Human Oversight, AI Kill Switches and the Fine Art of Not Looking Guilty.
September gave us the synthetic whistleblower – an AI system with the rather antisocial habit of spotting the transaction, pattern, or decision nobody in the room particularly wants spotted. October brings the less glamorous sequel. The system has raised an alarm, blocked a payment, refused a procurement step, or recommended an action capable of detonating a client relationship before lunch. Now comes the question boards tend to postpone until the corridor outside Legal becomes unusually busy: who may override it?
The reflexive answer is “a human”. Splendid. Which human? The CEO whose numbers are about to miss target? The model owner whose bonus depends on rollout? The compliance officer carrying 6 statutory portfolios, 3 committee packs and the sort of migraine usually reserved for contested mergers? Human oversight isn’t governance merely because a carbon-based life form has touched the keyboard. Sometimes it’s the safeguard. Sometimes it’s interference in sensible shoes, wearing a lanyard and asking that the minutes reflect a “robust discussion” nobody remembers having.
AI Override Authority Must Be Designed Before the Alarm
An override framework should exist before the machine says no. After the alarm sounds, governance drafted at speed tends to resemble an office fire drill conducted inside the fire, chaired by the person who misplaced the extinguisher. The board should approve the risk appetite, categories of override and matters reserved for escalation. Management should assign named roles, deputies, and authority limits. Technical teams should build access controls that enforce those limits, rather than relying on a solemn assurance from the person who described the last systems failure as “isolated”, “contained” and, with admirable ambition, “not technically a failure”.
The harder governance question isn’t whether a human remains in the loop. It ’s whether that human’s power to intervene has itself been governed. An organisation can design excellent controls around the machine and leave the override dangerously informal – which is rather like fitting a bank vault with biometric locks and keeping the master key beneath the receptionist’s pot plant. The override therefore needs its own chain of authority, evidential threshold, conflict rules, and audit trail.
This direction isn’t exotic. South Africa’s 2024 National Artificial Intelligence Policy Framework favoured human-centred AI, transparency, accountability, and oversight over critical decisions. A subsequent Draft National Artificial Intelligence Policy was published in April 2026 but withdrawn in its entirety in June 2026 (embarrassing indeed), so the country’s AI policy position remains developing and shouldn’t be presented as settled law. Internationally, Article 14 of Regulation (EU) 2024/1689, the European Union Artificial Intelligence Act, requires high-risk AI systems to be designed and developed so that natural persons can oversee them effectively. Depending on the system and context, those overseers must be able to understand limitations, remain alert to automation bias, interpret outputs and, where appropriate, disregard, override, reverse or interrupt the system. The Regulation has since been amended, so organisations should consult the current consolidated text and applicable commencement provisions rather than treating the original 2024 instrument as frozen in time. Notice the practical trio: competence, authority, and resources. A ceremonial human with no time, information or permission is just decorative governance.
Separate the Person Who Wants the Override From the Person Who Approves It
An override isn’t a single, dramatic red-button action. It can mean disregarding a recommendation, releasing a blocked transaction, changing a threshold, rerouting a decision, switching to manual processing, pausing the system, or approving an exception the model would otherwise reject. Each intervention carries a different level and type of risk, so they shouldn’t all follow the same approval route simply because they fall under the broad label of human oversight.
The requester shouldn’t be the sole approver either. That’s less 4-eyes control and more 2 eyes gazing lovingly into their own conflict. Low-impact operational overrides may need a trained business owner plus a recorded reason. High-impact interventions – terminating services, declining credit, stopping municipal benefits, flagging fraud, disciplining staff, or suppressing a safety alert – should demand independent legal, compliance, risk, or technical review. Truly exceptional cases belong with an executive committee, board committee, or governing body under an emergency protocol. Seniority is not an evidential standard, despite its long and glittering career impersonating one.
The protocol should define thresholds – urgency, reversibility, financial exposure, effect on rights, safety, data sensitivity, regulatory interest and whether the proposed override benefits its sponsor. Conflicts must be disclosed and managed. Repeated overrides by the same executive, business unit or model owner should trigger independent review. One override may be judgement. 14 overrides, always just before quarter-end, are a genre. IYKYK.
What Evidence Justifies Overriding an AI System?
A defensible override begins with evidence, not rank, volume or the executive habit of saying “commercial reality” until everyone else stops speaking. Record the model output, confidence score where available, inputs used, relevant model version, applicable rule, known limitation, and the human’s competing evidence. State what harm may follow if the output is obeyed, and what harm may follow if it’s ignored. Identify alternatives. Timestamp the decision. Preserve who saw what, when and in which sequence. If the rationale can’t survive being read aloud by somebody who wasn’t in the room, it probably isn’t a rationale. It’s atmosphere.
