PALO: effective oversight and agentic trustworthiness

Research and extension proposal · 10 October 2026 · Prepared for the European AI Office technical discussion

Decision brief

PALO has a credible foundation for this work: a six-stage governance lifecycle, explicit fairness and data-lifecycle controls, evidence contracts, action-bound approval, data-fitness decisions and outcome verification. The next development step is to connect those foundations to measured human intervention, trajectory-level bias evaluation and multidimensional data fitness. Treating trustworthiness as a single score would weaken that design.

The strongest contribution PALO can bring to the discussion is a reviewable chain from a harm scenario to a selected control, a test, its result, the affected action and an accountable decision. An integration, signed record or successful code test does not establish legal conformity or real-world effectiveness. A person named as a reviewer is not evidence that effective oversight exists.

Six proposed extensions form one coherent work programme:

1. Scenario-based oversight qualification: reaction windows, complete intervention timing and supported modes.
2. Human review capacity and independence: realistic load, competence, accessibility, escalation and active challenge.
3. Verified intervention and recovery: distinguish rejection, substitution, reversal, containment and safe resumption.
4. Agentic bias assessment: evaluate data, routing, tools, outcomes and repeated feedback at relevant population levels.
5. Purpose-bound data quality: measure separate dimensions on versioned sources and invalidate dependent decisions after change.
6. A composed assurance case: preserve applicability, evidence quality, unresolved findings and distinct authority boundaries.

The deliverable includes 45 oversight and 45 bias mapping records, a proposed machine-readable research profile, read-only evidence-screening prototypes and a concrete evaluation programme. The profile is an additive research artifact; it has not been installed into PALO-AI's live enforcement path or accepted as a new canonical framework release.

What was reviewed and source boundaries

The supplied prEN 18229-3:2026, July 2026 enquiry draft was read across all 29 PDF pages. Its scope, definitions, operative clauses, Annex ZA and bibliography were inspected. The reaction-time, intervention and Annex ZA pages were also rendered to check extraction and layout. Clause references below refer to that supplied edition. The PDF and extracted standard text remain outside the public deliverable.

The supplied prEN 18283:2026 N1240 sneak-peek revision, identified on its cover as 16 September 2026, has now been read across all 106 PDF pages. Its visible tracked changes, unstable numbering and editorial conflicts are documented in the reconciliation below. The analysis covers the full supplied text; it does not treat this copy as an adopted standard or a clean final enquiry edition. The earlier public-announcement-only boundary is superseded. Neither supplied PDF nor its full extraction is published. Official public enquiry announcement

The PALO review spans methodology, canonical control and indicator registries, all twelve governance control packs, all six decision gates, relevant evidence schemas, interoperability documentation, runtime data-assurance and approval code, swarm cancellation code, source/version governance and the complete existing 40-slide presentation. A repository inventory records 320 candidate files: 127 resident files and 193 cloud placeholders. Thirty-six selected framework paths were collected as 57 current working-tree and/or published versions, with SHA-256 provenance. Cloud placeholders were not silently treated as reviewed source. Published counterparts were used where needed and are identified in the baseline manifest. This is a cross-layer architecture and evidence assessment, not a line-by-line security audit of every repository file or an independent deployment audit.

The review identifies capabilities in source and published specifications. It does not infer their production deployment from documentation. The current scalar data-fitness function was additionally exercised with seven synthetic in-memory probes. The original research prototype passed 31 synthetic checks; the new fixed-family bias screen passed 30 additional checks. No real company system, worker population, protected group, production connector or live model was evaluated in those checks.

Source status and legal scope

The supplied human-oversight document is an enquiry draft, not an adopted European Standard. Its Annex ZA describes a conditional relationship to Article 14; the table's coverage labels do not themselves establish a current presumption of conformity. A draft crosswalk must not be labelled harmonised compliance. NEN independently identifies the document as a draft for consultation. NEN oversight announcement

The legal baseline was rechecked against the 27 July 2026 consolidated AI Act. Articles 9, 10 and 14 are relevant within their high-risk scope; proportional PALO safeguards can also be adopted for other systems without importing every high-risk duty. Article 10(6) distinguishes testing-data requirements for high-risk systems without model training. The current consolidated text locates the special-category bias-processing provisions in Article 4a, rather than the former Article 10(5). Article 4a(2) covers additional actors/systems under strict conditions, but does not create a general bias-testing obligation. It is not blanket permission to collect demographic data or send it to a cloud copilot. Article 40 conditions presumption of conformity on the applicable published Official Journal references and their scope. AI Act consolidated text

For the RBI-specific draft provisions, Article 14(5) concerns the relevant Annex III biometric-identification systems and includes stated legal exceptions. The two-natural-person arrangement must therefore be handled as an applicability-reviewed profile, not a universal requirement for every agent. Two model agents do not count as two natural persons.

