BuildNot yet confirmed elsewhere1 publisher2 min readPublished
Digital Omnibus moves Article 14 oversight duties for Annex III agents to December 2027
EU AI Act high-risk duties, Article 14 human oversight included, now start on 2 December 2027 for Annex III systems, a dev.to analysis says. The duty itself is unchanged, so teams whose agents fall under Annex III still need a person who can override or stop them.
The Engineer · Build desk
Timeline: the original date for most high-risk requirements was 2 August 2026. After the 2026 Digital Omnibus amendments, they apply from 2 December 2027 for Article 6(2) and Annex III systems, and from 2 August 2028 for Article 6(1) and Annex I systems.
| Date | Event | Claim |
|---|---|---|
| August 2, 2026 | Original date for most high-risk requirements | 3 |
| December 2, 2027 | Requirements apply: Article 6(2), Annex III systems | 1 |
| August 2, 2028 | Requirements apply: Article 6(1), Annex I systems | 2 |
What happened
- Systems that are high-risk under Article 6(1) and Annex I get until 2 August 2028 under the consolidated Article 113.
- The original date for most of these requirements was 2 August 2026.
- Scope follows use: an agent that filters job applications falls under Annex III point 4(a), and one that assesses the creditworthiness of natural persons falls under point 5(b).
- Article 14(4) lists what overseers must be enabled to do, including to "disregard, override or reverse" the output and to halt the system through a "stop" button or similar procedure.
Why it matters
- decision Where the gate sits becomes a per-action design choice. Anything that cannot be undone needs a named approver before it runs, because reversal is unavailable afterward.
- constraint The record is the open part. The Article 14 text the post quotes lists abilities, and the question of what proves a person used them is the post's own framing.
- cost A deployer that breaches Article 26 faces the higher of 15 million euros or 3% of worldwide turnover, and the deployer is the party that has to staff the oversight.
The delay buys 16 months for Annex III systems and 24 for Annex I, counted from the original 2 August 2026 date [13][14]. The dev.to post says the change moves the timetable and leaves the obligation as it was [4].
The design problem is the output. For a model that recommends, the output is a suggestion a person can ignore. For an agent, the post says, "the output is often an action: an email sent, a record updated, a payment initiated" [16]. Some of those can be reversed afterward. Many cannot [16].
That matters because Article 14(4)(d) gives the overseer the power to "disregard, override or reverse" the output [8]. For an irreversible action, we think the override has to happen before the action runs.
The post reaches the same place. It puts oversight in two spots: a gate before any action that cannot be undone, where a named person sees the proposal and approves or rejects it, and a stop mechanism that works while the agent runs [17]. A dashboard reviewed after the run meets neither, according to the post [18]. Article 14(3) asks for measures "commensurate with the risks, level of autonomy and context of use", and a system that plans and then acts on its own plan sits higher on that scale than one that recommends [7].
The form of the check is loose. Article 14(4) says people must be enabled to do these things "as appropriate and proportionate" [8]. Only for remote biometric identification under Annex III point 1(a) does Article 14(5) require verification by "at least two natural persons" [9].
The record is where the post raises a question teams pass over: if someone wanted proof later that a person actually oversaw a given agent action, what would there be to show [19]? The Article 14 passages the post quotes describe abilities. None of them specifies a log. The part of the post we could read breaks off before it says what the record should hold.
In our view, a record that answers the question has to show two things. The approval came before execution. The approver was one of the people Article 26(2) describes, with "the necessary competence, training and authority" [11]. A timestamped click shows the first and says nothing about the second.
The staffing duty lands on the deployer. The provider builds oversight measures into the system or identifies the measures a deployer should implement [10]. Because the Article 26 fine is the higher of two figures, the percentage limb only binds above 500 million euros of turnover [12][15]. Below that, the flat figure is the ceiling.
What to watch
- Whether the post, or any regulator guidance, specifies what an oversight record should contain; the text available ends before it says.
- What oversight measures providers identify for deployers under Article 14(3), since the deployer has to staff whatever the provider specifies.
- Any further change to the Article 113 dates, which would move the 2 December 2027 and 2 August 2028 lines again.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap−5
- Incentives40
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Following the 2026 Digital Omnibus amendments, the consolidated text of Article 113 applies the high-risk requirements from 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III.
- [2]
Under the consolidated Article 113, the requirements apply from 2 August 2028 for systems that are high-risk under Article 6(1) and Annex I.
- [3]
The original date for most of the high-risk requirements was 2 August 2026.
- [4]
The delay changes the timetable, not the obligation, and does not move the transparency duties covered under Article 50.
- [5]
Whether an agent is high-risk depends on what it is used for, not on the fact that it is an agent; a coding agent that edits your repository is unlikely to be in scope.
- [6]
An agent that filters job applications or evaluates candidates is in scope because recruitment and selection are listed in Annex III point 4(a); one that evaluates the creditworthiness of natural persons is in scope under point 5(b).
- [7]
Article 14(3) says the oversight measures "shall be commensurate with the risks, level of autonomy and context of use"; a system that plans and then acts on its own plan has a higher level of autonomy, and the oversight is expected to scale with it.
- [8]
Article 14(4) lists what the people assigned to oversight must be enabled to do, "as appropriate and proportionate", including deciding not to use the system or to "disregard, override or reverse" its output (d), and intervening or interrupting it "through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state" (e).
- [9]
Article 14(5) adds that for remote biometric identification under Annex III point 1(a), no action may be taken on an identification unless it has been "separately verified and confirmed by at least two natural persons"; it is the one place the Act spells out a two-person check.
- [10]
Under Article 14(3), the provider builds oversight measures into the system, or identifies measures the deployer should implement; the deployer then has to staff them.
- [11]
Article 26(2) says: "Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support."
- [12]
Breaching the deployer obligations in Article 26 falls under Article 99(4)(e), where fines go up to 15 million euros or 3% of total worldwide annual turnover, whichever is higher.
- [13]
The Annex III date is 16 months after the original date.
- [14]
The Annex I date is 24 months after the original date.
- [15]
The 3% limb of the Article 99(4)(e) fine exceeds the flat 15 million euros only above 500 million euros of worldwide annual turnover.
- [16]
For an agent the output is often an action, such as an email sent, a record updated or a payment initiated; some actions can be reversed afterwards and many cannot.
- [17]
In the post's reading, agent deployments have two practical places to put oversight: a gate before any action that cannot be undone, where a named person sees what the agent proposes and approves or rejects it, and a stop mechanism that works while the agent runs, as Article 14(4)(e) describes.
- [18]
Reviewing a dashboard after the run meets neither the pre-action gate nor the in-run stop mechanism.
- [19]
The post frames the question most teams skip as: if someone later asks whether a person really oversaw a particular agent action, what record could you show them?
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toEU AI Act Article 14: human oversight for AI agents, and what an oversight record should prove
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Human Oversight of AIFollow
- AI agent governanceFollow
- EU AI ActFollow