Automation Bias: The Over-Reliance Article 14 Forces You to Counter
Automation bias is over-reliance on AI output. EU AI Act Article 14(4)(b) requires oversight measures that help the person counter it for high-risk AI.
Automation bias is the human tendency to over-rely on the output of an automated system — to accept what the machine suggests even when one's own judgement, or the available evidence, points the other way. The EU AI Act treats it as a named risk to be designed against. Article 14(4)(b) of Regulation (EU) 2024/1689 requires that the human-oversight measures for a high-risk AI system enable the person doing the oversight to remain aware of the possible tendency of automatically relying or over-relying on the system's output — "automation bias" — in particular where the system is used to inform or support a human decision.
In plain terms: the law does not just say "have a human review the output." It says the design has to actively help that human not defer to the machine out of habit. A reviewer who rubber-stamps the AI is the exact failure mode Article 14(4)(b) exists to prevent.
What the statute requires
Article 14 governs human oversight for high-risk AI systems: such systems must be designed so they can be effectively overseen by natural persons while in use, to prevent or minimise risks to health, safety and fundamental rights. Article 14(4) lists what the oversight measures must let the assigned person do. Paragraph (b) is the automation-bias provision:
The measures must enable the person to "remain aware of the possible tendency of automatically relying or over-relying on the output produced by a high-risk AI system (automation bias), in particular for high-risk AI systems used to provide information or recommendations for decisions to be taken by natural persons."
Read alongside the rest of Article 14(4), this sits in a cluster of oversight capabilities the person must have: to understand the system's capacities and limitations, to monitor for anomalies, to correctly interpret the output, to decide not to use the system or to disregard, override or reverse its output, and to intervene or stop it. Automation bias is the psychological obstacle that can quietly defeat all of those — if the human defers reflexively, the override button is never pressed.
It matters most exactly where AI is most seductive: decision-support systems that hand a person a recommendation, a score, or a flag. The provision singles those out. A credit model that outputs "decline," a triage tool that ranks patients, a recruitment system that scores candidates — each invites the overseer to treat the output as the answer rather than as input.
Why it matters for high-risk oversight
Automation bias is the difference between oversight that is real and oversight that is theatre. You can satisfy the form of Article 14 — a human sits at the end of the process — and still fail its substance, because the human approves whatever the system produces. Article 14(4)(b) closes that gap by making the counter to over-reliance a design requirement, not an afterthought.
Two consequences follow:
The provider has to build for it. Under Article 14 (with the Article 16 provider obligations), oversight measures are designed in before the system reaches the market. Countering automation bias is part of that design — for example, surfacing the model's confidence and uncertainty, showing the basis for an output, prompting the reviewer to record an independent rationale, flagging edge cases for closer scrutiny, or deliberately not pre-filling the human's decision with the AI's answer.
The deployer has to staff and train for it. Under Article 26, the deployer assigns oversight to natural persons with the necessary competence, training, authority and resources. Training those persons specifically to recognise and resist automation bias — and giving them genuine authority to overrule the system without career risk — is how the design becomes effective in practice. This connects to Article 4 AI literacy (in force since 2 February 2025, and since 27 July 2026 worded as a duty to take measures to support staff AI literacy): training overseers to question the system is one of those measures.
If oversight collapses into deference, the breach is an Article 14 human-oversight failure, fined in the €15,000,000 or 3% tier under Article 99(4) (whichever is higher) — with the Article 99(6) SME cap applying the lower of the percentage or the fixed amount for smaller organisations, and Article 99(6a) extending the same lower-of cap to small mid-caps since the Digital Omnibus.
Automation bias vs algorithmic bias — don't conflate them
These two "biases" are different problems with different homes in the Act:
| Automation bias | Algorithmic / data bias | |
|---|---|---|
| What it is | A human failing — over-relying on AI output | A system failing — skewed, discriminatory or unrepresentative outputs |
| Lives in | Human oversight — Article 14(4)(b) | Data governance — Article 10 (examining datasets for possible biases) and risk management — Article 9 |
| Fixed by | Oversight design + competent, trained overseers | Representative data, bias detection and mitigation, testing |
Automation bias is about the person trusting the machine too much; algorithmic bias is about the machine being wrong or unfair. Article 14(4)(b) addresses the first; Article 10 (data and data governance, including examining training, validation and testing datasets for possible biases) addresses the second. A high-risk system needs both handled.
Worked example
Banveza Crédit SA, a ~600-employee, ~€120M-turnover French consumer-lending firm, deploys a high-risk AI system that scores loan applicants (creditworthiness assessment is Annex III point 5(b), high-risk). Loan officers review the score before approving or declining. The risk: officers start treating "score below threshold = decline" as automatic, and stop exercising judgement — classic automation bias.