That record matters because hindsight arrives impeccably dressed and astonishingly confident. The NIST Artificial Intelligence Risk Management Framework 1.0 organises responsible AI risk work around govern, map, measure and manage. ISO/IEC 42001:2023 similarly frames AI governance as a management system requiring defined responsibilities, risk treatment, monitoring, and continual improvement. Neither framework supports the executive method known as “I had a feeling, delete the log”.
POPIA Makes Human Intervention More Than Corporate Theatre
Where personal information drives a decision with legal consequences for a person, or affects that person to a substantial degree, section 71 of the Protection of Personal Information Act 4 of 2013 matters. It generally prevents a data subject from being subjected to a decision based solely on automated processing intended to provide a profile of that person. Where a statutory exception permits the processing, the responsible party must adopt appropriate measures to protect the data subject’s legitimate interests, allow the person to make representations and provide enough information about the underlying logic to enable those representations.
That doesn’t mean a human may rubber-stamp the machine and call the process humane. Nor does it mean a powerful person may reverse an inconvenient output without reasons. Credible intervention requires actual consideration by someone able to alter the outcome. For municipalities and public bodies, the stakes sharpen because an AI-assisted decision may still attract constitutional, administrative-law and procurement-law scrutiny, depending on the nature and legal effect of the decision. Software doesn’t cleanse an unlawful procurement process, nor does it permit arbitrariness to be outsourced at a monthly subscription rate.
When the Kill Switch Becomes the Cover-Up Switch
The dividing line between responsible governance and concealment is rarely the physical act of overriding. It lies in purpose, process, and preservation – and in whether the person pulling the switch is subject to controls as credible as those imposed on the machine. Was the intervention made to prevent demonstrable harm, correct a known defect, or comply with law? Or did it protect revenue, reputation, a tender, a favoured counterparty, or an executive from the vulgar inconvenience of being investigated? Human discretion isn’t automatically the ethical alternative to automation. Left ungoverned, it may simply become the least traceable part of the system.
Red flags include deleting or disabling logs, changing thresholds without version control, backdating approval, routing around compliance, silencing the system without preserving its alert, retaliating against the person who escalated it, and describing a substantive intervention as “routine maintenance”. Corporate language has performed many miracles, but turning evidence destruction into housekeeping remains one of its darker sacraments. If the reason sounds like something a nervous witness would rehearse in the lift, pause. If it contains the phrase “for optics”, sit down and call counsel. Stat.
Protect the Investigation, Not the Organisation’s Preferred Story
A serious alarm needs triage, not theatre. Contain the immediate harm without destroying the evidence needed to understand it. Preserve the relevant data, prompts, inputs, outputs, model versions, access records, communications, and override activity before anyone decides that a little digital housekeeping would be helpful. Then appoint an investigation lead who is independent of the conduct under review and decide, early, whether external lawyers, forensic specialists, cybersecurity experts, or regulators need to be involved.
The investigation protocol should also protect the people who preserve the alert, question the override, or refuse to tidy the record. Reporting lines, access controls, and anti-retaliation measures matter because independence is fictional when the investigator’s budget, promotion or continued invitation to meetings depends on the executive whose decision is under review. Nothing chills professional courage quite like discovering that “speak freely” means “speak freely while we update your succession plan”. A protected investigation requires more than confidentiality. It requires enough institutional distance for somebody to say that the switch was pulled for the wrong reason, and enough backbone in the organisation not to punish them for spoiling the mood.
Privilege requires care, not optimism. In 2026, Hofmeyr, Murray and Siddiqi warned South African organisations that feeding confidential material into AI tools may jeopardise legal professional privilege, depending on the tool, its contractual protections, the handling of inputs and whether confidentiality is preserved. Their analysis, “Chatting away your protection – Are you waiving legal privilege when you use AI?”, also notes that South African courts haven’t yet delivered a definitive ruling on this precise issue. An investigation doesn’t become privileged because someone copied Legal after the trouble started. Define the client group, legal purpose, approved tools, access restrictions, and information flows at the outset.
Regulator Notification Can’t Wait for the Minutes to Become Prettier
An AI incident may trigger sectoral, contractual, data-protection, market, safety, or public-law duties, depending on what occurred, which information and people were affected, and the organisation’s regulated activities. The organisation should maintain a notification matrix identifying the decision-maker, possible legal trigger, deadline, regulator, affected parties and required content. Legal should assess notification promptly and record both the conclusion and its basis but shouldn’t quietly become a witness-protection programme for unwelcome news.
