Every day a nurse, an underwriter or a factory engineer reads what an AI system recommends and decides whether to accept it, change it, or reject it and start again. When they overrule the machine, that decision is the clearest proof we have that a human was in charge. And the EU AI Act will require exactly this kind of oversight. Yet most systems throw the evidence of this human oversight away. Fortunately, there’s an easy way to keep it – and Ireland is well placed to lead the implementation.
Introduction
Artificial intelligence (AI) now drafts hospital letters, screens job applicants and flags faults on factory lines across Ireland. The EU AI Act will require that a person can genuinely oversee high-risk systems – and that those systems keep a record of what they do. Under amendments agreed in May 2026, those duties will apply from December 2027 for most high-risk systems, and from August 2028 for AI built into regulated products such as medical devices, while Ireland’s enforcement bodies switch on in 2026. Yet the single most useful record – the moment a trained professional reads the machine’s recommendation, disagrees with it, and decides to overrule it – is the one thing almost no organisation captures. This person’s decision-making disappears into emails, chat messages and people’s memories.
This paper explains why losing that moment, the point where a person decides whether to accept or overrule the machine, matters; shows that it can be captured cheaply and verifiably; and argues that Ireland, with its many regulated industries and its new system for enforcing the Act, is well placed to lead the way.
The bottleneck is no longer capability. It is trust.
Across Ireland, AI systems have started doing real work. They draft discharge letters in hospitals, suggest which insurance claims to pay, sort job applications, review software for bugs and watch for faults on production lines. In each case, a person still has the final say: a clinician, a claims handler, or an engineer reads what the system proposed and then accepts it, changes it, or rejects it and starts again.
These systems grow more capable every month. What now decides whether we can rely on them is no longer the technology itself, but trust. And trust is settled at that one human moment. When a regulator later asks whether an AI system was used responsibly, the answer turns on what the person did. Did they weigh the recommendation and decide? Or simply wave it through?
A correction, meaning the point where a person changes or overturns what the AI proposed, is also the clearest signal of what the system does not know or cannot do – if the record shows exactly what the machine got wrong and why a person disagreed. So the moment a human overrides the machine is both proof of oversight and the best clue as to how the system should improve. Yet in most organisations, none of this is recorded formally.
The evidence vanishes
Picture a routine insurance case. Software reviews a motor claim and recommends turning it down. The handler reading the file notices something the system missed: the claimant mentioned a recent bereavement on the first phone call. Recognising a customer in distress, the handler escalates the case, a senior colleague agrees, and the claim is paid. Six months later the regulator asks the obvious questions. What did the system recommend? Who changed it? On what grounds? To answer, someone has to piece the story back together from a system log, a chat thread, a note in the case file and the handler’s memory. It takes most of a morning. And the answer is part guesswork.
Nobody here was careless. This is not a failure of diligence but of plumbing: the handler did the right thing, the senior colleague signed off, and the reason was sound. But no one collated the process (the decision, the change and the reason) in one place. Or in any form that would be easy to check later.
The same gap opens wherever people supervise machines. On a medicines production line, the qualified person – the licensed expert who must personally certify that a batch is safe to release – judges a pressure reading as acceptable and releases it. In a bank, a lender overrides the system’s credit decision on documented grounds. In each case the human exercised judgement and got it right; what survives is a thin, scattered trail that is easy to lose, especially when staff move on (Figure 1).
Figure 1. One override, four scattered records. The override happens, but its record scatters: today the reason a person changed an AI decision is spread across disconnected tools, which makes reconstructing it later slow and uncertain.
The law now expects what our systems do not deliver
This gap is about to become a legal problem. The EU AI Act (Regulation (EU) 2024/1689) is the first broad law anywhere to regulate artificial intelligence, and its strictest rules apply to what it calls high-risk systems: those used where a mistake can seriously harm someone, such as in healthcare, lending, hiring, and essential public services. Under amendments agreed in May 2026 (the Digital Omnibus), those rules now take full effect on 2 December 2027 for high-risk systems used on their own, such as those used in healthcare decisions, lending and hiring. For high-risk AI that is built into regulated products such as medical devices, the rules apply later, from 2 August 2028, so that they line up with the separate product-safety regimes those goods already have to meet. Ireland’s enforcement bodies, though, come into operation in 2026, so the choices about how oversight will work are being made now.
Two of the Act’s requirements speak directly to that lost moment described earlier, the point in the human decision-making process where the evidence of oversight slips away. Article 14 says these systems must be built so that a person can genuinely oversee them. The Act is unusually frank about the danger it has in mind: that the human supervisor will slip into what it calls ‘automation bias’ – trusting the machine’s answer instead of thinking it through – and it insists that the supervisor must be able to question the output and, when necessary, override or reverse it. Articles 12 and 19 add that the system must automatically record what it does, and that those records must be kept.
Read together, these rules ask for two things: that a human stays genuinely in charge, and that there is a lasting record of how the system was used. But here is the difficulty. A rule that says a human must oversee the machine means little, unless we can later tell whether the oversight was real or just a signature. The override is exactly what tells the two apart. If we never record it, we cannot show that anyone truly exercised judgement. And “human in the loop” becomes a phrase on a compliance form rather than a safeguard that protects people.
This is not a far-fetched worry. A recent paper by Sourav (2026) warned that judges who use large language models to help prepare rulings may fall into the same automation bias, with the software quietly steering their reasoning even though the judge still signs the judgment. The same risk appears wherever a professional approves what a machine proposed. Recording when and why people overrule the machine is what keeps their oversight honest, and visible to anyone who later needs to check.
We have solved this kind of problem before
How do we fix this without slowing everything down? The history of computing offers a clear pattern. Whenever separate systems have needed to work together reliably, the answer has been a shared, open standard that anyone can use: the internet runs on one (TCP/IP), the web on another (HTTP), and the “Sign in with Google” button on a third (OAuth). No single company owns these, which is exactly why they work everywhere.
AI is now growing standards of its own. One, the Model Context Protocol (MCP), lets an AI assistant plug into outside tools and data. Another (A2A) lets one AI agent hand work to another. What no shared standard yet covers is the part that matters most for accountability: the back-and-forth between people and AI systems, and the human decisions inside it. Today each company records that in its own way, if at all, so the evidence sits locked inside one vendor’s product and cannot easily be checked or moved.
How CHAP records a decision
One version of this standard already exists, and it was built in Ireland. The Collaborative Human-Agent Protocol, or CHAP, which my colleagues and I have published openly at github.com/BrightbeamAI/chap, gives people and AI systems a shared, plain way to write down the decisions they make together. The idea is simple: every time a person approves, changes or overrides what an AI system has proposed, that decision is saved as one small, structured record.
Return to the insurance handler from earlier. When the handler overturns the system and pays the claim, CHAP records the whole decision in one place: what the system recommended (decline), what the handler changed it to (pay), the reason in plain words (‘recent bereavement disclosed at first contact; the customer is vulnerable’), who decided, and when. A short label from the firm’s own list, ‘vulnerable customer’, is attached, and the senior colleague’s sign-off is saved the same way. The record is then sealed with a digital fingerprint that ties it to the record before it, so the decisions form a chain that no one can quietly rewrite later (Figure 2). That one label is what lets the firm count, months afterwards, how often vulnerability drove an override, without anyone trawling through case files.
Figure 2. One decision, one tamper-evident record. With a shared protocol, the same decision becomes a single linked record: one read answers an auditor, and the gathered corrections show where the system needs to improve.
CHAP records the other moments where work passes between people and machines in the same plain form: when the system hands a task to a person to decide, when it flags that a question falls outside what it is allowed to judge and should go to a human, and when a brand-new AI tool is allowed to graduate from testing into live use. Each is written down and linked into the same chain, so the full account of who did what, and who was responsible, survives long after the people involved have moved on.
CHAP is published in full and free of charge. A technical report sets out exactly how it works (arXiv:2606.09751), and the working code, including a small demonstration anyone can run, is openly available at github.com/BrightbeamAI/chap. The written specification is released under an open Creative Commons licence and the code under a standard open-source licence, with no royalties, so any company, regulator or rival can read it, test it, take it apart or build their own version. That openness is not a detail: a method for recording human oversight is only worth trusting if anyone is free to inspect how it works, and to check that it does what it claims.
The point for policy is not this particular protocol; others will follow, and should. It is what CHAP already shows: the oversight and the record-keeping the AI Act demands can be built into ordinary work, rather than bolted on at great expense afterwards. A record like this captures decisions and the reasons for them; it is not a tool for watching individual workers, and it must be designed to respect data-protection law and employees’ rights. Understood this way, the Act’s requirements need not be a brake on innovation. They can be met as a by-product of doing the job well.
What we gain by recording the moment
Recording that moment well pays off three times over.
For the worker, judgement stops being lost labour. The qualified person, the underwriter, and the clinician make their call once, and it can be replayed later exactly as they made it, instead of being reconstructed from memory under pressure. The record protects the conscientious professional as much as it protects the public: it shows that they looked, they reasoned, and they decided.
For the organisation, oversight and auditing stop being a separate chore. Answering a regulator means reading one record instead of searching four systems. And the same record, read the other way, becomes a map of where the AI keeps getting things wrong: gather up the corrections and they point straight at the problems to fix. The organisation gets, at no extra cost, the kind of quality data it would otherwise have to pay a team to assemble.
For the public, decisions made with the help of AI can finally be shown to be fair, not merely asserted to be. Was a vulnerable customer treated properly? Was a medicine batch released on sound grounds? Was a person told why they were turned down? With the moment on record, these stop being matters of ‘trust us’ and become matters of fact, checkable across different suppliers and years after the event. That is what trustworthy AI looks like in practice, rather than on a poster.
