"A person always takes the decision, the AI only suggests." It is the sentence we hear most often in companies that use artificial intelligence systems to assess candidates, customers, suppliers or employees. On 21 August 2026 the Dutch Data Protection Authority explained to Uber, with a fine of almost €825 million, why that sentence alone is not enough. The right question is not whether there is a person in the process, but whether that person can actually change the outcome. Here is what the law requires and how to organise human oversight that survives an inspection.
Why "a person always checks" is not enough
According to the Dutch authority (AP), Uber suspended drivers' accounts when its systems flagged suspected fraud and, in some cases, deactivated them permanently on the basis of low customer ratings. The effects were immediate — loss of income — and, in the AP's view, meaningful human control was missing, as was adequate information for the drivers. The fine is €824,990,000, the second-highest ever imposed under the GDPR; Uber argues that permanent deactivations were not fully automated and has announced an appeal, so the decision is not final. But the lesson is already clear.
The test is not new. The Article 29 Working Party guidelines on automated decision-making (WP251rev.01, 2018), still the reference point for European authorities, say that human involvement must be "meaningful, rather than just a token gesture", carried out by someone with the authority and competence to change the decision, and that the controller "cannot avoid the Article 22 provisions by fabricating human involvement". Someone approving two hundred cases an hour without seeing the underlying data is not overseeing anything: they are lending a signature to a machine.
The three sources that require it, and since when
| Source | What it requires | Since when |
|---|---|---|
| GDPR, Article 22 | No decision based solely on automated processing with legal or "similarly significant" effects on the person; where allowed (contract, law, explicit consent), a right to human intervention, to express one's point of view and to contest | 25 May 2018 |
| AI Act, Articles 14 and 26 (Regulation EU 2024/1689) | The provider designs the high-risk system for effective oversight (Art. 14); the deployer assigns it to people with competence, training, authority and support (Art. 26(2)) | 2 December 2027 (Annex III) and 2 August 2028 (Annex I), after Regulation EU 2026/1744 |
| Italian law | Law 132/2025: in the intellectual professions AI is only instrumental and supportive, with intellectual work prevailing (Art. 13); in public administration the person remains solely responsible for the measures adopted (Art. 14). Ministerial Decree 180/2025: decisions about workers cannot be fully automated. Art. 1-bis of Legislative Decree 152/1997: workers must be informed about fully automated decision-making or monitoring systems | 10 October 2025 (Law 132/2025); 17 December 2025 (DM 180); 2022-2023 (worker information) |
Two clarifications on the GDPR, because they are the ones that move the boundary. With SCHUFA (C-634/21, 7 December 2023) the Court of Justice held that whoever produces a score that a third party relies on decisively is itself taking an automated decision under Article 22. With Dun & Bradstreet (C-203/22, 27 February 2025) it clarified that the person is entitled to meaningful information about the logic involved (Article 15(1)(h)), so that they can contest the decision. Trade secrets do not cancel that right.
What the overseer must be able to do: the five powers of Article 14
Article 14(4) of the AI Act is the most precise operational description the law offers of what "overseeing" means. The people in charge must be able to:
- understand the system's capabilities and limitations and monitor its operation, detecting anomalies and unexpected performance;
- remain aware of automation bias, i.e. the tendency to rely automatically on the output;
- correctly interpret the output, using the interpretation tools available;
- decide not to use the system, or to disregard, override or reverse its output in a specific situation;
- intervene or halt the system through a "stop" button or an equivalent procedure that brings it to a safe state.
The provider must make all of this possible (measures built into the system or set out in the instructions for use); the deployer must make it real, assigning oversight to people with competence, training, authority and support (Article 26(2)). How specific the rule can get is shown by Article 14(5): remote biometric identification requires separate verification by at least two people. Even if your company uses no high-risk systems, these five powers are the best checklist for any AI-assisted decision.
How to organise it in an SME: six steps
- Map decisions, not tools. Starting from your AI systems inventory, list the outputs that feed decisions with legal or significant effects on people: credit, hiring and appraisals, account suspensions, personalised prices or terms, fraud checks.
- Choose the oversight model for each one. Approval before effect (no outcome is produced without a review) for everything within Article 22 GDPR; monitoring with veto power for low-impact decisions; stop always available.
- Appoint people who meet the four requirements of Article 26(2). Authority is the critical one: someone assessed on the number of cases closed, or who must justify themselves every time they contradict the system, has no real authority.
- Give them the tools. The provider's instructions for use, the reasons and data behind each output, access to the logs, a review checklist and an escalation path. Without this information the review is blind.
- Measure. Override rate, average time per case, periodic sampling of confirmed decisions. An override rate of zero for months does not prove the system is perfect: it proves nobody contradicts it.
- Document and communicate. A written procedure, a register of reviews and overturned decisions, training records; information to workers before putting the system into service (Article 26(7) and Art. 1-bis of Legislative Decree 152/1997) and to the people subject to the decision (Article 26(11)); a channel to request human intervention and to contest (Article 22(3) GDPR).
The most common mistakes
- The rubber stamp. An "approve" button with hundreds of cases a day: the AP looked at substance, not at the existence of a human step.
- The reviewer without authority. Someone who cannot overturn the output without consequences is not overseeing.
- The reviewer without information. Seeing only the final score makes powers 1 and 3 of Article 14 impossible to exercise.
- One-off oversight. Done at adoption and never again: systems change (updates, different data) and oversight must follow them.
- No trail. If you cannot show who reviewed what and how many decisions they changed, in front of an authority the oversight does not exist.
- Delegating to the supplier. The Article 26 duty and Article 22 GDPR fall on whoever uses the system and decides, not on whoever sells it.
Where to start
Human oversight is not declared: it is designed and demonstrated. The first step is an honest snapshot of the decisions AI already enters today — with what effects, who reviews them and with what real powers. An independent gap assessment compares that snapshot with Article 22 GDPR, Articles 14 and 26 of the AI Act and the Italian rules, and returns a plan by person, process and tool: who oversees, what they see, what they can stop. Before an authority asks.