Who reviews a flag, and under what authority

1. Who reviews

A flag is reviewed in the ComplyEdge dashboard by the person signed in to the account. An account has one sign-in, its account holder, so the record names that person with reviewer_role: account_holder. An API key cannot review a flag.

The reviewer is recorded as a pseudonym of the signed-in email address, keyed to your account. The email address itself is not in the record.

2. Where the authority comes from

A deployer of a high-risk AI system assigns human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support (Regulation (EU) 2024/1689, Article 26(2)). The deployer duties of Article 26 apply from 2 December 2027. That assignment is yours, made under your own process.

ComplyEdge records that a review was made, by whom and with what result. It does not assign oversight, and it does not check that the reviewer has the competence, training or authority your process requires.

3. What a flag is, and what it is not

A flag is raised on an allowed request whose text touches a provision where compliance is a judgement: the disclosure that content is AI-generated (Article 50(1)), deep fake disclosure (Article 50(4)), transparency to deployers (Article 13), human oversight (Article 14) or resistance to prompt injection (Article 15). When the account turns on semantic review, every allowed request is flagged. When the plan includes the model review, its assessment is on the flag; otherwise the flag says it was not assessed. Either way a person decides.

Raising a flag is not an assignment of human oversight under Article 26(2). Reviewing a flag in the dashboard does not by itself meet that obligation. It is evidence that one review was made; whether the reviewer is the person your process put in charge is for your process to show.

4. What the oversight record holds

• • proposal_ref: the decision record that was reviewed.
• • oversight_action: accepted when the reviewer found a violation, disregarded when the reviewer found the output compliant, with the matching reason_code.
• • reviewer, reviewer_role and this page as authority_ref.
• • review_opened_at: when the flag was raised. The record's own time is when the review was made.
• • inputs_ref: the dashboard page of the flag. It shows the provision and, when the model review ran, its assessment, confidence, explanation and recommendation. The checked text is not on it: ComplyEdge never stores it, and the model review receives only its hash. The reviewer finds the text in your own systems by the decision's request id.

Review notes stay on the flag. They are never written to the audit record. Sending a flag to legal counsel writes no record, because no final review has been made yet.