EU AI Act Human Oversight Requirements: Risk, Systems, AI Governance

Illinois just passed a law that says: if an AI system screws something up in your life, a real human being has to answer for it. Not a press release. Not a FAQ page. A named person, on a legal timeline, with an independent auditor checking their work.

That might sound obvious. It isn't. Right now, in most of the country, if an AI system denies your job application, flags your insurance claim, or misreads your medical scan, there is no legal requirement for anyone to explain why. The company built a product. The product made a call. That's kind of… it. Illinois just changed that math.

Why Illinois AI Accountability Stands Out

A lot of AI laws talk about "transparency" and "fairness." They're easy to pass and easy to ignore. Illinois went further. According to Capitol News Illinois, the law, called the Artificial Intelligence Safety Measures Act, requires that large AI developers conduct independent third-party audits of their systems. Not internal reviews. Not self-certifications. Outside auditors, the way a restaurant gets inspected by someone who doesn't work there.

Here's the part that actually has teeth: if an AI system causes what the law calls a "catastrophic risk," the company has 72 hours to report it. If the problem is urgent and immediate, that window shrinks to 24 hours. Those are the response timelines you'd put on a gas pipeline or a hospital drug supply, critical infrastructure, not a feature update.

That 40% number matters a lot. If you're a company building or deploying AI anywhere in the United States, you almost certainly have customers, employees, or operations in at least one of those three states. You can't just opt out. The rules follow you. This article is part of a series, start with Your Phone Number Is About To Need Your Face.

High Risk AI Systems Must Be Designed to Allow Human Oversight

Human Oversight Under the EU AI Act

The eu ai act human oversight requirements work on a similar logic to what Illinois is doing, just built earlier and with more detail. The law says certain high-risk AI systems must be designed so a human can actually understand what the system is doing, step in, and override it if something looks wrong. That's the whole point of human oversight, it's not a checkbox, it's a real person with real power to stop the machine.

Risk Management and the Act's Core Obligations

Under the act, risk management is not optional paperwork. Companies that build or deploy high-risk systems have obligations to identify risks before deployment, not after someone gets hurt by the outcome. The act treats this the same way Illinois treats catastrophic risk, you don't get to find out the hard way.

Oversight Mechanisms Built Into the System to Allow Human Oversight

Oversight mechanisms under the act aren't just a human standing nearby watching a screen. They're built into how the system is designed from the start, so a person assigned to monitor it actually has the information and controls needed to catch a problem before it spreads. Article provisions on this point make clear that oversight has to be meaningful, not decorative, and that systems must allow human oversight in practice, not just on paper.

Let's be concrete, because this is where people's eyes glaze over and they start thinking "this doesn't affect me." It does.

AI is already being used to screen job applicants, score loan applications, flag insurance claims, and recommend medical treatments. These aren't hypotheticals. They're happening right now, at companies you've probably heard of, to people who look exactly like you. And until very recently, the person on the receiving end of a denial had almost no way to find out whether a human made that call or an algorithm did, let alone why.

"AI is no longer just a novelty people play with online. For regular people, the big question is simple: if AI is being used around your job, money, identity, or personal data, who has to explain it when something goes wrong?" The Independent, reporting on Gov. Pritzker's signing of the Illinois AI Safety Measures Act

The Chicago Sun-Times reported that Illinois is now positioning itself alongside California and New York as the leading edge of state-level AI governance, not because they're the biggest tech hubs, but because they're home to enough regular people whose lives could be affected that lawmakers finally felt the pressure to act.

Where Accountability Gaps Still Show Up

Implement Human Oversight Before Deployment, Not After

One lesson the EU AI act bakes in that Illinois is still catching up to: you implement human oversight before a system goes live, not after it's already made decisions about real people. A company that waits until a complaint shows up has already missed the point of oversight. The obligations exist precisely so that the human check happens while it can still change the outcome.

Look, nobody's saying this is simple. The law has real critics, and some of their concerns are worth hearing.

According to analysis from The Beckage Firm's May 2026 AI governance update, tech industry representatives argued that requiring companies to assess "catastrophic risk" without clear national standards is a bit like asking every restaurant to define what "too hot" means before a food inspector arrives, you'll get wildly different answers. That's a fair point. The law creates a mandate before the measuring tools are standardized. Previously in this series: Why Your Phone Wont Unlock With Wet Hands And What Airports .

