High-risk uses of AI are logged, human oversight is conducted, and affected subjects are informed.
Trigger
AI is used in decisions about hiring, firing, promotion, pay, access to services or benefits.
Why
The EU AI Act obliges organizations using AI systems in processes classified as high-risk to retain logs, conduct human oversight and inform affected individuals. These obligations apply from 2 December 2027.
How
AI and decision-related logs, such as chats and prompts, should be retained for at least six months. Oversight should be documented and assigned to a person with the authority to overrule decisions made with AI. Affected individuals or organizations must be informed that AI is used, and may request an explanation of decisions made with it. Organizations must also follow the provider's instructions for use, monitor the system and report serious incidents to the provider.
Sources
- AI Act Art. 26
- AI Act Art. 79
- AI Act Art. 86
- ISO/IEC 42001 A.6.2.8
- ISO/IEC 42001 A.9.4