail
Standards
ISO 42001:2023 §9.1
Related controls
- RK-001Automatic Event Logging CapabilityArticle 12(1) requires that high-risk AI systems are designed and developed with automatic logging capabilities, enabling the reconstruction of events…
- RK-002Log Integrity and Tamper ProtectionProviders must ensure that logs are protected against tampering, unauthorised deletion, or modification, using cryptographic integrity controls,…
- RK-003Log Retention for Minimum 10 YearsArticle 18(1) requires that providers retain technical documentation and logs for at least 10 years after the high-risk AI system is placed on the market…
- RK-004Log Accessibility for Competent AuthoritiesProviders must ensure that event logs are accessible to competent national authorities and market surveillance authorities upon request, with procedures…
- RK-005Event Traceability and ReconstructionLogs must enable the tracing and reconstruction of decision events to understand the inputs processed, the outputs generated, and the conditions under…
- RK-006Performance and Operational Metrics LoggingProviders must log performance and operational metrics relevant to verifying that the AI system operates within the parameters established in the…
Related EU AI Act terms
- Logging CapabilitiesThe automatic recording of events by a high-risk AI system during its operation — required under Article 12 to enable monitoring of its operation, post-hoc investigation of incidents, and to support the post-market monitoring obligations of providers and deployers.
- Human OversightMeasures built into high-risk AI systems enabling natural persons to understand, monitor, and — where necessary — override or shut down the system. Must be proportionate to the risks and must ensure that deployers can intervene in the system's output before it takes effect.
Upgrade when it needs to be
The free questionnaire returns preliminary signals. The Full Assessment turns real system material into a governed decision record - extraction, component separation, evidence, national overlays, and a review-ready dossier.
Start free risk preview