EU AI Act

Human oversight, as a thing you can actually ship.

The AI Act asks that a person can oversee a high-risk system, and that what happened is recorded. Most of that is a product question: how you reach the right person and keep the evidence. This page splits the parts you can build from the parts you need a lawyer for.

What does the EU AI Act require for human oversight?

Article 14 of Regulation (EU) 2024/1689 requires high-risk AI systems to be designed so natural persons can effectively oversee them, including the ability to intervene or interrupt. Article 12 requires automatic logging of events over the system's lifetime. Pushary covers the practical half. It reaches a named person and makes your agent wait for their decision. If they do not answer, the action does not run. Every decision is saved.

Read the regulation itself: Regulation (EU) 2024/1689 on EUR-Lex, and the amendment that moved the dates: Regulation (EU) 2026/1744.

Article by article

What the text asks for, and which part you can build

Article 14

Human oversight

High-risk systems must be designed and developed so that natural persons can effectively oversee them during use. That includes understanding the system's capacity and limits, staying alert to automation bias, correctly interpreting output, and being able to decide not to use the output or to intervene and interrupt.

Interrupting becomes a call your agent makes and waits on. Pushary pauses the run, sends one short, specific question to a named person on the device they carry, and returns their choice. Override is one of the answers they can pick, just like Accept.

Article 12

Record-keeping

High-risk systems must technically allow for the automatic recording of events over the lifetime of the system, to a degree appropriate to the intended purpose.

Pushary saves each decision with the question as the person saw it, the option they chose, who they are, and the time. Pushary keeps it for your plan's history window (90 days on Partner Launch, 365 on Partner Growth), and you can query and export it. Add a callback URL and each answer is also sent to your own server as a signed webhook, so your own evidence store keeps a copy.

Article 26

Deployer obligations

Deployers of high-risk systems must assign human oversight to natural persons who have the necessary competence, training and authority, and must make sure those people have the support to carry it out.

Each question goes to one specific person, by the id you already use for them, rather than to a shared channel. Two approvers on the same action means two separate calls, and two saved decisions, each tied to its own person.

Article 50

Transparency

Providers must make sure people are told when they are interacting with an AI system, unless that is obvious. They must also make sure synthetic audio, image, video and text output is marked in a machine-readable way. Deployers must disclose deep fakes. They must also disclose AI-generated text published to inform the public on matters of public interest, unless a person holds editorial responsibility for it. These duties took effect in August 2026 and sit outside the high-risk regime.

Pushary does not solve this one, and we would rather say so plainly. Marking your own model output belongs to whatever generates it. Pushary sits at the approval step, which is a different obligation. The difference matters, because the transparency duties apply now while much of the high-risk timetable does not.

Annex III

High-risk use cases

The annex lists the use cases treated as high-risk. They include areas such as employment, essential private and public services, creditworthiness, and risk assessment and pricing in life and health insurance.

Whether your product is in scope is a legal question about your use case, not a technical one. Settle it before anything else on this page matters to you.

What this page is not

  • This is not legal advice, and Pushary does not make anyone compliant. Human oversight is a property of how you design and run your system. A tool can supply part of the mechanism. The obligation stays with you.
  • The timetable has moved. Regulation (EU) 2026/1744, the Digital Omnibus on AI, has been in force since 27 July 2026. It pushed the obligations for stand-alone high-risk systems under Annex III to 2 December 2027, and those for AI inside regulated products to 2 August 2028. The Article 50 transparency duties took effect in August 2026, as originally planned. Dates have moved once and can move again. Check the current position on EUR-Lex or with your lawyer, rather than trusting a date on a vendor page.
  • Pushary is GDPR-aligned and self-assessed. It holds no ISO certification, no SOC 2 report and no AI Act conformity assessment, and we will not claim any of those.

The oversight step in code

Override is a normal answer the person can pick. If nobody responds, the result is a no, and the default action never runs.

server.ts
import { createPusharyServer } from "@pushary/server"

const px = createPusharyServer({ apiKey: process.env.PUSHARY_API_KEY! })

// The oversight step: a named natural person, not a role or a queue.
const decision = await px.decisions.ask({
  externalId: reviewer.id,
  type: "select",
  question: `Case ${caseRef}: system proposes ${proposal}. ${topReason}`,
  options: ["Accept", "Override", "Refer upward"],
})

// No answer in time comes back as approved: false. Nothing proceeds.
if (!decision.approved) return holdForReview(caseRef)
if (decision.value === "Override") return recordOverride(caseRef, decision)
if (decision.value !== "Accept") return referUpward(caseRef, decision)

// The saved decision is the record: who saw what, what they chose, when.
return applyProposal(caseRef, proposal)

Questions, answered

Which parts of the AI Act apply right now?
Most of the prohibitions in Article 5 and the AI literacy duty in Article 4 have applied since February 2025, and the Article 50 transparency duties since August 2026. Regulation (EU) 2026/1744 deferred the obligations for stand-alone high-risk systems under Annex III to 2 December 2027, and those for AI inside regulated products to 2 August 2028. So for most Annex III systems, the oversight and record-keeping duties on this page do not apply yet. That is a reason to build the mechanism before you are asked for it. It is not a deadline to sprint at.
Does using Pushary make our AI system compliant?
No. Any vendor telling you otherwise is selling you something. Compliance depends on your classification, your risk management, your documentation, your conformity assessment, and how you actually run the system. Pushary supplies a mechanism for the intervention and the event record. The obligation stays with you.
Is a Slack message enough to satisfy an oversight requirement?
That is a question for your lawyer. The practical problem is easier to describe. A chat message is delivered whether or not the right person reads it. The system has no answer to wait on, and if nobody replies, nothing stops. If the point of oversight is that a person can effectively intervene, an oversight step nobody received is hard to prove afterwards.
What is stored, and where?
By default, Pushary stores the question you wrote, the answer, the person and the time. It stores no transcript of your system's inner workings and no copy of your records. Keep sensitive content in your own environment, and put a reference and a short summary in the question.
Can an approver override the system rather than only approving it?
Yes, and for an oversight step it is usually the more useful shape. Use the select type with an Override option. The option they pick is saved as their answer, so the record reads Override, not a rejection. Article 14 speaks about deciding not to use the output, which is exactly that distinction.
Does this work for a product sold into the EU from outside it?
The mechanism does. It is addressed by your own user id and reaches whatever device that person carries. Whether the regulation applies to you as a provider or deployer placing a system on the EU market is a legal question. Answer it early rather than late.

Build the oversight step, keep the record.

One call reaches a named person and waits for them. Nothing runs without an answer, and every decision is saved.

Start free