But here's the interesting twist. Both OpenAI and Anthropic, the two most prominent AI companies in the world right now, ultimately supported the bill. (Yes, really.) Their reasoning appears to be that a consistent, state-driven audit system is better than the alternative: 50 different state laws pulling in 50 different directions, or a federal law that might be far more restrictive. In other words, they'd rather have a known inspection standard than no standard at all, even if it's imperfect.

There's also a deeper problem that no law has fully solved yet. The Burden of Proof breaks down what researchers call the "explainability trilemma", the uncomfortable mathematical reality that AI explanations cannot simultaneously be simple enough for a person to understand, accurate enough to reflect what the system actually did, and powerful enough to work on the most sophisticated models. You can have two of those three. Not all three. That's not a political problem. That's a math problem. And it means that even with the best-intentioned law in the world, "AI gave you an explanation" and "AI gave you a true explanation" are not the same thing.

That's not a reason to abandon accountability laws. It's a reason to stay skeptical of explanations that sound too clean.

Fundamental Rights, Providers, and Ongoing Obligations

Fundamental Rights Sit at the Center of the EU Framework

Fundamental rights protections are the reason the act exists in the first place. Lawmakers built the human oversight requirement around the idea that a person's job, credit, or health shouldn't hinge entirely on a system nobody can question. That's the same instinct behind Illinois's audit rule, just arrived at from a different legal tradition.

Required Documentation and Ongoing Review

High-risk systems under the act are required to keep records showing how oversight actually happened, not just that it was theoretically possible. A risk that gets flagged once and never reviewed again isn't real oversight. The recurring review is what separates a genuine safeguard from a rubber stamp.

Federal AI legislation has been mostly stuck. Congress has been talking about AI rules for years with limited results. So the states moved. According to NYU's AI Law Center, 2026 is the year that state-level AI accountability laws are actually going into effect, not just being proposed. Illinois, California, Colorado. Real deadlines. Real auditors. Real consequences for non-compliance.

The framework that's emerging looks a lot like how cars or pharmaceuticals get regulated. You don't get to sell a drug and then figure out the side effects after. You prove it's safe first, to an independent reviewer, before it touches real people. AI is slowly, messily, unevenly moving toward that same model. Illinois is the most aggressive step yet. It won't be the last. Up next: Age Related Face Recognition Eye Movement Patterns.

The Drata overview of 2026 AI regulations shows that employment-specific AI rules, covering hiring algorithms, performance monitoring systems, and automated scheduling, are now spreading across states with separate requirements that sit on top of general AI safety laws. So if your employer uses an AI system to track your productivity, schedule your shifts, or evaluate your performance reviews, there's a growing chance that system will soon need to pass an independent audit before it's used on you.

If you've ever wondered whether a decision that affected your career, your credit, or your healthcare was made by a person or a machine, and whether that even matters, that's exactly the question this kind of law exists to answer. The practical thing you can do right now: if you receive any denial letter for a job, loan, or benefit, ask in writing whether an automated system was involved in the decision. In an increasing number of states, you have the legal right to that answer. Not a lot of people know to ask. Now you do.

Here's the thing that will matter most five years from now. Illinois didn't just pass a law. It established the idea that AI is critical infrastructurethe kind of thing that gets 24-hour incident reporting requirements, not a blog post apology. Once that idea takes hold, the question stops being "should AI be regulated?" and starts being "who is the responsible adult in the room?" The companies that already know the answer to that question will be fine. The ones that have been hoping nobody asks, they're running out of time.

Comparing the two approaches side by side is useful for anyone trying to understand where AI regulation is heading. The eu ai act human oversight requirements were written into law before most state-level American rules existed, which is part of why they're often used as a reference point. Illinois didn't copy the EU model, but the underlying goal, a human who can meaningfully intervene, is the same on both sides of the Atlantic.

One thing people miss about human oversight is that it isn't just about having a person available to click "approve" or "deny." Effective human oversight means the person has enough information about how the system works, what its risk level is, and what could go wrong, to actually catch a mistake. A human sitting in front of a screen they don't understand isn't oversight, it's a formality.

High-risk systems get extra attention under the act for a simple reason: the more a system can affect someone's job, safety, or fundamental rights, the more scrutiny it has to survive before it's allowed to operate. Risk isn't treated as a single yes-or-no question. It's graded, and the human oversight requirements scale up as the risk does.

