whitepaper

Engineering Team Design for AI Under Regulation.

Regulation (EU) 2026/1744 pulled two obligations apart. Article 4 AI literacy was rewritten as a duty to support development rather than to ensure it, and the new text says plainly that no provider or deployer has to guarantee any individual's level.

Article 14 human oversight was not reopened: a natural person, with competence, training and the authority to stop a running system. One of those can be discharged with a course catalogue. The other needs somebody who can take revenue offline on a Thursday and keep their job.

Download whitepaper Talk to Our Engineers

In depth

One Duty Relaxed, One Did Not, And The Budget Followed The Wrong One.

An obligation of result became an obligation of means.

Regulation (EU) 2026/1744 replaced the Article 4 requirement to ensure a sufficient level of AI literacy with a requirement to take measures supporting its development, and it states in terms that neither providers nor deployers must guarantee any specific level for any individual. A literacy programme with sessions, materials and an attendance record now discharges it. Evidence of provision has replaced evidence of attainment, which makes it the cheaper of the two obligations to satisfy.

In shortEvidence of provision has replaced evidence of attai…

Article 14 was not reopened, and it names three things.

Competence, training and authority, and the third one is where appointments fail: a senior engineer is listed as the human in the loop, and the operational question is whether that person can halt the system on a Thursday afternoon without anyone's approval. Competence can be hired and training can be bought, but authority has to be granted by whoever would otherwise overrule it. A kill switch nobody is permitted to pull is a design feature with no owner.

In shortA kill switch nobody is permitted to pull is a desig…

A fine-tune can move you across the provider boundary in an afternoon.

Provider and deployer carry different sets of duties, and the line between them turns on what the organisation does rather than on what the stack contains, so adapting a hosted model, renaming the result and putting it in front of customers can change which column applies. The endpoint keeps its name, the dashboard keeps its name, and the engineer who ran the job records an experiment identifier. Fine-tuning, substantial adaptation and rebranding belong on a short list of actions that cannot run without a named approver.

In shortFine-tuning, substantial adaptation and rebranding b…

Accountability does not transfer by reorganisation announcement.

A squad is folded into another group, two engineers leave, the remaining one moves to the new priority, and the assistant they built is still answering customers every minute of every day. The appointment still names somebody, and that somebody now has a different manager, a different backlog and no access to the deployment pipeline. Transfer happens when a successor is named, briefed on the failure modes, granted the same stop authority and recorded as holding it from a given date.

In shortTransfer happens when a successor is named, briefed…

The detail

Three Duties That Resolve To A Person, And What Proves It.

A duty with no role attached is a paragraph in a policy, and a role with no evidence attached is an assertion. Each of these three names the person who carries it and the artefact a supervisory authority or a customer's auditor would be shown.

Zone · 01

The oversight appointment

Article 14 asks for a named natural person per system, not a committee and not a rota with gaps. The artefact is an appointment record carrying the individual, the date, the specific mechanism they may invoke alone - disable the endpoint, revoke the key, route to the fallback - and a dated exercise in which they used it.

Zone · 02

The literacy programme

Article 4 now sits on the organisation rather than on the learner, so the manager who funds and schedules the measures holds it. Record what was offered, who was in scope and when. The rewritten text does not ask you to guarantee anyone's level, which means a register of sessions and attendance is the whole evidence requirement.

Zone · 03

Release sign-off

Whoever applies the release threshold should not depend on the release for their objectives. One person may build; a different person, outside the delivery reporting line, must be able to refuse on evaluation evidence and have the refusal stand. The artefact is an approval record naming the reviewer and the thresholds, and an approval log with no rejections in it evidences a rubber stamp.

By the numbers

The figures that make it a board-level conversation.

Article 14

the human oversight duty Regulation (EU) 2026/1744 did not reopen at all

team archetypes DORA identifies across nearly 5,000 technology professionals

productivity gain from developer independence, at team and individual level alike

Inside the report

What you'll take away.

Step 1 - Name the Article 14 person and write down what they may do alone

One individual, a date, and the specific mechanism: disable the endpoint, revoke the key, route to the fallback. If the answer is that they would raise it with someone, the appointment is not real yet.

Step 2 - Exercise the stop once, deliberately, and keep the record

A rehearsed intervention against a live system in a controlled window proves competence, training and authority in one artefact. An authority nobody has ever used is indistinguishable from one that was never granted.

Step 3 - Gate the actions that change which duties apply

Fine-tuning, substantial adaptation and rebranding move a system across the provider boundary. List them, require a named approver in the pipeline, and record the classification per system so it is a decision rather than a discovery.

Step 4 - Make the handover a condition of every reorganisation

Predecessor, successor, effective date and a briefing on the system's failure modes, produced before the structure change lands. Systems outlive the teams that build them, and this obligation is the one that fails silently.

Questions

Frequently asked.

Did the Digital Omnibus make AI literacy optional?

No. Regulation (EU) 2026/1744 rewrote Article 4 rather than repealing it, so the duty to take measures supporting AI literacy still binds. What changed is the standard of proof. You evidence it with a programme and an attendance record instead of with an assessment of any individual's level.

Can a committee hold the Article 14 oversight role?

Article 14 asks for natural persons with competence, training and the authority to intervene and to stop. A committee meets monthly and cannot be paged. Name an individual per system with a named deputy, and record the mechanism each of them may invoke without asking anybody else first.

The high-risk deadline is December 2027. Why name roles now?

Annex III stand-alone obligations apply from 2 December 2027 and Annex I from 2 August 2028, but naming a role is the slow part. Granting somebody the authority to take revenue offline is a decision an executive has to make, and an unexercised authority proves nothing until it has been drilled.

What are the penalties attached to these duties?

For most operator duties the Article 99 ceiling is whichever is larger, EUR 15M or 3% of annual worldwide turnover, and the test inverts to whichever is smaller for SMEs, start-ups and small mid-caps.

Prohibited practices run to EUR 35M or 7%. The likelier cost is a system nobody can halt.

How does this differ from your engineering reference on team design?

This report asks which duty lands on which person and what proves they carry it. Engineering Team Design for AI: An Engineering Reference is the catalogue underneath it, numbering the organisational structures family by family with the artefact each one produces. Read this for who answers, that one for what to build.

Who is this report for?

VPs of engineering and heads of risk who own the answer when somebody asks which named person can stop a system. It assumes you already have AI in production and an org chart that was drawn for delivery rather than for accountability.