prEN 18229-3 reaches Enquiry

prEN 18229-3, the human oversight standard under JTC 21, reached CEN Enquiry ballot. It is Part 3 of the AI trustworthiness framework, sitting alongside prEN 18229-1 (logging, Article 12, already under Enquiry), prEN 18229-2 (transparency, Article 13), prEN 18229-4 (accuracy, Article 15) and prEN 18229-5 (robustness, Article 15). This one supports Article 14. Most commentary on Article 14 stops at the text of the Regulation: systems shall be designed so that natural persons can oversee them. prEN 18229-3 is what happens when you try to turn that sentence into something a conformity assessment body can check. The result is more interesting than Article 14 suggests.

If you take one concept from this standard, take this one. Everything in prEN 18229-3 is calibrated against a single number: the reaction timeframe, defined as the maximum time available for a designated person to react after the AI system produces an output, before the harm occurs. The provider determines this timeframe during risk management, per risk scenario, under prEN 18228.

The reaction timeframe is not a choice. It is a property of the hazardous situation itself, derived from the causal chain to harm, the estimated severity, and the exposure. For some systems it is measured in milliseconds. For others, hours or days. It drives:

• Which measure category is available. Short timeframes push toward continuous monitoring or pre-configured alert-triggered intervention. Long timeframes can be satisfied by retrospective review.

• Whether a single category suffices, or measures must be combined. The provider must select at least one measure per risk scenario, and the selected measures must be collectively sufficient to enable intervention inside the timeframe. Where no single category achieves this, the standard requires combining categories.

• Whether real-time human oversight is possible at all

This is the same architectural move the corpus has seen before in prEN 18229-1: a single determination in risk management becomes the conductor of a series of requirements. In logging, we saw the five hazardous-situation characteristics driving logging requirements. Here, it is one number: the reaction timeframe.

In truth, this is the key to the more technical harmonised standards - finding that crucial organising conductor of the rest of the requirements.