Article by article, the act builds out what companies actually have to prove, rather than just promise. This matters because a law that only requires a company to say "we care about safety" doesn't change behavior. A law that requires documentation, human sign-off, and the ability to override a system does.

Recital language in EU legislation often explains the "why" behind a rule, even when the operative articles just state the "what." For human oversight, the reasoning is straightforward: AI systems can be confidently wrong, and a human reviewer is the last line of defense before that wrong answer becomes someone's real-life denial.

None of this means human oversight solves every problem automatically. A person can be present and still rubber-stamp what the machine says, especially if they're overworked or not given real authority to disagree. The requirement only works if the human reviewer has the time, training, and institutional backing to actually say no.

That's the throughline connecting Illinois's audit requirement and the EU's human oversight requirement: both assume that without a rule forcing it, companies will default to letting the system decide and calling it done. Both are betting that naming a responsible human, and giving that human real power, is what actually changes outcomes for the people affected.

Providers building high-risk systems carry most of the compliance weight under the act, since they are the ones who design the system before it ever reaches a deployer. A provider has to build in the tools a human overseer will actually need, clear risk indicators, an override switch, and logs that explain what the system did and why. If providers skip that step, no amount of good intentions from the company using the system later can fix a design that never allowed for real human control.

European regulators designed the act's risk tiers so that oversight effort scales with how much harm a system could cause. A low-risk chatbot does not need the same human review as a system deciding who gets a loan or a job interview. That graduated approach is meant to prevent every AI system in Europe from drowning in the same paperwork, while still making sure the systems that can hurt people get real scrutiny.

Governance around high-risk systems is not a one-time approval. It is an ongoing responsibility that includes monitoring the system after deployment, documenting any risk that shows up in the real world, and updating the risk management file when new problems surface. Good governance means the paperwork keeps pace with how the system actually behaves once real people start relying on it.

Requiring human review at key decision points is one of the clearest ways the act tries to prevent a high-risk system from running unchecked. The point of that review is not to slow everything down for its own sake, it is to make sure that before a system's output changes someone's life, a person with real authority looked at it and had the power to say no.

Minimising risk is a phrase that shows up throughout the act's requirements for high-risk systems, and it is meant literally: providers must reduce risk at every stage, from design through deployment, rather than treating a single pre-launch check as good enough. Combined with human oversight, minimising risk means the system is built to fail safely, with a person positioned to catch what the design could not prevent on its own.

Human control is the plain-language version of what all these obligations are reaching for. The act does not ask companies to promise their AI is safe; it asks them to prove a human retains actual control over decisions that matter, with the authority and information needed to intervene before harm happens rather than after.

Risk under the act is not graded the same way for every system, and that grading is exactly what determines how much human oversight a given AI system needs. A high-risk system used to screen job applicants or score loan eligibility gets far more scrutiny than a low-risk chatbot answering customer questions about store hours, because the potential harm to a real person's fundamental rights is not the same in both cases. Understanding where a system sits on that risk scale is the first practical step for any provider trying to figure out what oversight obligations actually apply.

High-risk systems carry the heaviest documentation and human review burden precisely because the act assumes these are the systems most likely to affect someone's job, credit, health, or legal status. A provider deploying a high-risk system in hiring, lending, or medical triage has to be able to show, on paper, that a human reviewer had real visibility into how the system reached its output. That paperwork is not bureaucratic decoration; it is the evidence a regulator or a court would look for if something went wrong.

Systems that fall below the high-risk threshold still have obligations under the act, just lighter ones, and that distinction matters for any provider trying to figure out where to focus compliance effort. The act does not treat every deployment the same, which is why so much of the compliance work starts with correctly classifying the system before building out human oversight, risk management, or documentation processes around it. Getting that classification wrong at the start tends to create bigger problems later, when a regulator disagrees with how a provider labeled its own system.

Providers operating across the EU need governance structures that can absorb new risk information without a full redesign every time something changes. Good governance treats risk management as a living file, not a one-time report, so that when a high-risk system starts behaving differently in the real world, the provider already has a process for updating both the risk assessment and the human oversight plan. That kind of governance is what regulators are actually checking for when they ask a provider to prevent foreseeable harm rather than just document it after the fact.

