Does the person overseeing this understand it — and are they allowed to say no?
Enhanced: 22 controls
Who it applies to
Enter for every AI system whose letter is E or A (this area has no Baseline controls). Go as deep as your system letter, and implement in your mode.
Why it exists
Confirm that whoever holds the oversight duty can actually discharge it: that they understand the system well enough to judge it, and that they have the authority and the time to act on what they see. Oversight assigned to someone who cannot follow the system, or who lacks the standing to overrule it, or who is measured only on throughput, is oversight in name. The competence comes from the training of the Governance domain; the empowerment must be built into how the role is defined and measured.
What to actually do
Equip the overseer to understand what they oversee. Ensure the people in oversight roles have the role-specific competence from the Competence dimension — enough understanding of how the system works and fails to judge its outputs, not merely to receive them.
Give them the authority and the time to say no. Define the role so the overseer can overrule the AI without penalty, and so their performance is not measured in a way that punishes the pause. A reviewer rewarded only for speed will approve; a reviewer who cannot overrule without consequence will defer. Remove both traps deliberately.
Controls
Enhanced2 controls
Control 199
Confirm oversight-role competence for the systems overseen.
EnhancedPreventiveall rolesper system
What it is
Drawn from role-specific training; matched to the system’s complexity.
How to implement it · Steps
List the oversight roles per system and what each must judge
Define the understanding required: how the system works, typical failures, known weaknesses, what to do when in doubt
Scale the depth to the system's complexity
Confirm competence: role-specific training completed plus a short practical check on sample cases
Recheck when the system changes materially
How to start
List who holds oversight for this system, check each against the role-specific training, and close gaps before they continue.
Evidence
Competence records for each oversight role.
Mode: light / standard / full
light
The owner-manager confirms each overseer has done the training and talks through a few cases with them.
standard
Training records and a practical check kept by the system owner.
full
Competence managed by the training function, with role profiles per system and periodic assessment.
Control 200
Define oversight roles with real authority to overrule, and time to exercise it.
EnhancedPreventiveall rolesper system
What it is
Not measured only on throughput; overruling carries no penalty.
How to implement it · Minimum structure
Authority: explicit right to overrule the AI and to halt the process
No penalty: a justified override never counts against the reviewer
Performance measures: quality of judgement, not volume alone; no target unreachable with proper review
Workload: cases per day set at a level that allows real review
Escalation route when the reviewer disagrees with the AI and needs support
How to start
Review the role description and targets of the people overseeing this system and remove any measure that rewards speed alone.
Evidence
The role definitions granting override authority and the performance criteria applied.
Mode: light / standard / full
light
The owner-manager states the authority in writing and keeps no speed targets for reviewers.
standard
Role descriptions and targets agreed by the system owner and the line manager.
full
Formal role profiles from human resources, with workload and override data reviewed periodically.
Evidence
The competence records for oversight roles; the role definitions granting override authority; evidence that oversight is not throughput-penalised.