id,source,clause,pages,verbalForce,topic,paloBasis,gap,proposedExtension,acceptanceEvidence,priority,status
HO-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",1,[7],scope,"Provider-oriented, cross-sector scope","Case File context, system registry and risk-route assessment",The presentation must distinguish applicability from a generic maturity score.,"Pin provider/deployer roles, system, intended use, jurisdictions and version before selecting controls.",Reject a scope record with undetermined roles or unreviewed applicability.,P1,partial foundation; extension proposed
HO-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",2,[7],normative references,"Dependencies on risk, logging and transparency drafts",source registry and semantic mappings,A mapping to one draft does not cover its dependencies.,Version-pin each referenced source and maintain change-impact decisions.,Change a referenced draft version and require crosswalk review.,P1,partial foundation; extension proposed
HO-3-4,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",3.4,"[11, 12, 13]",definitions,"Human role, overload and three different timing concepts",ctrl-human-review; system-card humanOversight,Approval timestamps do not measure the complete human-to-effect loop.,"Distinguish reaction window, minimum feasible human intervention, response initiation and actuator latency.",Use event timestamps with a common reference and documented clock uncertainty.,P0,partial foundation; extension proposed
HO-5-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.1,[13],objectives and informative notes,Effective oversight protects people and fundamental rights,ctrl-human-review; impact assessment,A business-loss-only definition misses harm to affected people.,Use a harm scenario and causal chain; justify oversight within the risk-control hierarchy.,Record technical prevention options and their adequacy before assigning human responsibility.,P1,partial foundation; extension proposed
HO-5-2-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.2.1,[13],shall,Identify risk scenarios,"Frame, Assess; ctrl-adversarial-testing",Generic use-case descriptions do not identify each agent/tool causal chain.,"Scenario IDs link outputs, hazards, downstream effects and affected groups.",Trace each consequential action to an approved scenario and owner.,P0,partial foundation; extension proposed
HO-5-2-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.2.2,[14],shall,Determine a reaction timeframe for each scenario,kpi-incident-triage-time; action/capability expiry,TTL and incident-triage time are not time-to-harm.,Add reaction-window bounds and their operational justification.,"Measure from the relevant hazardous output to mitigation taking effect, with clock uncertainty.",P0,partial foundation; extension proposed
HO-5-2-3,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.2.3,[14],shall,Select and justify collectively adequate measures,ctrl-human-review; lifecycle Control gate,No typed per-scenario allocation of review modes and measured response budget.,"Link retrospective, alert-triggered and continuous measures to each scenario.",Show that the combined operational loop fits the available time under specified load.,P0,partial foundation; extension proposed
HO-5-2-4,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.2.4,"[14, 15]",shall,When real-time human intervention is infeasible,Authority gates and guarded execution; preview resource holds,An approval button cannot protect a subsecond external effect after it starts.,Specify tested automated protection plus retrospective review; never substitute nominal oversight.,Fast-action fixture holds or applies a validated protective path; human-only configuration fails.,P0,partial foundation; extension proposed
HO-5-2-5,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.2.5,[15],shall,Overload and conflicts across simultaneous scenarios,AI-literacy and human-review controls; swarm exposure bounds,Exposure reservation is not reviewer-capacity reservation.,"Measure reviewer queues, concurrent alerts, fatigue and conflicting duties; define backup coverage.","Representative-user testing at peak joint load, including correlated alert bursts.",P0,partial foundation; extension proposed
HO-5-2-6,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.2.6,[15],shall,Review assignments after changes or monitoring findings,ctrl-change-gate; assurance signals; immutable version records,Fitness invalidation does not yet reopen typed oversight qualifications.,"Invalidate scenario qualification on model, tool, UI, staffing, workload or deployment change.",Version change prevents reuse of the old assessment until accountable requalification.,P0,partial foundation; extension proposed
HO-5-3-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.1,[15],shall,Combine oversight categories per scenario,PALO lifecycle tailoring,A single human-in/on/out-loop label loses scenario-specific adequacy.,Allow several modes per scenario and document why their combination is sufficient.,Two scenarios on one agent can require different modes without ambiguity.,P1,partial foundation; extension proposed
