What produces evidence of human oversight of AI agents under the EU AI Act?

What the Act asks for

• Article 14: a high-risk system must be provided so that the people assigned to oversee it are enabled, as appropriate and proportionate, to understand its capacities and limits and monitor it, to “remain aware of the possible tendency of automatically relying or over-relying” on its output, to interpret its output correctly, to decide not to use it or to override its output, and to intervene or stop it.
• Article 12: high-risk systems must allow the “automatic recording of events (logs) over the lifetime of the system.”
• Article 26: deployers must “assign human oversight to natural persons who have the necessary competence, training and authority”, monitor the system, and keep its logs, where they control them, for at least 6 months, unless applicable EU or national law provides otherwise.

These duties apply to high-risk AI systems. Whether your system is high-risk depends on its use (Annex III) or the product it is part of (Annex I). Ask your counsel.

When do the high-risk rules apply?

On October 13, 2026, the European Commission's AI Act Service Desk timeline showed the high-risk rules applying from December 2, 2027 for systems listed in Annex III, and from August 2, 2028 for AI in products covered by Annex I, both marked as amended following the Digital Omnibus on AI. Check the official timeline before you plan on them.

Evidence an auditor can read

1. Who oversees each agent: a name, their training, and their authority to stop it.
2. What the person saw before a high-impact action, beside the agent's summary.
3. What the person decided, and when: approve, refuse, override or stop.
4. The decision record for each action, and what happened next, or unknown when it could not be confirmed.
5. A dated test showing the stop procedure works.

Where TrustGate fits

TrustGate returns a signed allow, deny or escalate decision before the action runs, for actions that go through it. Escalate means ask a person, and that answer is on the record. The receipt binds the agent, action, target and exact arguments that were evaluated. It records whether approval was asserted, not who approved. On its own, that record does not show that a person oversaw the agent meaningfully.

An outcome we cannot confirm is reported as unknown, never as success. TrustGate reports 'could not check' separately from 'checked and found nothing'. TrustGate can also produce a control-coverage pack:

• Signed, per-tenant evidence pack (JSON + Markdown) that marks each control supported, unsupported, stale, or unknown.

That pack marks the EU AI Act Article 14 human oversight control as unknown, because no record the pack reads can back that control. It is not an audit report, an attestation or a certification.

What this page is not

• Not legal advice, and not a conformity assessment.
• Not a claim that any tool, TrustGate included, makes an AI system compliant with the EU AI Act.
• Not a lock. Signatures prove and detect. They do not prevent.

Related questions

• Who is accountable when an AI agent takes the wrong action?
• How do you make an AI agent audit trail tamper-evident?
• How do you control and record what an AI agent may do before it acts?
• AI agents in the public sector: the record before the signature