ISO/IEC 5259-2:2024 provides a data-quality model and measures for analytics and machine learning, including structured and unstructured data. Its public overview supports the direction of multidimensional measurement; a licensed full-text crosswalk has not been performed here. ISO/IEC TS 12791:2024 concerns unwanted-bias treatment in classification and regression ML tasks; extending a measure to open-ended agent trajectories requires a separately justified method. ISO/IEC FDIS 42105 remains under development in the official catalogue checked for this review; it is informative background, not a substitute for the supplied European draft. ISO 5259-2, ISO TS 12791, ISO FDIS 42105

The current PALO foundation

The published v3.1 control plane contains 31 controls, 38 indicators, 12 control packs and 6 gates. Its own documentation distinguishes governance completeness, operational effectiveness, production readiness and certification. That separation should be retained, with any completeness statement explicitly tied to a named release, source set and review date. A new draft or operating context can expose additional needs in a previously complete registry.

The full twelve-domain review also covers GPAI roles, systemic risk, Article 50, serious incidents, retirement and environmental performance. These remain connected: an oversight change may affect accessibility, energy demand, privacy, provider responsibilities or incident reporting. No domain should be silently marked complete because another domain's metrics are good.

Source pointers: control packs, control library, indicator registry, governance control plane, data-assurance design.

1. Qualify oversight against the action's harm window

The most consequential requirement is the comparison between the available reaction window and a realistically achievable human intervention. Both must terminate when mitigation takes effect. An alert arriving in five seconds is insufficient if interpretation, approval, connector delivery and physical or digital actuation require another minute. An approval TTL describes how long approval is accepted; it is not a measurement of time-to-harm.

For engineering evaluation, PALO should record a complete-loop decomposition:

T_effect = T_queue + T_notification + T_understanding_and_decision + T_actuation + uncertainty_margin

The proposed feasibility screen is T_effect <= T_reaction_window. This is an engineering proposal derived from the draft's timing distinction, not an equation mandated by the draft. It must use a justified operational envelope and end-to-end measurements. Adding component p95 values does not produce an end-to-end p95 guarantee. Minimum feasible human time, a measured response distribution, the tolerated tail probability and any bounded worst-case claim are different quantities and must be labelled separately.

For an agent swarm, shared human attention is a limited resource. Four individually manageable agents can generate a correlated burst of alerts that overwhelms a single person. Measure queue age, simultaneous scenarios, assignment conflicts, shift coverage, handovers, language/accessibility needs and fatigue. Capacity policy must slow or contain the workload when the qualified envelope is exceeded; it must not silently bypass review.

Where no human loop can fit the reaction window, the draft's route is automated protection and retrospective oversight. A pre-execution hold can create time only if it actually prevents the consequential effect and is safe for the process. An industrial process may require controlled degradation rather than an abrupt halt. The operator must qualify that choice.

PALO delta: add a versioned oversight-scenario profile linked to the Case File, Action Claim, harm scenario and evidence bundle. Bind its validity to model/tool/UI versions, staffing assumptions, deployment and workload. Reopen the profile after material change. The existing human-review control remains the anchor; it gains concrete operational evidence rather than a duplicate policy slogan.

2. Separate approval, intervention and safe recovery

PALO already binds approval to the exact Action Claim. That is valuable protection against substituting a different operation after approval. It does not demonstrate that the reviewer understood the action or that an intervention can change an in-flight outcome.

The draft requires at least one of disregard, override or reverse, plus a stop function or equivalent procedure. It does not require pretending that every real-world action is reversible. PALO's existing compensation design appropriately uses a new governed Action Claim. A compensating transfer, corrected email or reverted database field does not necessarily erase all effects of the original action.