HO-5-3-2-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.2.1,"[15, 16]",shall,Retrospective review interface and context,"Receipts, attestations, trace records; system cards",Technical event logs alone do not demonstrate a usable review interface.,"Associate input references, output, model/version, available scores, alarms and human annotations.",Reconstruct a selected trajectory through authorized evidence access; missing data remains visible.,P1,partial foundation; extension proposed
HO-5-3-2-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.2.2,[16],shall,"Retention, navigation and corrective-action trace","Lineage, privacy, retention and incident contracts",Retention periods and filters are not qualified against harm discovery and review tasks.,"Define privacy-minimized review retention, scenario filters and annotation-to-remedy links.",Retrieve a historical case within the justified retention window and verify access restrictions.,P1,partial foundation; extension proposed
HO-5-3-2-3-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.2.3.1,"[16, 17]",shall,Verify review effectiveness and fallback,Generic assurance record and adversarial test controls,No reviewed user-study evidence in this assessment establishes oversight effectiveness.,Specify acceptance criteria and degraded-interface/logging fallback.,Representative reviewers detect hazardous cases; outage drill retains required review capability.,P0,partial foundation; extension proposed
HO-5-3-2-3-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.2.3.2,[17],can,Possible retrospective metrics,KPI/KRI registry,"Completion rate misses false negatives, inconsistency and fatigue.","Add review accuracy, missed-harm rate, time distribution, agreement and workload measurements.","Publish denominators, scenario mix and uncertainty; do not label suggested metrics mandatory.",P1,partial foundation; extension proposed
HO-5-3-3-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.3.1,[17],shall,Design risk-calibrated notifications,Runtime telemetry; incident records,An emitted event does not prove it reached an available human in time.,"Specify routing, triggering, acknowledgement and escalation contracts.","Measure end-to-end delivery and mitigation time, including unavailable reviewers.",P0,partial foundation; extension proposed
HO-5-3-3-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.3.2,[18],shall,"Perceivable, interpretable and validated alerts",Accessibility and explanation-comprehension packs,Dashboard visibility alone does not validate alert discrimination or prioritisation.,"Test modality, urgency, accessibility and advance warning in the intended environment.",Inject noisy concurrent alerts and verify correct priority and timely action.,P1,partial foundation; extension proposed
HO-5-3-4-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.4.1,[18],shall,Continuous access to operational and intervention status,Operational snapshot; execution and cancellation status,Distributed stop availability and freshness need a reviewer-facing contract.,"Show current actions, stale observations, alerts and available controls separately.",Partitioned worker displays unknown status and cannot be reported safely stopped.,P0,partial foundation; extension proposed
HO-5-3-4-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.4.2,[18],shall plus informative guidance,HMI supports judgment and protects against accidental mitigation,System-card explanation and accessibility controls,No specific oversight HMI study or accidental-trigger evidence reviewed.,"Use explicit action context, uncertainty and guarded critical controls.",Usability trials cover accidental activation and reversible confirmation design.,P1,partial foundation; extension proposed
HO-5-3-4-3,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.4.3,[19],shall,Functions support capability and limitation understanding,"Knowledge Reader, system cards, evidence references",A grounded answer does not demonstrate a reviewer can operate the control.,"Separate explanation, current-state evidence and actual intervention affordances.","Reviewer identifies stale data, unavailable actions and policy limitations.",P1,partial foundation; extension proposed
HO-5-3-4-4,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.4.4,[19],shall,Verify task completion within the scenario timeframe,Control tests and generic governance-assurance measurements,Runtime tests do not establish human task performance.,"Bind the oversight qualification to system/UI version, user population and load envelope.",Predefined task-success and timing criteria must be met before claiming effective oversight.,P0,partial foundation; extension proposed
HO-5-3-4-5,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.3.4.5,[19],should/can,Representative usability studies and metrics,AI-literacy competence and comprehension indicators,Suggested generic percentages are not evidence-based safety thresholds.,"Pre-register task success, initiation time, misinterpretation and workload criteria.",Compare distributions and failure cases; qualify thresholds as case-specific.,P1,partial foundation; extension proposed
HO-5-4-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.4.1,[20],shall,Provider-deployer implementation and verification contract,"Integration guide, enterprise adapters and case owners","An API contract does not allocate staffing, competence and residual-risk acceptance.","Create a provider/deployer responsibility matrix with technical, procedural and staffing prerequisites.",Deployer signs measured readiness evidence for each transferred measure.,P0,partial foundation; extension proposed
