Article 86(1) of the EU AI Act gives an affected person the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken. The provision sits in Chapter IX, and Article 113 as consolidated lists no postponement for that chapter, while the Chapter III obligations for Annex III systems apply from 2 December 2027. Article 86 therefore follows the general application date of 2 August 2026, and the 2027 in this guide’s title refers to 2 December 2027, when the Annex III requirements that generate the supporting evidence begin to apply. A deployer asked for an explanation works within that split timetable.
Which Decisions Trigger the Article 86 Explanation Right
The scope test in the text
The operative wording of Article 86 sets four conditions that must all be present. The decision must be taken by the deployer. It must be taken on the basis of the output of a high-risk AI system listed in Annex III. The system must not be one listed under point 2 of that annex. And the decision must produce legal effects or similarly significantly affect the person in a way that the person considers to have an adverse impact on health, safety or fundamental rights.
The effect threshold is drafted from the perspective of the affected person (“that they consider to have an adverse impact”), not from an objective assessment by the deployer. A deployer that screens requests by its own view of whether the impact was adverse is applying a narrower test than the text states.
Annex III covers biometrics, education and vocational training, employment and workers’ management, access to essential private and public services and benefits, law enforcement, migration, asylum and border control, and the administration of justice and democratic processes. Within the essential-services area sit the evaluation of eligibility for public assistance benefits, creditworthiness and credit scoring (excluding fraud detection), risk assessment and pricing for life and health insurance, and the classification and dispatch of emergency calls. Point 2, covering safety components in critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity, is carved out of Article 86 by its own wording.
Operative text and Recital 171 do not use the same words
Article 86(1) refers to a decision taken “on the basis of the output” of the system. Recital 171 speaks of a decision “based mainly upon the output”. Recitals are not binding, and the Regulation’s text does not state a “mainly” threshold, so a deployer that treats the recital wording as the legal test risks excluding decisions in which the output was one significant input among several. Whether the two formulations produce different results has not been settled in the sources reviewed for this article.
The text also differs from the GDPR formulation. Recital 71 of the GDPR describes decisions “based solely on automated processing”, and that recital lists an explanation of the decision reached among the safeguards. Article 86 contains no “solely” qualifier. Decisions in which a human reviews the output are not excluded by the wording of Article 86(1).
Classification questions upstream of the right
Whether a system counts as an Annex III system depends on Article 6. Article 6(3) removes from high-risk status an Annex III system that does not pose a significant risk of harm, where one of four conditions applies: a narrow procedural task, improvement of the result of a previously completed human activity, detection of decision-making patterns without replacing or influencing a completed human assessment, or a preparatory task. A system that performs profiling of natural persons stays high-risk regardless of those conditions. Under Article 6(4), a provider that regards an Annex III system as not high-risk documents that assessment before placing the system on the market and registers it under Article 49(2).
A deployer that declines an Article 86 request on the ground that the system is not high-risk is relying on the provider’s documented assessment. The Commission published draft guidelines on the classification of high-risk AI systems on 19 May 2026, with examples of systems that are and are not high-risk. They remain drafts, so they inform the classification analysis without settling it.
The Date Structure Around Article 86
The Digital Omnibus on AI, Regulation (EU) 2026/1744, adopted on 8 July 2026 and in force from 27 July 2026, amended Article 113. The consolidated text applies the Regulation from 2 August 2026 and then lists exceptions. Chapter III, Sections 1 to 3, now applies from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for Annex I systems. Chapter IX does not appear among the exceptions.
| Provision | Location in the Regulation | Application under Article 113 as consolidated |
|---|---|---|
| Articles 85 and 86 (complaint right; explanation right) | Chapter IX, Section 4 | General rule of 2 August 2026; Chapter IX is not listed among the exceptions |
| Article 99 (penalties) | Chapter XII | 2 August 2025, with Article 101 excepted |
| Article 13 (information from providers to deployers) | Chapter III, Section 2 | 2 December 2027 for Annex III systems |
| Article 26 (deployer obligations, including logs and notice to natural persons) | Chapter III, Section 3 | 2 December 2027 for Annex III systems |
Sources: Article 113, Article 13, Article 26 and Article 99, consolidated text as at 27 July 2026.
Article 111(2) adds a further layer. It provides that the Regulation applies to operators of high-risk systems placed on the market or put into service before the Chapter III application date only if those systems undergo significant design changes from that date. Providers and deployers of high-risk systems intended for use by public authorities must take the necessary steps to comply by 2 August 2030. The text is available at Article 111.
