AG-819
Oversight-Gap Declaration
EU AI Act
NIST AI RMF
ISO 42001
AGS Frontier Autonomy (Group K) | Meta-Governance & Assurance | Version 3.0
Oversight-Gap Declaration governs the explicit identification, quantification, and justification of the gap between an agent's capability and its overseers' ability to verify that capability — requiring an organisation to state, for each consequential deployment, how large the oversight gap is and why oversight remains reliable across it.
A scalable-oversight protocol (AG-818) is only meaningful if the gap it must span is known. This dimension forces the gap to be named: an organisation cannot claim "we have human oversight" without declaring whether humans can actually verify the agent's outputs, and how that claim holds as capability scales.
In scope: measuring/declaring the capability-vs-verifiability gap per consequential deployment; justifying oversight reliability at that gap; updating the declaration as capability grows; using it as a deployment-gating input.
Out of scope: the oversight method itself (AG-818) and the capability evaluation (AG-802). This dimension governs *the declaration and justification of the gap*.
Organisations routinely assert "meaningful human control" without examining whether their humans can meaningfully control the system at all. As capability rises, the same governance language masks a widening, undeclared gap. Forcing an explicit oversight-gap declaration makes the erosion of real oversight visible and reviewable, prevents an "oversight in name only" posture, and gives regulators a concrete, comparable artifact.
Test 6.1: Declaration Exists
Test 6.2: Update on Capability Change
Test 6.3: Gap-Triggered Response
| Score | Criteria |
|---|---|
| 0 | No analysis of whether overseers can actually verify the agent ("oversight" assumed) |
| 1 | Gap acknowledged qualitatively but not quantified or justified |
| 2 | Quantified per-deployment declaration with justified reliability, owner approval, update-on-change |
| 3 | Gap-gated deployment, independent review, portfolio tracking, authority disclosure |
Scenario A — Oversight Theatre: A deployment claims "human-in-the-loop" while humans approve outputs they demonstrably cannot evaluate. An oversight-gap declaration would have exposed that the control was nominal.
Scenario B — Silent Widening: Successive model upgrades widen the gap without any declaration update; oversight quietly degrades from real to nominal over a year, unnoticed until an incident.
Scenario C — Unbounded Gap Shipped: A new capability puts the agent far beyond verifiable oversight, but with no gap-triggered response the deployment proceeds at full autonomy.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Declare the oversight gap | Art. 14 — Human oversight | MAP 2.2 — Knowledge limits & oversight | Clause 6.1 — Actions to address risk |
| R2: Justify reliability across the gap | Art. 55 — Model evaluation | GOVERN 1.3 — Risk-based activity | Clause 8.3 — Verification |
| R3: Update on capability change | Art. 9 — Risk management lifecycle | MANAGE 4.1 — Post-deployment monitoring | Clause 9.1 — Monitoring and measurement |
| R4: Gap-triggered response | Art. 55 — Risk mitigation | MANAGE 1.3 — High-priority response | Clause 6.1 — Actions to address risk |
| R5: Owner approval + independent review | Art. 55 — Governance | GOVERN 2.1 — Accountability | Clause 9.3 — Management review |
| R6: Retained safety case / disclosure | Art. 11 — Technical documentation | GOVERN 4.3 — Information sharing | Clause 7.5 — Documented information |
| R7: No oversight theatre | Art. 14 — Effective oversight | MAP 3.5 — Human oversight | A.9 — Use of AI systems |
Article 55 systemic-risk assessment must reckon with whether oversight is real; Article 9 requires lifecycle risk management. AG-819 makes the oversight gap an explicit, managed risk artifact rather than an unexamined assumption.
GOVERN 1.3 (risk-based activity levels) and MAP 2.2 (document system knowledge limits and human oversight of outputs) require exactly the declared, justified oversight gap.
Clause 6.1 (actions to address risks) and Clause 9.1 (monitoring) require identifying and acting on the oversight gap as a managed risk.