Article 26 of the European Union Artificial Intelligence Act, for example, imposes obligations on deployers of high-risk AI systems concerning instructions for use, competent human oversight, monitoring and the retention of logs under their control. Whether those duties apply to a South African organisation depends on the Regulation’s territorial scope, the organisation’s role and the particular AI system and use case. Even where the Regulation doesn’t apply directly, EU customers, group companies and supply-chain contracts may still import comparable governance requirements. The board’s safest position isn’t “nobody told us”. It’s a documented process for finding out.
Directors Can’t Delegate Their Way Out of Personal Accountability
Section 76 of the Companies Act 71 of 2008 requires directors to act in good faith, for a proper purpose, in the company’s best interests and with the required care, skill and diligence. The statutory business judgement protection depends, among other things, on reasonably diligent steps to become informed, proper management of any personal financial interest and a rational basis for believing the decision served the company. That doesn’t make every failed override a ticket to personal liability, but it does make the quality of the information, process, conflicts analysis and recorded reasoning legally significant. A board pack stating “AI issue – resolved” may be concise. It may also be an engraved invitation to cross-examination.
King V reinforces ethical and effective leadership, informed decision-making, accountability, risk governance and oversight of technology and information. It superseded King IV and applies to financial years beginning on or after 1 January 2026. Delegation doesn’t dissolve accountability. It merely gives accountability more people to interview. Boards need meaningful reporting on material overrides, root causes, repeat patterns, unresolved risks, and remediation. They don’t need 83 slides of pastel reassurance, 4 heat maps in soothing shades of apricot and a conclusion that the model remains “broadly aligned” with values nobody can locate.
A Credible AI Override Protocol in 8 Questions
- What decisions may be overridden, paused, or stopped?
- Who may request, approve, and independently review each category?
- What evidence and reasons are mandatory?
- Which conflicts require recusal or escalation?
- What records and system logs must be preserved?
- When does an override trigger investigation or notification?
- How are affected people told, heard, and offered redress?
- What patterns are reported to executives and the board?
The answers should sit in policy, contracts, committee terms, incident plans, and technical controls, but the questions shouldn’t all produce the same kind of approval. Each override category needs a named requester, independent approver, evidential threshold, maximum duration, review date, and preserved system state. Test the arrangement through simulations, because the first real crisis is a dreadful time to discover that the authorised approver is on leave, the deputy has no access, the model owner is also the complainant, and the log retention period is 24 hours. Governance loves abstraction. Evidence does not.
There is an uncomfortable limit to all of this. A flawless override protocol can’t rescue a system whose risks were misunderstood at procurement, whose data was never fit for purpose or whose commercial incentives reward silence. You cannot govern your way out of a bad premise by adding another approval box and inviting Internal Audit to the funeral. Human intervention is a final control, not absolution for every governance failure that came before it.
The Final Question: Responsible Governance or Evidence of a Cover-Up?
Overriding AI is responsible when authorised people use reliable evidence, follow a proportionate process, preserve the original output, disclose conflicts, protect affected rights, escalate material risk, and leave an honest record. It begins to resemble a cover-up when authority is invented after the fact, evidence disappears, reasons mutate, critics are isolated and the intervention mainly protects those who ordered it.
The machine isn’t the moral actor in the boardroom. It can alarm, recommend, or refuse, but the organisation still decides who may answer, under which law and with what proof. Perhaps that is the real exorcism. Not driving a ghost from the system but removing plausible deniability from the humans gathered around it. The machine may be artificial. The amnesia, curiously, rarely is. Settle the authority, preserve the evidence, and record the reasons before somebody asks where the audit log went. That is usually when otherwise articulate people begin studying the carpet.
————————–
If your organisation’s AI override plan currently amounts to “phone someone senior”, you’re not uniquely doomed. You’re simply early enough to fix it. AJS works with legal, compliance, risk, and leadership teams to turn escalation rights, approvals, evidence, investigations and reporting into a workflow people can still follow when the system says no, and the room becomes politically inconvenient. Bring us the awkward process. Those are usually the ones worth fixing before they become exhibits.
(Sources Used and Those to Whom We Owe Thanks – South Africa National Artificial Intelligence Policy Framework; Withdrawal of the Draft South Africa National Artificial Intelligence (AI) Policy; Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence; Artificial Intelligence Risk Management Framework (AI RMF 1.0); ISO/IEC 42001:2023; Companies Act 71 of 2008; Protection of Personal Information Act 4 of 2013; King V Report on Corporate Governance for South Africa, 2025; Chatting away your protection – Are you waiving legal privilege when you use AI?).