The proposed event model should distinguish requested → received → applied → externally observed, with late, unsupported and unknown terminal evidence states. A worker acknowledgement is not sufficient. The current cancellation code already makes that distinction through a separately provisioned verifier; qualification must add scenario timing, cross-worker dependencies, network partitions and restart control.

A stop-path study must test the availability of the intervention trigger independently of the failed agent path, stale UI state, connection loss, irreversible actions, partial effects and unsafe automatic resumption. In-flight uncertainty retains the hold and exposure until accountable reconciliation. Do not return a green result merely because no new log line arrived.

3. Assess automation bias as a property of the human-system interaction

Automation bias is not the same as demographic disparity. A reviewer may accept a technically valid, source-cited answer too readily; a demographically balanced model may still induce passive human acceptance. Conversely, an attentive reviewer does not make biased data representative.

Extend PALO's existing explanation and literacy controls with a controlled evaluation: representative designated persons receive a counterbalanced mix of correct, ambiguous and deliberately flawed recommendations under realistic load. Compare UI variants with explicit uncertainty, counter-evidence, alternatives and action consequences. Measure incorrect acceptance, hazard detection, appropriate intervention, time to effective action, review consistency and workload. Record the task mix, training, population, learning effects and uncertainty.

A high override rate is not inherently good: it can indicate model defects, reviewer error or inappropriate thresholds. A low override rate may reflect correct recommendations or ineffective oversight. Review completion, source citation and self-reported confidence should never be substituted for task performance. The copilot should present evidence and concise reasons without suggesting that fluent rationale is proof of correctness.

4. Extend bias assessment from model output to the whole trajectory

The full supplied prEN 18283 revision supports data, component, output and outcome analysis. The stage-specific design below is PALO's agentic application; Sections 7A–7F reconcile it with the supplied clauses and document unresolved editorial issues.

The unit of analysis matters. Ten tool calls from one task are not ten independent people or cases. Repeated interactions, agents sharing a model and overlapping cohorts create dependence. The production analysis should use a design that handles those dependencies, such as justified case-level aggregation or cluster-aware resampling, rather than manufacturing sample size from message counts.

Group definitions, comparator choice, metric direction, utility/harm trade-offs and thresholds require stakeholder and accountable review. Record intersectional groups and unknown membership; protect people from unnecessary inference of sensitive attributes. A small or missing group yields insufficient evidence, not a fairness pass. Examine selection effects: only analysing completed cases can hide who was excluded, abandoned the process or was routed away.

A minimum metric record should include system/model/tool versions, stage, population, evaluation window, selection protocol, denominator, outcome definition, uncertainty method, threshold rationale, exclusions, evidence reference and owner. A rate difference is descriptive unless the study supports a causal claim. Passing one fairness criterion does not establish compliance with anti-discrimination law or absence of representational and individual harm.

The original 0.1 research prototype demonstrates these principles with synthetic binomial outcomes only. It uses separate Wilson intervals as a conservative descriptive screening envelope. This is not a calibrated simultaneous confidence interval for a difference, not a multiple-testing method and not a validated general agentic fairness evaluator. It deliberately returns insufficient evidence when the envelope crosses the illustrative threshold. The separate 0.2 bias screen below adds fixed-family error control and absolute performance criteria; it remains a bounded research method.

5. Replace the scalar-quality inference with purpose-bound dimensions

PALO's current data-fitness evaluator checks an imported scalar score alongside freshness, authority, ownership, approval, lineage, access, incidents, classification and permitted purpose. The synthetic probes confirm those controls behave as expected. They also confirm that the configured scalar policy can return allowed without evaluating subgroup disparity or human reaction time. That is a boundary of the tested policy, not evidence that the framework claims those properties.

A proposed data-quality record should keep separate dimensions and prohibit compensation between critical failures:

These are proposed measurement areas informed by the published ISO 5259 direction and PALO's existing lineage controls, not a reproduced or complete ISO 5259 measure catalogue. A reliable source can be outdated; a fresh source can be wrong; complete fields can encode a biased construct; high annotator agreement can preserve a shared misconception.