HO-5-4-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.4.2,[21],shall,Residual risks and conditions of use,System-card limitations; assurance findings,A residual-risk note needs to constrain operation when a prerequisite is absent.,"Link missing staffing, unavailable monitoring or unqualified connectors to operating restrictions.",Run configuration without required coverage; gate remains held.,P1,partial foundation; extension proposed
HO-5-4-3,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.4.3,[21],shall when applicable,Deployer notification implementation specification,HTTPS/MCP schemas and event telemetry,"Notification thresholds, payload, modalities and delivery expectations are not a complete qualified specification.",Publish an integrator contract sufficient to implement and test alerts.,Independent implementer builds the alert path from the specification without hidden assumptions.,P1,partial foundation; extension proposed
HO-5-5-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.5.1,[21],shall,Design against passive acceptance and over-reliance,ctrl-human-review; explanation and AI-literacy packs,"Exact approval proves binding, not independent critical judgment.","Require active review, counter-evidence access and explicit uncertainty; keep automation-bias risk visible.",Reviewer can reject an incorrect but confidently worded recommendation without workflow penalty.,P0,partial foundation; extension proposed
HO-5-5-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.5.2,"[21, 22]",can; scenario recommendation uses should,Automation-bias testing,Generic adversarial/user-evaluation framework,No controlled evaluation of wrong-answer acceptance is available.,"Design counterbalanced trials with intentionally flawed outputs, workload variation and mitigation variants.","Report erroneous acceptance, corrective action and decision quality, with sample and task limitations.",P1,partial foundation; extension proposed
HO-5-6-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.6.1,[22],shall,"Interpretation of capability, scores and unreliability",System-card performance and limitations; source-based copilot,Citation presence and model confidence are not calibrated correctness probabilities.,"Explain measurement meaning, calibration population, unavailable evidence and failure conditions.","Test whether reviewers distinguish source provenance, confidence, data quality and observed effect.",P1,partial foundation; extension proposed
HO-5-6-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.6.2,[22],should,Training relevant to oversight tasks and learning feedback,AI-literacy pack; role-based competencies,Training may omit whether human corrections enter future learning or agent memory.,Document correction scope and prevent unreviewed feedback-to-training loops.,Reviewer correctly predicts whether an edit changes only the case or future behaviour.,P1,partial foundation; extension proposed
HO-5-7-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.7.1,"[22, 23]",shall,"At least one intervention function, plus a stop procedure","Approval denial, capability revocation, incidents",These controls do not prove every deployed system can reach an appropriate safe state.,"Declare supported intervention semantics, measured latency and abstention events.","Separate initiated, acknowledged, effected and verified states; require stop capability.",P0,partial foundation; extension proposed
HO-5-7-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.7.2,[23],shall for disregard,Reject output before execution without re-execution,Exact-claim denial and one-time capability,Workflow retries or alternative credentials can defeat a local rejection.,Bind the rejected action and invalidate dependent retries; acknowledge the human event.,Rejected output never executes through any in-scope route.,P0,partial foundation; extension proposed
HO-5-7-3,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.7.3,[23],shall for override,Block original action and integrate human alternative,New Action Claim can bind changed arguments,A replacement flow is not yet a complete typed override record.,Link original and replacement claims and revalidate the alternative under current policy.,Original path halts; changed action cannot inherit the old exact approval.,P1,partial foundation; extension proposed
HO-5-7-4,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.7.4,[23],shall for reverse,Reversal including dependent processes and infeasible cases,Effect Contracts; compensation explicitly requires a new Action Claim,Automatic rollback is deliberately absent; compensation does not undo every external harm.,"Specify reversibility boundaries, dependency propagation and safe-state fallback.",Undo or compensate a synthetic action; verify downstream effects; retain irreversibility as a finding.,P0,partial foundation; extension proposed
