Oversight processes defined and assessed

The requirement, in our words

Define, assess and document the human oversight process for the system in line with the governing policy, and assess whether the oversight is exercisable at the pace and volume of operation.

What it means for human oversight

Oversight designed for a pilot often fails at production volume. Assess the time per decision, the queue, the alert load and whether the person can genuinely intervene.

How to evidence it

Attach the artefacts above to the Oversight processes defined and assessed row with the system name, the owner and the date. The first one is the anchor: The documented oversight process. The OH-46 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for An assessment of whether it is exercisable at operational volume. If that artefact for OH-46 cannot be produced, the row is a gap, whatever the policy says.

OH-46 carries 3 evidence items and 2 common gaps. For oversight processes defined and assessed, test the control on a live system at production volume, since a version that works only in a pilot has not yet been shown to work. The OH-46 statement above is ours, written from NIST AI RMF 1.0, MP-3.5, not a reproduction of the licensed text.

Common gaps

• Oversight designed at a volume the reviewer cannot sustain
• Overseer can observe but not intervene

Related units

• AI risk assessment
• Operational planning and control
• Context and the role you play