Quality must be re-evaluated along the trajectory: a summarised memory, retrieved chunk, tool result and generated plan may each change meaning or lose constraints. Bind the decision to purpose, subject/version, source snapshot, metrics and expiry. A model update, new retrieval corpus, changed tool schema, new subgroup or feedback loop should identify and invalidate affected assessments. PALO's assurance-signal and fitness-binding mechanisms provide a useful technical starting point, but a full multi-asset dependency graph and verified enterprise reopening workflow remain development work.

6. Compose a trustworthiness case without a universal trust score

The proposed case structure is:

Claim → applicability and scope → risk scenario → selected controls → independent challenge → evidence and uncertainty → accountable decision → expiry/reopen trigger.

Use distinct results for legal applicability, data fitness, bias evaluation, oversight qualification, action authority, external outcome and production admission. Critical failures are conjunctive: a good fairness result cannot offset a missing stop path, and a safe execution cannot legalise a prohibited purpose. Unknown evidence must remain visible.

Three evidence questions recur: is the artifact authentic and current; is the measurement scientifically and operationally appropriate; and does the claimed conclusion follow? A digest answers an integrity-binding question, not all three. A signed record with a false source assertion remains false. Evidence review must examine source independence, selection, denominators, conflicts and adverse cases.

Provider responsibilities, deployer arrangements, connector/operator obligations, designated-person authority and affected-person remedies belong in one responsibility matrix. Contractual allocation does not automatically eliminate legal duties. The existing system-card, assurance, affected-person and AIMS records can hold most of this structure; the extension should add typed scenario and evaluation records rather than replace them.

Concrete extension architecture

Proposed flow: enterprise evidence adapters → versioned source/quality records → oversight and bias assessment records → composed review dossier → accountable governance gate → existing exact Action Claim / authority path → governed executor → independently observed outcomes → monitoring and reassessment.

The new research profile binds caseId, systemVersion, scenarioId, actionClaimDigest and purpose; it carries reviewed evidence references, an applicability record, complete-loop timing, workload assumptions, intervention declarations, separate data dimensions and cohort comparisons. The prototype accepts a separate expected context so that an old or substituted record cannot silently match itself.

Its results are eligible_for_review, hold and insufficient_evidence. None authorises execution. The program performs structural and numerical screening over supplied records; it does not authenticate an evidence source, confirm that a user study happened or resolve legal applicability. A future production gate must load evidence from a trusted registry, verify signatures and revocation, enforce tenant and role boundaries, validate chronology and measurement units, and prevent unreviewed profile replacement.

For interoperability, use a sidecar evidence record composed into existing Case Files and evidence bundles. Do not insert unknown fields into strict Action Claim 1.4 schemas. A later runtime integration requires a reviewed versioned binding or envelope, compatibility fixtures and migration documentation. Existing stable controls and source IDs must retain their meaning. The first integration should remain in shadow mode: compare assessments without controlling real actions.

Suggested control additions

These are proposed extension identifiers, not newly released canonical ctrl-* entries.

7A. Full bias draft reconciliation and source quality

The second supplied document is now available and has been read across all 106 PDF pages, including scope, definitions, Clauses 6–13, informative Annexes A/B/ZA and bibliography. The cover identifies CEN/CLC/JTC 21/WG 3 N1240, 18283_sneak_peek_for_ENQ_15092026, with document date 16 September 2026; the internal title page retains 5 March 2026. This is a supplied sneak-peek revision with visible tracked changes, not a clean final enquiry text and not an adopted standard. PDF page numbers below count the committee cover as page 1. Broken references and changing clause numbers make the heading and page essential identifiers.

Original analysis and the crosswalk are published; the supplied PDF and its full extracted text are excluded from the website, copilot corpus and downloads. Full-text review closes the earlier source-availability gap. It does not establish compliance with a future edition, public availability of this committee copy, or implementation of all its requirements.

Five source issues need standards-review attention. First, the outcome-analysis modal conflict appears on PDF pages 43 and 50. Second, Clause 6.4.2 asks for disjoint scenario comparison groups, while Clause 8 also uses an unconditioned full-data baseline; record the aggregate diagnostic separately from the disjoint scenario comparison. Third, references such as 10.7[10.8] and repeated 8.3 labels show ongoing renumbering. Fourth, several metric descriptions contain sign, ratio-versus-difference or formatting inconsistencies; do not turn raw PDF extraction into executable formulas. Fifth, Clause 9's visible revision refers to the final pre-deployment iteration for required reporting; it does not support claiming that every historical iteration must be published. PALO can retain the complete internal version history as its own stronger evidence practice.