To meet Article 14(4)(b):
- Provider design. The scoring system shows each decision's main drivers and a confidence band; it does not pre-select "approve" or "decline" for the officer; it flags borderline cases for mandatory closer review; and it requires the officer to enter an independent reason before finalising, which is logged.
- Deployer staffing and training (Banveza's Article 26 duty). Loan officers are trained specifically on automation bias — taught that the score is decision support, not the decision — and are given explicit authority and protection to overrule it. Banveza monitors override rates: a near-zero override rate is itself a warning sign that officers are deferring rather than deciding.
- Documentation. The override logs and the training records become evidence that oversight is effective, not cosmetic — exactly what a market-surveillance authority would test.
The contrast case: if Banveza had simply added a "human approval" click with no confidence display, no independent-rationale prompt, and untrained officers under time pressure, it would have a human "in the loop" who rubber-stamps the model — formally present, substantively absent. That is the Article 14(4)(b) failure the provision is written to prevent.
(Timing: this Annex III high-risk obligation applies from 2 December 2027 under the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, which moved the original 2 August 2026 date.)
How Confir helps
Confir's structured assessment covers Transparency & Human Oversight (Articles 13, 14, 27 and 50) for each high-risk system it registers. It surfaces the Article 14(4)(b) automation-bias obligation as a concrete control on both sides — the provider's design measures to counter over-reliance and the deployer's Article 26 duty to assign competent, trained overseers with authority — and keeps it distinct from the Article 10 data-bias controls. The engine is deterministic and rule-based: the same intake yields the same oversight requirements, with the rule behind each item visible, so you can evidence to an auditor precisely why an anti-automation-bias measure is required.
Frequently Asked Questions
What is automation bias under the EU AI Act?
It is the human tendency to over-rely on, or automatically defer to, the output of an AI system — accepting the machine's recommendation even against contrary evidence or one's own judgement. Article 14(4)(b) of Regulation (EU) 2024/1689 names it explicitly and requires that the human-oversight measures for a high-risk AI system enable the assigned person to remain aware of, and counter, this tendency — especially for systems that inform or support human decisions.
Is automation bias the same as algorithmic bias?
No. Automation bias is a human failing — over-trusting AI output — addressed by the Article 14(4)(b) human-oversight requirement. Algorithmic or data bias is a system failing — skewed or discriminatory outputs — addressed by Article 10 (examining datasets for possible biases) and the Article 9 risk management system. A high-risk system must handle both: design and trained overseers to counter over-reliance, and representative data plus bias mitigation to counter unfair outputs.
Who has to address automation bias — the provider or the deployer?
Both, at different stages. The provider designs the oversight measures into the high-risk system before it is placed on the market (Article 14 with Article 16) — for example showing confidence levels, not pre-filling the human's choice, and prompting an independent rationale. The deployer (Article 26) assigns oversight to competent persons and trains them specifically to recognise and resist over-reliance, giving them genuine authority to override the system. Design without trained, empowered overseers is not effective oversight.
Does having a human approve each AI decision satisfy Article 14?
Not necessarily. If the human approves reflexively — through over-trust, time pressure or lack of authority — the oversight is cosmetic and fails Article 14, which requires effective oversight. Article 14(4)(b) specifically targets this by requiring the design to help the person stay aware of and counter automation bias. A meaningful signal is the override rate: a near-zero rate often indicates deference rather than genuine, case-by-case human judgement.
Which penalty tier applies if human oversight fails?
A breach of the Article 14 human-oversight requirement falls in the €15,000,000 or 3% of total worldwide annual turnover tier (whichever is higher) under Article 99(4). For SMEs and start-ups, the Article 99(6) cap applies the lower of the percentage or the fixed amount, and Article 99(6a) does the same for small mid-caps for Article 99(4) and (5) fines (not for prohibited practices). The €35M/7% tier is reserved for Article 5 prohibited practices, and the €7.5M/1% tier for supplying incorrect or misleading information to authorities — not for an oversight failure.
How do I evidence that we've countered automation bias?
Document both layers. On the design side, record the provider measures — confidence and uncertainty displays, no pre-filled AI decision, mandatory independent rationale, flagging of borderline cases. On the deployment side, keep training records showing overseers were taught to recognise and resist over-reliance, evidence of their authority to override, and monitoring data such as override rates. These records demonstrate to a market-surveillance authority that the Article 14(4)(b) obligation is met in substance, not just in form.
Related guides
- Article 14: human oversight
- Human-in-the-loop vs on-the-loop — glossary
- Human oversight implementation
- Article 10: data and data governance
- Article 9: risk management system
- AI literacy — glossary
- Bias in AI systems
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →