In short
- Article 86 of Regulation (EU) 2024/1689 gives an affected person the right to clear and meaningful explanations of the role of the AI system in the decision and of the main elements of the decision taken.
- The duty falls on the deployer, not on the provider of the model. The person asks the organisation that made the decision about them.
- The right covers decisions based on Annex III high-risk systems with 1 carve-out: systems listed under point 2, critical infrastructure, are excluded.
- Article 86(3) makes the right residual. It applies only to the extent an equivalent right is not already provided under other Union law, which is where Article 22 GDPR does the work.
- The right sits in Chapter IX and applies from 2 August 2026, ahead of the Annex III obligations deferred to 2 December 2027.
Most obligations in the EU AI Act are owed to a regulator. Article 86 is owed to a person, and it is the provision most likely to arrive without warning.
An affected person can ask the deployer why a decision went the way it did, and the answer has to describe the system’s role in the procedure and the main elements of the decision. There is no form, no fee and no threshold of sophistication on the asker.
01Who is the duty owed by?
The deployer, which is rarely the organisation that built the system.
Article 86 addresses the deployer: the body using the system under its own authority. A bank running a purchased scoring model answers for the decision it took. The vendor that supplied the model is not the addressee of the request, whatever the contract says about support.
This is the practical reason the line between deployer and provider has to be settled before launch and not after a complaint. An organisation that cannot describe the system’s role in its own decision has bought a product it cannot lawfully operate at the moment someone asks.
02Which decisions are actually in scope?
Four elements, all of which have to be present.
| Element | Requirement | Where it bites |
|---|---|---|
| System | High risk, listed in Annex III | Point 2 excluded |
| Decision | Taken by the deployer on the basis of the output | Output need not be the only input |
| Effect | Legal effects or similarly significant effect | Refusals, pricing, access |
| Perspective | Adverse to health, safety or fundamental rights | As the person considers it |
The fourth row is the one that surprises teams. The adverse character of the impact is framed from the affected person’s standpoint, so the deployer cannot screen requests by deciding in advance that the outcome was not really adverse.
The second row matters almost as much. A decision taken on the basis of an output is in scope even where a human made the final call, which is why an oversight design that leaves no trace of what the human actually did makes this right impossible to satisfy honestly, a problem examined in what Article 14 asks of human oversight.
03How does it relate to the GDPR?
Article 86 fills gaps rather than duplicating cover.
| Question | Article 22 GDPR | Article 86 AI Act |
|---|---|---|
| Trigger | Decision based solely on automated processing | Decision on the basis of a high-risk output |
| Human in the loop | Takes the decision outside the rule | Does not take it outside the rule |
| Personal data required | Yes | Not stated as a condition |
| Addressee | Controller | Deployer |
| Applies from | 25 May 2018 | 2 Aug 2026 |
The second row is the whole point of the provision. Article 22 of the GDPR has long been narrowed in practice by inserting a human reviewer, and Article 86 does not offer that exit. A decision informed by a high-risk system remains within its scope even when a person signed it.
Article 86(3) then prevents double cover: the AI Act right applies only to the extent the equivalent is not already provided under Union law. In a case squarely inside Article 22 of the GDPR, the data protection regime governs.
04What should a deployer have ready?
A record written at decision time, and a named owner for the request.
The explanation has to state the system’s role in the procedure and the main elements of the decision. Both are cheap to produce if the decision record captured which system ran, which version, which inputs were decisive and what the human reviewer changed. Both are expensive to reconstruct later, and a reconstruction is what a regulator or a court will examine.
The date is the reason to do this now rather than in 2027. The right applies from 2 August 2026 under Article 113, while the Annex III obligations were deferred to 2 December 2027, so the period where requests can arrive and the supporting duties have not yet bitten is open already, and nothing in the deferral of the high-risk dates closes it.
05Frequently asked questions
Who has to answer a request for an explanation under the AI Act?
The deployer. Article 86 gives the affected person a right to obtain explanations from the deployer, meaning the organisation that used the system under its own authority to take the decision, not the provider that built or supplied the system.
Which decisions does Article 86 cover?
Decisions taken on the basis of output from a high-risk system listed in Annex III, other than systems under point 2, that produce legal effects or similarly significantly affect the person in a way they consider adverse to their health, safety or fundamental rights.
What has to be in the explanation?
Two things: the role the AI system played in the decision-making procedure, and the main elements of the decision taken. The text requires the explanation to be clear and meaningful, which rules out a generic statement that a model was involved.
How does this interact with the GDPR?
Article 86(3) applies the right only to the extent it is not otherwise provided for under Union law. Where Article 22 of the GDPR already gives the individual rights over a solely automated decision, that regime governs and Article 86 fills the space it leaves.
06References and method
- Regulation (EU) 2024/1689, Article 86, for the right, the deployer as addressee, the exclusion of Annex III point 2 and the residual clause in Article 86(3).
- Article 86 of Regulation (EU) 2024/1689 in the consolidated presentation, checked on 17 September 2026 for the wording of the exclusions and for the application date of 2 August 2026 under Article 113.
- Regulation (EU) 2016/679, Article 22, for the rights attaching to decisions based solely on automated processing, which Article 86(3) defers to.
- Regulation (EU) 2026/1744, checked on 17 September 2026 for whether the deferral of high-risk obligations to 2 December 2027 reaches Article 86. It amends the high-risk limb of Article 113 and leaves the Chapter IX date unchanged.