AI threat catalogue Reliability and Responsible Use Production
Overreliance
People tend to accept convincing-sounding AI outputs without checking them (automation bias). When employees or downstream systems rely uncritically on AI for important decisions, errors go undetected and cause real-world harm.
Description
AI systems phrase their answers fluently and confidently even when the content is wrong. This is exactly what fuels automation bias: the human tendency to trust the results of an automated system more than one's own judgement. This threat does not come from attackers; it arises in everyday work, for example under time pressure or when knowledge about the limits of AI is missing. It becomes especially critical when AI outputs feed into follow-up decisions or other systems without human review: a single undetected error then propagates and compounds. A decline in model quality also stays invisible for as long as nobody questions the results.
Possible impact
Poor decisions based on unchecked AI outputs first hit the people affected, such as applicants, customers, or patients, and then fall back on the company. Financial losses, liability questions, and reputational damage follow. The EU AI Act requires effective human oversight for high-risk systems, and the GDPR places strict limits on fully automated individual decisions.
Example
An HR department has incoming applications pre-ranked by an AI system and adopts the ranking as it is. Only months later does it emerge that the system systematically screened out suitable candidates and that nobody had ever spot-checked its recommendations.
Recommended mitigations (5)
Compare effects and implementation levels. Expand each entry for the additional classification and rationale.
-
Clear confidence indicators in UI
Technical- Effect
- Preventive, Detective
- Implementation level
- Application, API & agents, Use & operations
Classification and rationale
Primarily technical: The application makes uncertainty, system boundaries, or safe next steps visible and supports informed decisions.
-
User training on AI limitations
People & competence- Effect
- Preventive
- Implementation level
- Organization, Use & operations
Classification and rationale
Complementary control typeOrganizational & process-based
Primarily a people-and-competence control: Human knowledge, attention, or professional judgment produces the protective decision; complemented by binding workflows.
-
Human verification for high-stakes decisions
Organizational & process-based- Effect
- Preventive, Detective
- Implementation level
- Organization, Use & operations
Classification and rationale
Complementary control typePeople & competence
Primarily organizational and process-based: A binding workflow requires an accountable human decision before use or execution; complemented by human expertise and judgment.
-
Output provenance and source attribution
Technical- Effect
- Preventive, Detective
- Implementation level
- Application, API & agents, Use & operations
Classification and rationale
Complementary control typeOrganizational & process-based
Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.
-
Explainability features
Technical- Effect
- Detective
- Implementation level
- Model & training, Application, API & agents, Use & operations
Classification and rationale
Primarily technical: The application makes uncertainty, system boundaries, or safe next steps visible and supports informed decisions.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (11)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM07:2026 MisinformationLLM07:2026 Misinformation, OWASP Top 10 for LLM Applications 2026 v1.0, pp. 43-45 (doi:10.5281/zenodo.22109015); canonical text 2026/final/LLM07_Misinformation.md at commit 7e144e05 OWASP FoundationOriginal
- NIST AI RMF Section 2.2 ConfabulationSection 2.2, p. 6 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF Section 2.7 Human-AI ConfigurationSection 2.7, p. 9 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF GOVERN 3.2 GOVERN 3.2GOVERN 3.2, p. 23 National Institute of Standards and Technology (NIST)Original
- EU AI Act Article 13(1), 13(3)(b)(ii), (iv), (v) Transparency and provision of information to deployersArticle 13(1), 13(3)(b)(ii), (iv), (v) European Union (EUR-Lex)Original
- EU AI Act Article 14(4)(b) Human oversightArticle 14(4)(b) European Union (EUR-Lex)Original
- EU AI Act Article 4 AI literacyArticle 4(1), as replaced by Article 1(5) of Regulation (EU) 2026/1744 European Union (EUR-Lex)Original
- BSI R8 Automation Bias (Text, Bild, Video)Kap. 4, R8, p. 17 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
- BIML BIML-LLM LLMtop10:9 Model TrustworthinessPDF p. 13, [LLMtop10:9:model trustworthiness] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML-LLM output:12 OverconfidencePDF p. 20, [output:12:overconfidence] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML78 system:2 OverconfidencePDF p. 25, [system:2:overconfidence] Berryville Institute of Machine Learning (BIML)Original
EU AI Act obligations related to this threat
The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.
-
Support the AI literacy of your staff
Art. 4 · applies from 2 February 2025 · amended by Reg. 2026/1744
Statutory roles: Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model. Classes: Prohibited practice, High-risk under Annex III, High-risk as a product or safety component, System subject to transparency obligations, General-purpose AI model, Model with systemic risk, Minimal risk.
Regulation (EU) 2026/1744 recast Art. 4. The duty to ensure AI literacy has become a duty to support its development. It is now expressly clarified that no one has to guarantee a particular level of competence for any individual. The obligation as such remains and has applied since 2 February 2025. The wording attaches to AI systems; a provider of a general-purpose AI model alone is covered in so far as they also provide or deploy systems.
This reference is a review prompt. A threat match alone does not establish applicability.
-
Provide instructions for use to deployers
Art. 13 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028
Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.
This reference is a review prompt. A threat match alone does not establish applicability.
-
Build in effective human oversight
Art. 14 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028
Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.
This reference is a review prompt. A threat match alone does not establish applicability.
All 62 obligations by role, risk class and deadline in the obligations compass
Related threats
More entries from the topic group Reliability and Responsible Use.
Matching use cases
This list shows where to review this threat, rather than how high the risk is.
Belongs on the checklist for every AI system. What to review for every AI system
Particularly important for:
- Generative AI assistant for staffDrafts sound confident and read smoothly. People who accept them under time pressure may stop checking content and sources.
- Speech recognition and transcriptionThe transcript reads smoothly and looks complete. Approval without checking the recording misses misheard figures, names and negatives.