HO-5-7-5,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.7.5,"[23, 24]",shall subject to scenario/design conditions,Safe state and recovery qualification,"Preview hold, revocation and cancellation mechanisms",Revocation/worker acknowledgement is not a system-wide safe-state proof.,"Define active functions, independent trigger, transition budget and recovery authority for each scenario.","Test delayed/unreachable workers, harmful abrupt halt and forbidden automatic restart.",P0,partial foundation; extension proposed
HO-5-8-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.1,"[24, 25]",shall within RBI profile,Prevent action before required natural-person review,Approval binding and controlled-executor concepts,Single-resolver approval is not the draft RBI review barrier.,Separate optional RBI profile with reviewed legal applicability and two-person barrier.,Unreviewed identification cannot cause an in-scope downstream action or transmission.,P1,partial foundation; extension proposed
HO-5-8-2-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.2.1,[25],shall within RBI profile,Authenticated review state machine,Approval statuses and actor identity,Generic approval statuses do not establish two distinct completed reviews.,"Use review-required, review-complete and rejected with natural-person review records.",Duplicate identity or rejected result cannot complete the gate.,P1,partial foundation; extension proposed
HO-5-8-2-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.2.2,[25],shall within RBI profile,Evidence required by each reviewer,System-card and artifact-reference patterns,PALO has no qualified biometric review UI.,"Specify protected access to probe/reference material, quality indicators and context.",Each authorized reviewer can inspect the relevant evidence without disclosure beyond scope.,P1,partial foundation; extension proposed
HO-5-8-2-3,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.2.3,[25],shall within RBI profile,Biometric inspection and low-quality alerts,Accessibility and explanation principles,Image inspection and alert functionality are not implemented by generic PALO evidence forms.,Keep this as a sector adapter acceptance profile.,Test usable visual comparison and quality alerts with representative operators.,P1,partial foundation; extension proposed
HO-5-8-2-4,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.2.4,"[25, 26]",shall within RBI profile,"Explicit decisions, notes and timestamps",Approval rationale and event timestamps,Passive acknowledgement must not count as substantive review.,Record separate active decisions and disagreement handling.,"No timeout, default choice or page visit completes a review.",P1,partial foundation; extension proposed
HO-5-8-3,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.3,[26],shall within RBI profile,Distinct identities and sequential-review independence,Authentication/tenant binding; independent-remedy concept,Two agents or two clicks by one person are not two natural persons.,Keep reviewer decisions sealed until independent sequential submission.,"Same identity, shared credentials or premature visibility fails the qualification.",P1,partial foundation; extension proposed
HO-5-8-4,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.4,[26],shall within RBI profile,"Review architecture, independence tests and configuration documentation",Governance-assurance evidence contract,A schema-valid record is insufficient evidence of enforced independence.,Attach architecture and negative integration tests for each review configuration.,Attempt duplicate review and downstream bypass through actual adapters.,P1,partial foundation; extension proposed
HO-5-8-5,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",5.8.5,"[26, 27]",shall plus recommended competence detail,Reviewer competence and training,AI-literacy effectiveness controls,Generic attendance records do not establish biometric review competence.,Use system-specific competence and training evidence in the separate RBI profile.,Representative review tasks demonstrate the declared competence.,P1,partial foundation; extension proposed
HO-6-1,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",6.1,[27],shall,Oversight content in instructions for use,System cards and integration guides,Provider/deployer requirements are distributed across artifacts.,Generate a versioned deployer handover dossier from approved scenario records.,Completeness checks link every applicable instruction to evidence and responsible roles.,P1,partial foundation; extension proposed
HO-6-2,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",6.2,[27],shall,Technical documentation for verification and limitations,Evidence bundle and governance-assurance record,"No dedicated collection of timing, overload, fallback and intervention qualification evidence.",Compose existing evidence records with the proposed oversight scenario profile.,A reviewer can reproduce results and trace failed criteria to open corrective actions.,P0,partial foundation; extension proposed
HO-ZA,"prEN 18229-3:2026, July 2026 user-supplied enquiry draft",ZA,[28],informative,Draft mapping to Article 14 and conditional future presumption,Source-status and legal-applicability controls,An enquiry draft must not be labelled an adopted harmonised standard or certification.,"Track draft status, published edition and any applicable Official Journal reference separately.",No presumption-of-conformity claim is emitted from a draft crosswalk.,P0,partial foundation; extension proposed