Analysis: Article 86 applies under the general date, yet its trigger depends on Annex III classification, whose Chapter III obligations apply later, and Article 111(2) is worded broadly enough (“this Regulation shall apply”) to raise the question whether legacy systems fall outside Article 86 until significantly changed. The text does not answer that question, and no Commission or AI Office guidance addressing it was located in the sources reviewed for this article. Sources that give 2 December 2027 as the date for Article 86 itself do not match the consolidated Article 113 text. Compliance planning that depends on the answer should treat the interaction as unsettled.
Where Article 86 Yields: Paragraphs 2 and 3, the GDPR and the Dun & Bradstreet Ruling
Two paragraphs limit the right. Article 86(2) disapplies paragraph 1 for uses of AI systems where Union or national law, in compliance with Union law, provides exceptions or restrictions. Article 86(3) makes the article apply only to the extent that the right is not otherwise provided for under Union law. Article 86 itself contains no trade-secret clause, so any withholding on that ground has to rest on an exception or restriction that exists elsewhere in Union or national law.
For content, the nearest binding benchmark is GDPR case law. In Case C-203/22, Dun & Bradstreet Austria, decided on 27 February 2025, the Court of Justice held that a controller must describe the procedure and principles actually applied so that the data subject can understand which personal data were used and how. According to the Court’s press release, informing the person how a variation in the data would have changed the result may be appropriate, while handing over the algorithm does not amount to a sufficiently concise and intelligible explanation. Where the controller regards the information as containing third-party data or trade secrets, it must provide that information to the competent supervisory authority or court, which balances the interests. A national provision that excludes access as a rule whenever a trade secret is involved is precluded.
The ruling interprets the GDPR, not Article 86, and it predates the application of Article 86. Whether Article 86(3) displaces the AI Act right where GDPR access rights already apply is not answered by the Regulation’s text or by the judgment. Guidance prepared for the Austrian Federal Ministry of Labour, Social Affairs, Health, Care and Consumer Protection by the Research Institute – Digital Human Rights Center in 2025, before the Omnibus amendments, advises deployers to assume parallel applicability and to answer both rights in one response where doubt exists. That advice is non-binding guidance. The full text is published as the Enlightenment 4.0 business manual.
The guidance also notes a difference in reach. The GDPR concerns personal data of natural persons, and Recital 14 excludes data concerning legal persons, whereas Article 86(1) speaks of “any affected person” and Article 26(11) speaks of “natural persons”. The manual reads Article 86 as capable of covering legal entities. That reading is guidance, and the text of Article 86 does not state it expressly.
Building the Response File for an Explanation Request
The text of Article 86 sets two content elements and no procedure. The steps below use the Regulation’s own provisions to source each element, and mark where non-binding guidance fills silence.
- Intake and trigger test. Record the request, the decision concerned, the system used and the reasoning against the four scope conditions, including a negative outcome. Ownership of this step depends on how responsibilities are distributed in the organisation, a question covered in the analysis of centralized, federated and hybrid AI governance operating models.
- Evidence assembly. Collect the decision file, the system output, the logs, the record of human oversight and the provider’s instructions for use (see the table below).
- Drafting against the two elements. Address the role of the AI system in the decision-making procedure, then the main elements of the decision taken. A statement that an AI system was used does not describe a role.
- Trade-secret and third-party data handling. Apply Article 86(2) and the Dun & Bradstreet balancing approach as the nearest benchmark, without refusing the explanation wholesale.
- Timing and form. Article 86 sets no response period or format. For GDPR requests, Article 12(3) GDPR requires a response without undue delay and in any event within one month of receipt, and Recital 59 is to the same effect. The Austrian guidance recommends that period by analogy, along with free-of-charge handling. Treat it as a reference point, not an AI Act deadline.
- Record of the response. Retain the request, the trigger analysis and the explanation sent, including negative responses that explain why Article 86 did not apply.
| Explanation element | Internal source | Provision relied on |
|---|---|---|
| Role of the AI system in the procedure | Decision-workflow documentation showing where the output enters the decision; provider instructions for use | Article 86(1); Article 13(3)(b)(iv) and (vii) |
| Degree of human involvement | Record of the person assigned human oversight and any departure from the output | Article 26(2); Article 13(3)(d) |
| Input data behind the decision | Decision file; input data under the deployer’s control | Article 26(4) |
| System output and its use | Logs under the deployer’s control, kept for a period appropriate to the intended purpose and at least six months unless other Union or national law provides otherwise | Article 26(6) |
| Main elements of the decision taken | Decision notice and reasons | Article 86(1); Austrian guidance on criteria, weighting and impact (non-binding) |
The Austrian manual proposes a content list for the response: the contribution of the system and a low, medium or high rating of its significance for the decision, the input data and influencing criteria, any preliminary decisions, the weighting of criteria, a description of the processing logic without algorithmic code, the impact on the person, and the human review. It also recommends informing the person of the complaint right under Article 85. These are recommendations from guidance and are not requirements of the Regulation.
