AI Human Oversight Matrix

Version: 1.0 

Effective Date: 12 August 2026

Previous versions : N/A

AI-M.1 Purpose and application

This Matrix sets the level of Human Oversight that applies to an activity performed by or with an AI System under clause AI.3 of the AI Terms. Tier is determined by the consequence of the activity being wrong, not by the technology used. Where an activity could fall within two tiers, the higher tier applies.

AI-M.2 Tier 1 — Informational

Activities that produce information for a person to consider and that make no change to a Client system, record or entitlement. Examples: drafting or summarising documents and reports, triaging or classifying alerts and tickets, generating draft knowledge-base content, log and telemetry analysis. Oversight: a competent person reviews the output before it is relied upon outside the Supplier, and the Supplier samples outputs periodically for accuracy.

AI-M.3 Tier 2 — Operational change

Activities that recommend or prepare a change to a Client system, record or configuration. Examples: configuration and policy recommendations, script and runbook generation, proposed ticket resolutions, patch and update scheduling, routine reporting to the Client. Oversight: a competent person reviews and approves the specific action before it is executed, and the approval is recorded.

AI-M.4 Tier 3 — High consequence

Activities that are difficult to reverse, that affect security posture, availability or data integrity, or that affect an individual. Examples: identity, access or privilege changes, changes to security controls or enforcement policy, deletion or restoration of production data, changes affecting an individual’s access or entitlements, and actions with a material financial consequence. Oversight: a named competent person authorised by the Supplier approves the action before execution, the approval and the reasons for it are recorded, and the activity is identified in the register maintained under clause AI.2.

AI-M.5 Not permitted in any tier

Automated Decisions that produce legal effects concerning an individual, or that otherwise significantly affect an individual, are not made without Human Oversight in any tier. Clause AI.3 of the AI Terms governs; this Matrix does not create an exception to it.

AI-M.6 Review

The Supplier reviews this Matrix at least annually, and on any material change to its AI Systems or delivery model, as part of its AI management system aligned with ISO/IEC 42001.