Home / Requirement record / B.4
B.4
Level of automation
AI-related risk source: The degree to which the system acts without human involvement determines how far a wrong output can propagate before anyone intervenes, so the level of automation and the human oversight around it are a source of risk. Use level of automation as a prompt in the identification step, not as a finding.
- What it asks
- AI-related risk source: The degree to which the system acts without human involvement determines how far a wrong output can propagate before anyone intervenes, so the level of automation and the human oversight around it are a source of risk.
- Where generative AI changes the answer
- The level of automation decides whether a bad output is a draft someone reads or an action already taken.
- Reading it in practice
- The level of automation decides the consequence of a wrong output. A draft that a person edits is a different risk from an action taken in a system with no review. The evidence is a workflow map that marks every point where the output is acted on without a human check, and the reason that point is acceptable.
- Who it binds
- The assessment team that runs identification, and the business owner who knows the use. For B.4 the named role is the owner of documented level of automation and the human control points.
- Evidence an auditor normally samples
- Documented level of automation and the human control points
- The test you can run
- Take documented level of automation and the human control points and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.
- Common failures
- Full automation with no defined intervention point
- Before the draft publishes
- For B.4, add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present. The first artefact to produce is documented level of automation and the human control points.
- Where this sits against the draft
- B.4 carries the annex b: ai-related risk sources part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on B.4 (level of automation) with this record and note the change in the register.