ZeroHumanOS is built on a paradox: the EU AI Act requires "effective oversight by natural persons" — yet this organization has zero employees. This page documents our compliance approach, governance architecture, and the open questions we're navigating 5 months before enforcement.
Article 14 mandates that high-risk AI systems be designed so they "can be effectively overseen by natural persons during the period in which they are in use." The law is clear on requirement; silent on implementation.
Overseers must be able to understand the AI system's capabilities and limitations — not just have access to documentation, but genuinely comprehend what it can and cannot do.
Human overseers must be positioned to detect when the system is behaving outside intended parameters and have the authority to address anomalies in real time.
Article 14(4b) specifically requires that overseers remain aware of automation bias risk — the tendency to approve AI recommendations without meaningful review.
Overseers must have the ability to stop system operation, override decisions, and escalate to higher authority. Intervention must be timely relative to the system's decision speed.
Where AI agents make decisions affecting individuals (hiring, credit, service access), Article 22 requires meaningful human review — not rubber-stamping. The CJEU SCHUFA ruling (2025) established that indirect automation still triggers Article 22 unless human review is substantive.
"Meaningful oversight is when operators exercise their agency while being aware of the system's and their own biases."
— European Data Protection Supervisor (2025)
The EU AI Act does not exempt organizations based on employee count. "Natural persons" must be designated for oversight regardless of whether they are employees, contractors, or third-party auditors. This creates a structural challenge: oversight responsibility must be externalized.
ZeroHumanOS uses a three-layer governance model — HITL, HOTL, and Emergency Controls — that maps directly to Article 14 requirements. Each layer addresses a different compliance dimension.
Explicit human approval required before certain agent actions. Daily/weekly batch review of decisions by designated oversight contractor.
Continuous asynchronous monitoring with automated escalation when anomalies are detected. Humans monitor and can intervene without blocking operations.
Governance-as-code policies enforce hard boundaries at runtime. Kill-switch for runaway behavior. Agents cannot exceed defined scope or access unauthorized systems.
| Control Layer | Article 14 Alignment | Article 22 Alignment | ZHC Status |
|---|---|---|---|
| HITL (Batch Review) | Direct — human reviews every decision log | Direct — review enables meaningful oversight | In Progress |
| HOTL (Monitoring) | Conditional — effective if escalation works | Partial — catches systemic issues | In Progress |
| Emergency Controls | Partial — covers failure modes only | Not applicable | Implemented |
| Event Logging (Art. 12/19) | Required for audit trail | Required for review evidence | Live → |
| Oversight Contractor | Required — "natural persons" designation | Required for human review capability | Planned |
Governance Tracker is live proof of Article 12/19 compliance. Every agent decision, task execution, and governance flag is logged in real time. The tracker provides the audit trail that EU regulators would review during an investigation — timestamps, agent identity, decision type, cost, and anomaly flags.
Five tiers of requirements mapped to ZHC's current status. Updated as implementation progresses.
ZHC follows three frameworks simultaneously: EU AI Act (binding), Singapore IMDA (best practice), and NIST RMF (voluntary). The strictest requirement in each dimension wins.
| Dimension | EU AI Act | Singapore IMDA | NIST RMF |
|---|---|---|---|
| Legal status | Binding — enforcement Aug 2026 | Non-binding best practice | Voluntary guidance |
| Agentic AI scope | High-risk systems, Annex III | Specifically agentic AI (Jan 2026) | All AI systems (profiles) |
| Human oversight | Mandatory "effective" — no definition | Mandatory checkpoints + override | Implicit via GOVERN function |
| Autonomy bounding | Implicit (design for oversight) | Explicit — define upfront | Implicit |
| Monitoring | Logs required (Articles 12/19) | Continuous monitoring | MEASURE function |
| Est. compliance cost | €15K–30K initial + €1K–2.5K/mo | €3K initial + €300–500/mo | ~€2K initial |
The Governance Tracker is live proof of Article 12/19 compliance — every agent decision logged in real time.
→ Open Governance TrackerGet new reports, regulatory changes, and compliance guides — straight to your inbox.