The Enforcement Route Around Article 86
Article 85 allows any natural or legal person with grounds to consider that the Regulation has been infringed to submit a complaint to the relevant market surveillance authority, and such complaints are taken into account in market surveillance activities and handled under Regulation (EU) 2019/1020. The route exists independently of any response the deployer gives.
The penalty structure is less direct. Article 99(1) requires Member States to lay down rules on penalties applicable to any infringement of the Regulation by operators. The fine tier of up to EUR 15,000,000 or 3% of total worldwide annual turnover in Article 99(4) lists provider obligations under Article 16, deployer obligations under Article 26 and transparency obligations under Article 50, among others. Article 86 is not on that list. The Austrian guidance reaches the same reading, stating that Article 86 breaches carry no direct sanction in the Regulation while Article 26 and Article 50 breaches do. Paragraphs 6 and 6a of Article 99 apply the lower-of rule for SMEs and small mid-caps. National penalty rules for Article 86 infringements are a matter for each Member State.
Article 26(11) is the adjacent duty. Deployers of Annex III systems that make or assist in making decisions related to natural persons must inform those persons that they are subject to the use of the system, and that duty falls within the Article 99(4) tier through Article 26. It applies from 2 December 2027 for Annex III systems. The Austrian guidance argues that a broad reading of Article 26(11) extends the duty to informing persons of the right to explanation. That reading is an interpretive argument and is not in the wording of the provision.
The same guidance adds that Article 110 incorporates the AI Act into the annex of the Representative Actions Directive, which would allow qualified entities to bring legal action for infringements of the Regulation.
The Provider Information Chain Behind a Deployer Explanation
Article 86 names the deployer alone, yet much of the material for an explanation sits with the provider. Article 13 requires high-risk systems to be designed so that deployers can interpret the output and use it appropriately, and it requires instructions for use that include, where applicable, the technical capabilities and characteristics of the system for providing information relevant to explaining its output, information enabling deployers to interpret the output, and the human oversight measures including technical measures that facilitate interpretation of outputs.
Those provider obligations apply to Annex III systems from 2 December 2027, while Article 86 follows the general application date. Analysis: a deployer using an Annex III system before that date may receive an explanation request without the Article 13 documentation that the Regulation will later require providers to supply. Contractual requests for explainability information, framed around the Article 13(3) headings, are one way to close that difference before the Chapter III date, and they are a governance practice, not a legal duty.
The same sequencing affects the Article 6(4) documentation. A provider that classifies an Annex III system as not high-risk must document the assessment, and a deployer relying on that classification to decline an Article 86 request holds no independent record of the reasoning unless it obtains one.
How the Deployer Accountability Burden Is Sequenced Between 2026 and 2027
The Regulation front-loads the individual right and back-loads the infrastructure that supports it. Article 86 and the Article 85 complaint route follow the general application date, and the duties on providers and deployers that generate the evidence, namely Articles 13 and 26, follow on 2 December 2027 for Annex III systems. For deployers, the planning priorities that follow from this sequencing are:
- a named owner and an intake channel for explanation requests, with a documented trigger test;
- a register of Annex III systems in use and the decision points at which their output enters a decision affecting a person;
- retention of decision files and logs aligned with the Article 26(6) minimum, extended where the explanation obligation requires longer reconstruction;
- a request route to providers framed around Article 13(3), including the provider’s Article 6(4) documentation where a non-high-risk position is relied on;
- response templates covering a full explanation and a reasoned negative response, with a defined internal period if the organisation adopts the GDPR one-month reference.
Several regulatory milestones remain open. The Commission’s draft classification guidelines were published on 19 May 2026 and are not final. The Commission’s report of 22 May 2026 on the review of Annex III under Article 112(1) states that the results of the targeted consultation on the draft guidelines will inform the following year’s review, and its page is available as the report on the review of prohibitions and high-risk AI. The Chapter III obligations for Annex III systems apply from 2 December 2027, and the compliance date for high-risk systems intended for public authorities under Article 111(2) is 2 August 2030. Whether Article 86 reaches legacy systems before they are significantly changed is the question on which guidance would change planning most.
Covering responsible AI, governance frameworks, policy, ethics, and global regulations shaping the future of artificial intelligence.