The draft's informative Annex ZA, PDF page 104, aims at Article 10(2)(f) and (g). It is not a mapping to the whole AI Act. Its conditional language concerning a future Official Journal citation is not a present presumption of conformity. Use the current consolidated legislation and its actual applicability alongside the draft; draft text cannot supply a data-processing legal basis or a certificate. AI Act, Articles 10 and 40

7B. A versioned bias profile as part of the PALO assurance case

Clauses 6 and 7, PDF pages 26–42, make the bias profile a living collection of evidence connected to risk management. This is a particularly good fit for PALO's Case File and evidence-bundle architecture. It should be an evidence sidecar with a defined owner and version, not a new unverified fairness score attached to every Action Claim.

The profile receives inputs from three processes: quality management supplies the intended purpose and system requirements; risk management supplies affected persons, harm scenarios and risk-acceptance criteria; data-quality governance supplies population assumptions, sampling validity, provenance, dimensions and results. Functional-correctness evidence and reusable component profiles are further inputs. Missing inputs must be identified and completed rather than silently omitted.

The proposed PALO sidecar has six linked records:

1. Profile identity and applicability: source edition, system and component versions, deployment, intended purpose, affected population, legal route, owner and predecessor. Reusing a component creates a scoped reuse review; its previous acceptance does not transfer automatically.
2. Group and scenario register: category, group definition, relevant intersections, at-risk and vulnerable populations, comparator, hazard, potential cause, hazardous situation and foreseeable harm. Each inclusion, exclusion and grouping decision has a reason and evidence source.
3. Metric and protocol register: level, task, positive class or outcome, unit, denominator, selection rationale, quality floor, disparity criterion, uncertainty method, family, error allocation, confidence, precision and preregistration record.
4. Completion and evaluation reports: qualified dataset snapshots, measurement results, all registered comparisons, failed or unavailable evaluations, uncertainty and interpretation. Preserve original and conditioned estimates together.
5. Risk decision and treatment: accountable reviewer, decision rationale, selected mitigation, trade-offs, residual risk, post-treatment evaluation and monitoring. The numerical evaluator cannot fill this role.
6. Lifecycle dependencies: source/model/tool/router/UI/policy/memory versions, validity period, incidents, complaints and explicit reopening triggers. Retirement includes retention, deletion and unresolved impacts.

A proposed interoperability flow is: enterprise test or monitoring adapters produce scoped evidence → a bias-profile assembler binds versions and studies → an independent measurement service evaluates the registered protocol → PALO composes findings into the Case File → accountable risk review selects the disposition → existing policy and exact-action authority checks remain necessary → independent observations feed reopening. This is an integration design, not a claim that a new service is already enforcing production traffic.

Sensitive case-level records remain in controlled enterprise storage. PALO receives permitted aggregates and controlled evidence references. The copilot explains the dossier, sources and limitations; it does not invent missing demographic labels, infer protected attributes from a conversation or pronounce a company compliant from an uploaded document.

7C. Agentic scope: where the draft changes the implementation plan

The draft distinguishes the source level of an observation from a potential cause of bias. Data, component, output and outcome are levels. Historical exclusion, automation bias, selection effects and presentation bias are possible mechanisms. A disparity does not prove its cause. This distinction must appear in PALO records and copilot explanations.

Clause 7.2 and informative Annex A support considering channel, language, accessibility and intersectional groups where the purpose, evidence and risk analysis justify them. Do not restrict the inventory to attributes explicitly provided to the model. Also do not mechanically collect every sensitive attribute listed in the illustrative lending annex. Relevance, legal authority, data minimisation, measurement validity and affected-person engagement must determine the approach.

