EU AI Act · Article 14 · Human Oversight

EU AI Act Article 14. Human Oversight Readiness Checklist

My working document from ZeroCopy Systems' own conformity work. Use it to score your agent stack before Aug 2, 2026.

Print or save as PDF: ⌘+P

How to score

Check each item your system satisfies today. Count your total at the bottom. 22 items total. A score below 15 warrants immediate attention before the Aug 2 deadline.

1 Deterministic kill switch 6 checks

Can you halt every agent action in under 100ms under realistic production load? Does the kill switch propagate through all execution layers (API, queue, inference loop). Not just the top-level process? Is the halt verified by an independent watchdog process (not self-reported by the agent)? Do you have a documented test that demonstrates the halt under load. Runnable without access to production? Is the halt state persisted to durable storage so a restart cannot silently resume a stopped agent? Can a non-engineer (compliance officer, operator) trigger the halt through a UI without requiring code access?

2 Hardware-attested signing 4 checks

Does every agent-issued action carry a cryptographic signature traceable to a TEE or HSM (not a software key in memory)? Can you produce and verify an attestation document proving the signing code has not been tampered with since last audit? Is the key provenance documented. Where the key was generated, by whom, under what ceremony. And is this documentation accessible to your auditor? Have you audited the full signing code path to confirm that the private key never leaves the hardware boundary at any execution point?

3 Policy engine 5 checks

Is agent behavior governed by a machine-readable policy file (equivalent to mission.yaml) rather than prompt text alone? Are policy rules version-controlled with a change log. So you can show a regulator exactly what rules were active on any given date? Does your system emit an alert when policy drift is detected (agent behavior diverging from the declared policy)? Is there an audit trail of every policy-engine decision, including which rule fired and on what input? Can an agent's own memory state or prompt modification bypass any policy rule. And have you tested this explicitly?

4 Audit log tamper-evidence 3 checks

Does your audit log use SHA-256 hash chaining. Where each entry references the hash of the previous. Making retroactive deletion detectable? Is audit log storage append-only at the infrastructure level (not just by application convention)? Is your log retention policy documented and enforced. And does it meet the minimum required by your sector's compliance framework?

5 Pre-deployment validation 4 checks

Has your agent stack been subjected to adversarial testing. Including prompt injection, goal hijacking, and memory poisoning attempts? Have you run chaos testing against the safety systems specifically (kill switch, circuit breaker, policy engine). Not just the happy path? Has a rollback from a failed agent deployment been rehearsed. Not just planned. In a production-equivalent environment? Is there a documented, signed-off conformity assessment for this agent system. Not just an internal review. Before it handles high-risk decisions?

Your score: ☐☐ / 22

15-22: Conformity-ready. 10-14: Gaps exist, prioritise kill switch + audit log. Below 10: Consult before August 2.

If you scored below 15, let's talk . nikhilpadala.com/work/for-cto or book directly: calendar.app.google/W1CEqo8GsoGtjJX49

Nikhil Padala · Ex-Gemini SRE · Ex-Akuna Capital · ZeroCopy Systems