Why Ireland is well placed to lead
Ireland is better placed than most countries to act on this, for three reasons.
First, the industries that the Act’s high-risk rules touch most directly are concentrated here. Ireland makes medical devices and medicines for the world, hosts a large financial-services sector, and is home to the European operations of many of the biggest technology firms. Decisions taken on Irish sites already answer to regulators here and across the EU, and a great deal of those firms’ European compliance and trust work is run from Ireland.
Second, Ireland has just built the machinery to oversee these systems, and built it in a way that suits the task. Rather than create one new super-regulator, the Government has handed AI oversight to fifteen existing regulators that already know their sectors – among them the Central Bank, the Health Products Regulatory Authority, Coimisiún na Meán and the Data Protection Commission – and set up a new central body, the AI Office of Ireland (Oifig Intleachta Shaorga na hÉireann), to coordinate them. It is expected to be up and running by August 2026. This keeps the expertise close to the systems being watched.
Third, the timing is now. The high-risk rules take full effect in 2027 and 2028, but Ireland’s AI Office and sector regulators switch on their powers in 2026, and the country is creating regulatory “sandboxes”, supervised settings where companies can test new AI systems with the regulator in the room. The country is therefore making practical choices about how oversight will actually work, right at the moment those choices are still open. The live question is no longer what the law says, but how anyone will supervise AI in practice. A shared way to record human oversight is a direct answer, and Ireland is in a position to help write it rather than simply import it.
What Ireland should do
Five practical steps would turn this position into leadership.
- Count a genuine record of oversight as proof of compliance. The new regulators should tell the organisations they supervise that, for high-risk AI, they will expect to see not just that someone was assigned to oversee the system but that they actually did so – in the form of clear, checkable records of the decisions that people made. This gives Article 14 real force, and protects the conscientious professional who can now show their work.
- Buy and build in the open. When the State and public bodies procure or build AI systems, they should require open, shareable formats for oversight and audit records instead of locked-in vendor logs, so that the evidence stays portable and is not lost when a contract ends. Public-service AI guidance can set the example.
- Treat open standards as public infrastructure. As it already does for other digital standards, the State should help develop and independently test open, royalty-free standards for recording human-AI decisions, working through the AI Office of Ireland, developing the sandboxes and allocating research funding. A standard that many independent parties have built and checked is more trustworthy, and more exportable, than any single firm’s product.
- Use the sandboxes to gather real evidence. Ireland’s regulatory sandboxes are the natural place to test, with regulators present, how oversight and record-keeping can be made to work in real Irish cases – in medical devices, in financial services, and in public services – and to feed what is learned straight into national and EU guidance, including the continuing argument over how high-risk systems should be classified.
- Insist that oversight be real, not nominal. Above all, policy should hold organisations to oversight that means something, and the surest way to do that is to measure it. When we can see when and why people overrule the machine, we can tell genuine judgement from a rubber stamp, and we keep people, not software, answerable for the decisions that matter. That is the automation bias the Act warns against, caught before it does harm.
Conclusion
A record format is a small, dry thing. But small things add up. The habits Ireland and Europe settle into now – how people and AI systems work side by side, and how that work is written down – will decide what a decade of AI in our hospitals, banks and public offices actually feels like to the people on the receiving end of its decisions. The machines will keep getting better. What stands between us and trusting them is not their capability but our ability to prove that a person was watching and willing to say no. We can prove it, by keeping the one record that matters: the moment a human takes responsibility and decides. Ireland has the industries, the regulators and the talent to build that habit in the open, and to lead Europe in doing so.
About the Author
Dr Arsalan Shahid is Principal Solutions Director at Brightbeam AI, an Irish integrator of digital intelligence specialising in regulated industries. He is a co-author of the Collaborative Human-Agent Protocol (CHAP), referred to here as an illustrative example; CHAP is published as an open, royalty-free specification. The views expressed are the author’s own.
References and Further Reading
Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), in particular Articles 12, 14 and 19. EUR-Lex.
European Commission, “AI Act”, Shaping Europe’s Digital Future (digital-strategy.ec.europa.eu).
Department of Enterprise, Tourism and Employment, General Scheme of the Regulation of Artificial Intelligence Bill 2026; Statutory Instrument No. 366/2025.
A. Shahid, G. Suttie and P. Black, “Collaborative Human-Agent Protocol (CHAP): An open protocol for auditable, structured multi-human and multi-agent collaboration”, Technical Report arXiv:2606.09751 (2026); repository at github.com/BrightbeamAI/chap.
R. Sourav, (2026) “Guardrail the Judicial Mind: Preserving the Cognitive Integrity of Judges in the Era of LLMs”, PublicPolicy.ie.