European providers building systems for high-risk use cases increasingly design human oversight and risk management together from day one, rather than treating oversight as something bolted on after the system is finished. That approach tends to produce systems where the human reviewer's controls actually match the real risk the system poses, instead of a generic "human in the loop" button that does not give the reviewer enough information to catch a genuine problem. Building oversight and risk management side by side is quickly becoming the practical standard for any provider that wants to prevent costly redesigns later.

Systems Designed So a User Can Ensure Human Oversight

The act's drafters wrote the human oversight rule so that oversight is actually usable by the person doing it, not just present in theory. A user assigned to monitor a high-risk system needs a clear signal when the system is uncertain, plus a real way to pause or override it, because a control nobody can find in practice does not count as oversight. Systems built this way tend to let human oversight work the way the act intends: a person catching a bad outcome before it reaches someone's job, loan, or health record.

Deployers carry their own share of the act's obligations, separate from what providers must build in. The act lets deployers rely on a provider's technical design, but that reliance has limits: a deployer still has to make sure the human assigned to oversight actually has the training and authority the system's design assumes they have. A provider can build a perfect override switch, but if the deployer never tells anyone it exists, the oversight the act requires does not happen in practice.

Annex material in the act spells out, system by system, which uses count as high risk and therefore trigger the heavier human oversight and documentation obligations. Providers and deployers both check the relevant annex early in a project, because the classification decided there determines almost everything that follows, including how much risk management paperwork a provider must keep and how much authority a human overseer must be given. Getting the annex classification right at the start saves a provider from redesigning the oversight plan later.

Obligations under the act are not evenly split between providers and deployers, and understanding who owes what is part of proving compliance. A provider's obligations focus on building a system that can be overseen at all, the risk indicators, the override tools, the documentation of how the system reaches its output. A deployer's obligations focus on using that system responsibly once it is live, including assigning a qualified human, keeping records of oversight decisions, and reporting problems back so the risk file stays current.

Article language throughout the act repeats a consistent pattern: define the risk category, then scale the obligations to match it. This pattern shows up again in how the act treats providers differently from deployers, and again in how it treats high-risk systems differently from everything else. Reading any single article in isolation can be confusing, but reading the act as a whole makes clear that every obligation traces back to how much a given system could hurt someone's fundamental rights.

Risk management under the act is not a document a provider writes once and files away. It is a process that has to keep running for as long as the system stays in use, which means a provider revisits the risk file whenever the system is updated, whenever it is used for a new purpose, or whenever a deployer reports an unexpected outcome. That ongoing process is what lets human oversight stay meaningful instead of becoming a snapshot of risks that existed only at launch.

Fundamental rights considerations shape which systems the act treats as high risk in the first place, not just how those systems must be documented afterward. A system that could affect someone's access to a job, credit, education, or public benefits gets classified with fundamental rights squarely in mind, because the harm from getting that decision wrong falls on a real person who may have no other way to challenge it. That framing is why the act's human oversight requirement is written as a right the affected person benefits from, not just a compliance task the provider checks off.

Article provisions describing high risk systems consistently tie the classification back to real-world consequences rather than abstract technical categories. A system counts as high risk under the act because of what happens to a person if it fails, not because of how sophisticated its underlying model is. That consequence-first approach is part of why a relatively simple system used in hiring or lending can face heavier obligations than a far more advanced system used for something lower stakes.

Ensure Human Oversight Stays Real, Not Just Documented

Providers who keep human oversight functional, and not merely written into a policy binder, tend to design systems where a reviewer can see risk indicators in plain language rather than raw model output. The act's framers wanted a system where a human could catch a bad decision, not just sign a form saying oversight exists. Systems that expose confidence scores, flagged edge cases, and a one-click override tend to satisfy this expectation far more convincingly than systems that bury that information in a technical log nobody reads.

Allowing human oversight is the standard the act sets for system design itself, not just for company policy sitting on top of the system. A system that fails to support human oversight in practice, because the interface is confusing, the override is buried, or the risk signal is delayed, fails the requirement even if the provider's paperwork says a human is "in the loop." Teams that test whether their interface actually supports human oversight, by putting a real reviewer in front of it before launch, tend to catch these gaps before a regulator or an injured user does.

Article obligations across the act consistently point back to one underlying test: can a person, with the information they were actually given, catch a mistake before it reaches someone's job, credit file, or health record. Every article on documentation, every article on risk classification, and every article on provider duties exists to make that one test possible in practice. A compliance program that keeps that test in view tends to build oversight that works, rather than oversight that only looks good in a compliance report.