- AI meeting minutes and conversation documentationThe draft is ready immediately and looks complete. Under time pressure, staff sign it off without checking it against their recollection.
- Intelligent document processing (IDP)Approving many extracted records every day can become a cursory task. Wrong amounts or allocations then go unnoticed.
- Automated anonymisation and redactionMost suggestions are correct, so approval becomes routine. Missed passages are then discovered only after publication.
- E-discovery and technology-assisted review (TAR)Review ends when the model expects few relevant documents to remain. If that estimate is wrong, important records remain unread and the gap goes unnoticed.
- Text analytics for feedback and consultation responsesThe theme overview looks complete and is ordered by frequency. Rare but serious indications, such as danger, may never be read in full.
- Customer service chatbots and voicebotsCustomers treat the bot's information as binding because it speaks for the company. Staff accept its summary of a request without reading the conversation.
- Credit scoring and creditworthiness assessmentA caseworker may reject a score just below the threshold without considering the person's situation. An estimate becomes a decision, even if the score is wrong.
- Money laundering detection and sanctions screeningWith many false alarms, specialists begin dismissing alerts hastily and treating unflagged accounts as normal. Incorrect model assessments then go unnoticed.
- Life and health insurance risk assessment and pricingUnderwriters may accept an unfavourable risk class without reviewing health information. The person then receives a surcharge or rejection based only on an estimate.
- AI-assisted insurance claims handlingStaff approving many settlement proposals daily may start waving them through. Inconsistencies missed by the system then escape human review too.
- AI-assisted candidate screeningRecruiters often look only at the top-ranked candidates. Those placed lower have little chance, even when the ranking is wrong.
- Algorithmic managementSupervisors use performance figures in discussions and appraisals without knowing how they were calculated. Traffic jams or long waits at restaurants then go unaccounted for.
- Online proctoringInvigilators focus on flagged passages and accept the suspicion. Disability, a child in the room or poor lighting can then unfairly cast suspicion on candidates.
- Automated assessment of exam performance (essay scoring)A second examiner who sees the automated score first may be influenced by it. Human assessment then ceases to check it independently.
- Remote biometric identification (facial recognition)The system returns the closest match even if the person sought is absent from the database. Investigators who rely on it can place an uninvolved person under suspicion, as the Detroit incidents show.
- Emotion recognitionFacial expressions do not reliably reveal feelings and differ across cultures and individuals. Trusting the output may label a tense traveller suspicious or a calm worker unmotivated.
- Risk-based review selection for applications and benefitsReviewers can assume something is wrong with a selected case. Selection for review becomes suspicion, as in the Dutch childcare benefits scandal.
- Automated property valuation (AVM)With thousands of properties, valuers often scrutinise only unusual estimates. An unremarkable but incorrect value enters the notice, leaving the owner to challenge it.
- Police data analysis platformsA graph connection looks like a finding even if based only on a shared address or witness statement. Accepting it unchecked can draw an uninvolved person into proceedings.
- AI assistance in high-volume court proceedingsWith many similar claims, simply accepting extracted features and drafts is tempting. If the system misses a distinguishing detail, the judgment does not fit the case.
- Language and dialect recognition in asylum proceduresA dialect probability looks like a measurement but says nothing about where someone grew up. Treating it as proof can make someone whose speech reflects several regions seem untrustworthy.
- Automatic number plate recognition (ANPR)Enforcement staff see many matches each day and may begin confirming them without close inspection. A misread digit then produces a notice against an uninvolved person.
- Intelligent video analytics in public spacesControl centre staff focus on scenes the system flags. Undetected events go unwatched, and harmless rough play may be treated as an attack.
- AI-assisted medical image analysisClinicians reviewing many AI-marked images may increasingly focus on marked regions. Unmarked findings are then more easily missed.
- Clinical decision support (such as early sepsis detection)A team relying on sepsis alerts may quickly consider an unflagged patient stable. Treatment then begins too late.
- AI support for emergency call handlingA dispatcher relying on cardiac arrest alerts may stop asking targeted questions when none appears. Telephone resuscitation instructions then begin too late.
- Predictive maintenanceMaintenance teams relying on predictions may extend fixed inspection intervals. Damage no sensor detects becomes apparent only at failure, disrupting operations and potentially endangering people at points or energy facilities.
- Visual and acoustic quality inspectionRelying on the camera to find every defect can lead to dropping manual sampling. Defect types the model has never seen remain undetected.
- Automated driving and driver assistanceDrivers become accustomed to the system handling the situation and turn their attention elsewhere. If it requests a takeover or fails unnoticed, too little time remains to intervene.
- Coding assistantSuggestions that fit smoothly and compile successfully are easily waved through without thorough review. Vulnerabilities such as missing input validation then enter the code.
- AI-based cyberattack detectionWhen the system reports nothing, a network is soon assumed to be clean and people stop hunting for attackers themselves. Attacks the model does not recognise as deviations remain undetected.
Frequently asked questions
- What is Overreliance?
- People tend to accept convincing-sounding AI outputs without checking them (automation bias). When employees or downstream systems rely uncritically on AI for important decisions, errors go undetected and cause real-world harm.
- Which mitigations help against Overreliance?
- The catalogue lists 5 mitigations, each with control type, effect and implementation level. First among them are Clear confidence indicators in UI, User training on AI limitations and Human verification for high-stakes decisions.
- Which EU AI Act obligations does Overreliance touch?
- The catalogue maps this threat to Art. 4, Art. 13 and Art. 14 of the EU AI Act. In the obligations compass this leads to: Support the AI literacy of your staff, Provide instructions for use to deployers and Build in effective human oversight. Whether an obligation applies depends on role, risk class and deadline.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Overreliance”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/overreliance/