For an agentic enterprise-service pilot, define the cohort at case admission, before routing or completion. Measure retrieval sufficiency, tool availability, avoidable retries, escalation delay, verified completion and remedy at successive stages. Publish stage-specific denominators and the end-to-end denominator; otherwise a router can hide excluded users before the model benchmark begins. A tool-call log is not a population sample. Repeated cases, shared users, time effects and clustered deployments require an appropriate dependence-aware design beyond the new fixed-case research screen.

Equal numerical error rates do not imply equal harm severity. A five-minute delay can be harmless in one process and consequential in another. Record both frequency and severity in the risk scenario. The consequence may result from the combined model, interface and human process, so the outcome observation must not be described as causal attribution to one component.

7D. Metric selection: five families and a conditioning layer

Clause 10 provides a non-exhaustive catalogue. The numbers in this supplied revision are unstable after regression: identify each family by its heading and PDF pages. The following is a selection guide for PALO research, not an implementation claim for every metric.

The draft's Relevant Group Information procedure specifically constrains the probe's purpose and treats intermediate inferences as sensitive. PALO should isolate these diagnostics, restrict access and retention, and prevent their reuse as an operational demographic inference service. Removal of an explicit attribute does not prove its proxies are absent.

Conditioning is particularly easy to misuse in agents: task complexity, channel and language may affect outcomes, but a feature can also encode the very disadvantage under investigation. Clause 10.7[10.8].2 requires risk-based justification and excludes direct or indirect proxies of the protected attribute under investigation from conditioning features. Retain a reviewed admissibility decision. Do not choose a conditioning variable merely because it makes the disparity smaller.

Report the original and conditioned estimates together. Distribution matching in this draft selects existing comparison observations or uses constrained weights; an observation must not be replicated or receive a weight above one. Document overlap, achieved balance, sample loss and uncertainty. A zero adjusted gap is not causal proof and is not a legal non-discrimination conclusion. Training re-sampling under Clause 12 is a different procedure from constructing the evaluation comparator; permissions and assumptions must not be mixed.

For each metric, use the Clause 11 template: name, alternative names, level, task, intent, motivation, applicability, limitations, inputs, outputs, interpretation, formula/algorithm, references and per-use definitions. A custom agentic measure needs a distinct name, justification and disclosure of limited validation. For the research demo, the endpoint is a binary verified case completion within a defined service window, with difference-of-outcome-rates and separate absolute completion-rate criteria. The profile must justify why comparison is appropriate; it does not cover representational harm, individual fairness, unequal harm severity or every possible outcome.

7E. Statistical acceptance: a measured gap is not a decision

Clause 7.4.4 and Clause 8, PDF pages 40–52, require a protocol chosen before estimation: a family-wise error-rate limit and allocation method for the hypothesis-test family, a common confidence level for estimates, and a maximum permissible margin for each estimate. The family covers the bias hypothesis tests in a procedure iteration. A set of convenient independent 95% intervals does not automatically meet that requirement.

Keep four quantities separate: the absolute performance floor; the acceptable disparity band selected through risk management; the precision limit; and the statistical error budget. A five-percentage-point disparity limit is not a five-percent probability of error. The null described by the draft is non-acceptability; failure to detect a difference is not affirmative evidence of acceptability. In addition, comparisons against a best-performing group selected from observed results need a selection-aware or simultaneous method.

The new bias-evaluation.mjs is a deliberately narrow research implementation. For K registered group means, independent binary cases within each group, fixed sample sizes and unweighted sampling, let alpha be the smaller of the registered FWER limit and one minus the required confidence. For each group with n cases, use radius sqrt(log(2K/alpha)/(2n)) around its observed success rate, clipped to [0,1]. Hoeffding's bound and a union bound yield simultaneous coverage of at least 1-alpha for the registered means under those assumptions. Difference bounds follow by subtracting opposite interval endpoints. Dependence between comparisons does not invalidate the union bound; dependence between cases within a group invalidates this implementation's sampling assumption. Hoeffding, original paper, 1963

This conservative construction is our engineering choice, not an algorithm prescribed by prEN 18283. Simultaneous intervals support the registered floor and equivalence decisions without treating their individual false-acceptance risks as unrelated. No favourable outcome is returned unless every required group and comparison satisfies its floor/band and precision requirement. Bounds crossing a criterion remain inconclusive; bounds entirely on an adverse side flag adverse evidence. Neither state is an accountable legal/risk decision.

