Route to a person and opt-out
Customers can reach a person and decline the AI path.
Layer L3 Application · Owner Deployer · Family Human oversight
By risk
| Risk | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control |
|---|---|---|---|
| Credential and privilege abuse | 1 | 13 | |
| Privacy harm to a person | 1 | 1 | |
| Consumer detriment and unsuitable advice |
Why it was not effective
| Most common reason it was not effective | Number of incidents | Example incident |
|---|---|---|
| Reason not given | 2 | “Users who have had their accounts stolen say that there is no way to escalate their problem to a human.” LR-2026-0534, LR-2026-0560 |
Incidents where it was not effective or did not exist per month
2 so far in 2026; 0 in the same span of 2025.
19 of 183 incidents in Oct 2026 have been read for controls.
Added in reported fixes, and what followed
No reported fix names this control yet.
Frameworks
| Standard | Clause | Requirement |
|---|---|---|
| GDPR | Art. 22(3) | To verify when the text is stored |