Roles in the human-AI configuration

The requirement, in our words

Policies and procedures define and differentiate the roles and responsibilities for human-AI configurations and oversight: operator, reviewer, overseer and affected party, with what each may and must do about the output.

What it means for human oversight

The configuration is the specific arrangement of human and machine for this system. Document it, including what the human is empowered to change, and update it when automation increases.

How to evidence it

Attach the artefacts above to the Roles in the human-AI configuration row with the system name, the owner and the date. The first one is the anchor: A policy defining each human role and its authority. The OH-44 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Per-system documentation of the configuration and why. If that artefact for OH-44 cannot be produced, the row is a gap, whatever the policy says.

OH-44 carries 3 evidence items and 2 common gaps. For roles in the human-ai configuration, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-44 statement above is ours, written from NIST AI RMF 1.0, GV-3.2, not a reproduction of the licensed text.

Common gaps

• Human in the loop asserted without saying what the human can change
• Oversight assigned to a role with no authority to stop the system

Related units

• Context and the role you play
• What the management system covers
• AI risk assessment