An independently supplied digest binds the expected protocol and context. Protocol timestamps must precede collection, missing groups remain in the family, and changed sample sizes are not silently accepted. The digest is an integrity comparison at a caller trust boundary, not an authenticated signature or proof of genuine preregistration. Sampling, representativeness and measurement-review declarations are checked for presence; their truth needs external evidence. Real raw records, deduplication, group disjointness and population validity are not authenticated by this module.

The illustrative fixture uses two disjoint synthetic channels, 10,000 cases each, 95.0% and 94.8% completion, a 90% floor, a ±5 percentage-point disparity band, 95% confidence and a 5% FWER limit. These are demonstration parameters, not recommended regulatory thresholds. The demo also exercises equal poor performance, disparity, uncertainty, missing groups and protocol tampering. The method does not implement classification-error families, regression, ranking, weighted estimators, meta-metrics, optional stopping or correlated/sequential monitoring. If other metrics belong to the iteration, their full family must be integrated and reviewed before claiming iteration-wide control. Cross-iteration monitoring requires a separate sequential error-control design.

The original 31-check oversight/data prototype remains available and retains its scope. Its Wilson-based bias envelope is descriptive only; use the separate fixed-family screen to inspect the new statistical design. Neither prototype is a full implementation or validation of the draft.

7F. Mitigation, consultation and a practical adoption programme

Clauses 12 and 13, PDF pages 82–91, make treatment part of risk management and require evidence beyond a favourable metric. For each mitigation, record the hazard, selected method, rationale, trade-offs, post-treatment results, newly introduced or amplified bias, residual risk and continuing monitoring. Training, representation of affected persons, accessible interaction and organisational procedures are relevant alongside data, model and output interventions.

For PALO, a router change, tool-budget adjustment, revised escalation UI or retriever re-ranking is a controlled intervention. Bind the before/after configurations, test the original target hazard and the other affected groups, repeat oversight-capacity checks, and reopen the corresponding Case File. Better parity must not conceal lower accuracy, worse service for everyone, greater privacy intrusion or an overloaded human-review queue. Synthetic data can help test coverage and rare scenarios; synthetic parity does not validate real-population representativeness.

Consultation is an evidence process, not a generic claim that stakeholders were consulted. Record who participated, group coverage, representative qualifications, timing, accessibility and language accommodations, conflicting views, and the decisions actually changed. If consultation is the selected method, the draft calls for the known at-risk groups, particularly vulnerable groups or representatives. Other evidence routes are available under Clause 13.1; choosing only expert consultation or research requires the stated justification. Reusing earlier consultation requires a justified unchanged deployment context and documented use in the current decision.

The recommended first integration is one bounded enterprise workflow in shadow mode:

1. Register the purpose, risk route, relevant population, oversight scenario, endpoint and qualified datasets. Resolve draft ambiguities with standards/domain reviewers.
2. Create the bias sidecar and a complete measurement protocol, with immutable external registration, metric-template records and individual data-quality criteria.
3. Run paired reference workflows over the same tasks; collect stage and outcome evidence, failed/abandoned cases, workload, interventions and residual impacts.
4. Challenge protocol tampering, missing cohorts, proxy conditioning, correlated tool-call counts, poor ground truth, favourable aggregate scores and ineffective stop acknowledgements.
5. Review results with the domain owner, data-quality/statistics lead, human-factors lead and accountable risk owner. Choose proceed, revise or stop without delegating that decision to the copilot.
6. Only then qualify authenticated evidence exchange, tenant isolation, expiry/revocation, schema compatibility and production admission. A released profile needs registry/mapping/version governance; current strict Action Claim 1.4 fields remain unchanged.

The 45 oversight records and the accompanying bias crosswalk are review work items, not a count of satisfied legal requirements. The strengthened proposal makes PALO more ready for future standards because it can absorb new metrics, source editions and evidence findings without collapsing them into a universal compliance score.

Evaluation programme and release gates

No date should be treated as evidence of completion. The twelve-week pilot already proposed in the deck can allocate these workstreams, but duration must depend on access to representative users and valid operating evidence.