Risk classification under the act shapes every downstream obligation, from how much documentation a provider keeps to how much authority a human overseer is given, which is why providers who get the risk analysis right early tend to have an easier compliance path later. A system misclassified as lower risk than it actually is will eventually collide with the act's fundamental rights protections, usually at the worst possible moment, after a real person has already been harmed. Treating risk classification as a first step rather than an afterthought is the cheapest way for a provider to avoid rebuilding an oversight plan from scratch.

Enforcement, once fully underway, is expected to focus heavily on whether the human oversight a provider documented on paper matches what a reviewer could actually do in practice. Regulators reviewing a high-risk system will likely ask to see the override tool work, not just read a description of it, because the entire point of the requirement is a human who can act, not a human who is merely listed as present. That gap between documented oversight and working oversight is where most compliance failures under the act are expected to surface.

Article-level detail matters here because the act does not leave "human oversight" as a vague aspiration; it ties the requirement to specific obligations a provider has to satisfy before a high-risk system reaches deployers at all. Systems that are designed from the article text outward, rather than retrofitted to match it after the fact, tend to give a human reviewer the exact tools, clear risk flags, a working override, and an audit trail, that the act's obligations were written to require.

Systems That Support Human Oversight From the First Design Review

Systems built to support human oversight from the earliest design review, rather than after a working prototype already exists, tend to give a provider more room to fix a weak override before it ships. An engineering team that treats human oversight as a design constraint from day one avoids the expensive scramble of retrofitting risk indicators onto a system that was never built to expose them. That early habit is often the difference between an audit that goes smoothly and one that turns up a system nobody can actually explain.

How Teams Keep Human Oversight Working Through Updates

Every time a system is updated, the update itself can quietly break the human oversight controls that were working fine before. Teams that retest human oversight after every meaningful update catch this before a reviewer discovers, mid-decision, that the override button no longer does what the documentation says it does. Treating an update as a trigger for re-checking oversight, not just re-checking accuracy, keeps the system's real behavior in line with what a provider has already told a regulator.

Article obligations tied to high risk classifications tend to travel together: once a system is labeled high risk under the relevant annex entry, nearly every other requirement in the act, documentation, human oversight, risk management, attaches automatically. A provider who treats the annex lookup as a minor formality often underestimates how much work follows from a single classification decision. Getting that first call right is cheaper than discovering, mid-deployment, that a system needed a far heavier oversight structure than the one it shipped with.

The act's obligations on providers are written so that a regulator can ask, at any point after deployment, to see proof that human oversight existed at the moment a decision was made, not just that it was designed into the system on paper. Providers who keep a running log tied to specific high-risk decisions, rather than a general statement that oversight "is available," tend to survive that kind of review without scrambling. That habit of keeping contemporaneous records is quietly becoming one of the most practical compliance steps a provider can take.

A deployer's obligations under the act do not disappear just because a provider supplied a well-designed system. The act expects a deployer to keep human oversight functioning in the deployer's own operating environment, which means training staff, setting escalation paths, and making sure the human assigned to a high-risk system actually has time in their workday to do the review properly. A perfectly engineered override switch is only as good as the deployer's willingness to let a human use it.

Risk management files under the act are meant to be read together with the human oversight plan, not filed separately, because a change in one almost always changes what the other needs to cover. A provider that updates a risk assessment after a new failure mode is discovered, but never revisits the oversight plan built around the old risk profile, ends up with a human reviewer working from outdated assumptions. Keeping both documents synchronized is a small process fix that closes a gap regulators are increasingly likely to look for.

The AI office plays a coordinating role that sits above any single provider or deployer, since the AI office is meant to give consistent guidance on how the act's risk categories and human oversight obligations should be read across the EU. Providers building AI systems for multiple member states benefit when the AI office issues clear guidance, because it reduces the risk that two national regulators interpret the same human oversight requirement differently. Watching AI office guidance closely is becoming part of how serious providers track their own compliance obligations over time.

Artificial intelligence systems used in hiring, lending, and medical triage draw the most attention under the act precisely because artificial intelligence making those calls affects fundamental rights in ways a customer service chatbot never will. When artificial intelligence systems influence whether someone keeps a job or gets a loan, the act expects a human reviewer to sit close enough to that decision to catch an error before it becomes permanent. That is the practical difference between artificial intelligence that assists a human and artificial intelligence that quietly replaces one.