Minimum challenge set

• Change tool arguments after review: the old approval and profile cannot be reused.
• Preserve high average quality while one required dimension fails: the case remains held.
• Remove or undersample an affected subgroup: the bias assessment remains inconclusive.
• Compare two agents that share the same biased model: agreement is not independent validation.
• Route one cohort through a weaker fallback: evaluate whole-trajectory service quality, including non-completion.
• Flood a reviewer with correlated alerts: capacity limits and backup paths must work.
• Acknowledge stop while the external operation continues: do not report containment.
• Lose a worker connection after dispatch: preserve unknown effect, hold and reconciliation.
• Attempt reversal of an irreversible external effect: report the limit and verify the safe-state path.
• Alter the retrieval corpus, memory or feedback policy: reopen affected evaluations.
• Make the main review interface unavailable: verify a qualified fallback without expanding disclosure.
• In the optional RBI profile, use two accounts controlled by the same reviewer or expose the first judgment: independence must be challenged beyond superficial account counting.

Evaluate against a baseline consisting of the existing PALO control path and a documented conventional approval workflow, with comparable task populations. Pre-register the acceptance protocol. Include adverse effects of the extension itself: alert fatigue, extra delay, discriminatory hold rates, privacy intrusion and excessive operator burden.

Deployment and privacy boundaries

Current PALO-AI documentation explicitly describes a developer preview. The runtime uses reference persistence, in-process trust and operator-provisioned connectors. Production readiness still depends on isolation, credential custody, durable recovery, tenant controls, trustworthy observations and independent evaluation. The proposed extension cannot overcome those limits by adding a score or schema.

Bias assessment should minimise personal data. Prefer suitable synthetic or anonymised evaluation where it answers the question; where it does not, use the applicable lawful route and safeguards, with reviewed necessity, restricted access, retention and deletion. Public reports should expose aggregated findings and controlled evidence references. Do not send demographic microdata, raw personnel records or biometric material to the meeting copilot as a shortcut to assessment.

The supplied attachments were analysed as source material. They have not been added to the public site or copied into the copilot corpus. Public materials contain original analytical insights and source references. The new proposal and code are not an endorsement by CEN, CENELEC, ISO or the European Commission.

What changes in the Commission presentation

The existing deck's authority, budget, outcome and recovery material remains relevant. The revision adds a focused trustworthiness sequence: existing foundations and gaps; oversight timing; safe-state evidence; bias across trajectories; data-quality dimensions; and a concrete research-profile/code boundary. Executive viewers receive the key architectural and decision implications; the full route retains the implementation detail.

Existing slides on Article 9/10/14, proportional risk routes, enterprise interoperability, evidence maturity, adversarial testing, measures, the pilot and next steps are updated to connect those concepts. English notes explain the source status and limits. The audience view continues to omit the speaker script. Public slide retrieval is rebuilt from the updated audience content, with the analytical proposal clearly marked as a proposal.

The central meeting claim becomes: PALO can make delegated action and the evidence supporting trustworthiness reviewable across the lifecycle. Effective human control, fair outcomes and fit-for-purpose data require distinct tests and accountable decisions.

Technical evidence index

• oversight-crosswalk.json / .csv: 45 original clause-mapping records and proposed acceptance evidence.
• bias-crosswalk.json / .csv: 45 bias-draft mapping records, source digest and full-page review inventory.
• extension/bias-evaluation.mjs, bias-fixture.json and bias-evaluation.test.mjs: separate fixed-family statistical research screen.
• bias-test-results.json: 30 synthetic tests of the new statistical screen.
• baseline-manifest.json: hashes and origin of the selected PALO baseline versions.
• existing-fitness-probe.json: seven synthetic observations of the current pure data-fitness evaluator.
• extension/evaluate.mjs: read-only research evidence screen.
• extension/synthetic-profile.json: illustrative input; no real personal data or measured company evidence.
• extension/evaluate.test.mjs and extension-test-results.json: 31 synthetic checks and outcomes.
• repository-inventory.json: candidate-file inventory, including unavailable cloud-placeholder state.

The full supplied prEN 18283 revision has now been compared. The next source-review step is reconciliation against a clean authoritative enquiry edition, especially outcome-analysis force, comparator rules and renumbered references. The new 45-row bias crosswalk records proposals and evidence needs; it is not an assertion that every draft requirement is implemented.