AI governance programs inside a provider's organization tend to work best when they treat human oversight, risk management, and documentation as one connected system rather than three separate checklists. Mature AI governance means the team that builds the override switch talks regularly to the team that writes the risk file, so neither one drifts out of sync with what the system actually does in production. Providers investing in AI governance now are, in effect, buying themselves a smoother path when the AI office or a national regulator eventually asks to see how oversight really works.

Notified bodies play a narrower but important role for certain high-risk systems, since a notified body may be required to assess conformity before a system can legally reach the market. A provider working with a notified body needs the same underlying evidence a regulator would want later: proof that human oversight, risk management, and documentation all work the way the act requires, not just the way a policy document describes them.

Allow deployers to build their own internal checklist around what a provider's technical documentation says a human overseer needs, rather than assuming the default settings are enough for every use case. A deployer that customizes training and escalation paths to its own high-risk use case tends to catch problems a generic rollout would miss, because the people using the system every day usually notice friction before a compliance review does.

AI Systems and the Everyday Reality of Oversight

Systems that look compliant in a slide deck do not always behave the same way once real employees start relying on them daily, which is why providers increasingly test AI systems with the actual humans who will oversee them before a full rollout. Watching how a real reviewer interacts with AI systems under normal time pressure, not in a calm demo, tends to reveal whether the override tool is genuinely usable or just technically present. That kind of pre-launch testing catches the gap between a system that allows human oversight in theory and one that supports it in practice.

Frequently Asked Questions About Human Oversight Requirements

AI systems that touch hiring, lending, healthcare, or education keep showing up across both the Illinois law and the EU framework because AI in those areas can quietly redirect someone's whole life without them ever knowing an AI made the call. Every added safeguard, audits in Illinois, human oversight in the EU, exists because AI adoption outran the plain rules that would normally apply to a decision this important. Treating AI as ordinary software, rather than something that can affect fundamental rights, is exactly the assumption both laws were written to correct.

Risk shows up as the organizing idea behind almost every obligation discussed here, and that is not an accident. A rule built around risk, instead of around a fixed list of banned technologies, can flex as AI systems change without requiring lawmakers to rewrite the statute every year. That is part of why both the Illinois catastrophic risk standard and the EU's risk tiers were built the way they were: risk scales, so the obligations scale with it.

Systems that get flagged as high risk tend to share a pattern regardless of which law is doing the flagging: they touch a job, a loan, a medical decision, or a legal status, and the systems behind those calls are exactly the ones regulators want a human watching closely. Systems that stay low risk, a scheduling assistant, a spam filter, do not carry the same weight because a mistake there rarely follows someone around for years. That distinction is the quiet logic sitting underneath both frameworks discussed in this article.

Fundamental rights language keeps recurring here because it is the actual justification lawmakers point to when they are asked why any of this regulation exists at all. A system that could cost someone a job or a loan is not just a technical product, it is something touching a fundamental rights question the law was written to protect. That is why both the EU act and the Illinois statute keep circling back to consequences for real people rather than abstract technical risk scores.

AI governance, as a practice inside a company, is really just the internal version of what these laws require from the outside. A provider with mature AI governance already has the audit trail, the override logs, and the risk file a regulator would ask for, whether that regulator works for an EU member state or the Illinois attorney general's office. Building AI governance before a law forces the issue tends to be far cheaper than assembling it under deadline pressure after an incident.

Notified bodies and independent auditors serve a similar function across both systems discussed in this article, even though the terminology differs. Illinois requires outside audits of large AI developers; the EU relies on notified bodies to check conformity for certain high-risk categories before a system reaches the market. Both mechanisms exist for the same reason: self-certification alone was never going to be trusted once AI started making decisions this consequential.

The AI office's coordinating role matters most for providers operating across several EU member states at once, since inconsistent national interpretations of the same rule create exactly the kind of compliance confusion the AI office exists to prevent. A provider that ignores AI office guidance risks building a compliance program that satisfies one country's regulator while quietly falling short in another. Keeping a habit of checking AI office updates is cheap insurance against that kind of fragmented compliance risk.

High risk classification, in the end, is the single decision that determines almost everything else covered in this article, from how much documentation a provider keeps to how much authority a human reviewer is given to override the system. Getting that first call right, whether under the EU act or a state law like Illinois's, is what lets everything downstream, oversight mechanisms, audits, fundamental rights protections, actually function the way lawmakers intended.