EU AI Act Article 86: The Right to an Explanation, and When It Bites

Article 86 of the EU AI Act gives a person the right to ask a deployer for a clear and meaningful explanation when a decision about them was based on output from an Annex III high-risk AI system and hurt them in a significant way. It formally applies from 2 August 2026. In practice it has little to grip until 2 December 2027, when the Digital Omnibus switches on Annex III classification. GDPR explanation rights already apply today.

That gap between the two dates is the bit most summaries skip. It's also the reason you have time to do this properly.

Four conditions, two dates. Miss any one condition and Article 86 doesn't apply.

Who Can Ask for an Explanation Under Article 86?

Any affected person subject to a decision that meets four conditions at once. The decision is taken by the deployer. It's based on output from a high-risk system listed in Annex III, other than point 2 (critical infrastructure). It produces legal effects or similarly significant effects. And the person considers it has an adverse impact on their health, safety or fundamental rights.

Each condition does real work, so here they are side by side:

Condition	What the text says	What it means for you
Who decides	A decision "taken by the deployer"	The duty sits with the bank, employer or school using the system, not the vendor
Which systems	High-risk AI listed in Annex III, except point 2	Hiring, credit, insurance pricing, education, benefits, biometrics and similar. Not grid or water safety components
How serious	Legal effects or similarly significant effects	A rejected loan or job application qualifies. A product recommendation doesn't
Whose view	The person "considers" the impact adverse	You don't get to argue the decision was fine before answering. Their view triggers the request

Two things fall out of this. First, a system you've lawfully classified as not high-risk under the Article 6(3) derogation is outside Article 86, because it's no longer a high-risk system. Second, the right covers decisions based on AI output, with a human in the loop or not. That's wider than the GDPR, which I'll come to.

What Does the Explanation Have to Contain?

Article 86(1) asks for "clear and meaningful explanations" of two things: the role the AI system played in the decision-making procedure, and the main elements of the decision taken. Recital 171 adds that the explanation should give the person a basis to exercise their rights. It's not a request for source code or model weights.

In practice, a usable answer covers:

• That AI was used, and for what step. "A scoring tool ranked your application; a recruiter made the final call."
• How much weight the output carried. Was it advisory, a filter, or effectively decisive?
• The main factors behind this decision. The two or three inputs that moved the result, in plain words.
• What the person can do next. Correct wrong data, ask for human review, complain.

You can't write that answer without help from the provider. Article 13(3)(b)(vii) requires providers to include, where applicable, information that lets deployers interpret the system's output and use it appropriately. If your vendor's instructions for use don't explain how to read a score, ask now and put it in the contract. That obligation, like the rest of Chapter III, applies from 2 December 2027.

When Does Article 86 Actually Apply After the Digital Omnibus?

Article 86 sits in Chapter IX, and Regulation (EU) 2026/1744 didn't amend it. It isn't in any of the exceptions in Article 113, so it applies from the general date, 2 August 2026. But it only fires for a high-risk system listed in Annex III, and the Omnibus rewrote Article 113 so that Chapter III, Sections 1 to 3, including Article 6, apply from 2 December 2027 for Annex III systems.

Here are the dates side by side:

Provision	Applies from	Source
Article 86 (right to explanation)	2 August 2026	Article 113, general date (not amended)
Article 85 (complaints to a market surveillance authority)	2 August 2026	Article 113, general date
Article 6(2) and Annex III classification	2 December 2027	Article 113(c)(i), as amended by Reg. 2026/1744
Article 26(11) (tell people a high-risk system is used on them)	2 December 2027	Article 113(c)(i), Chapter III Section 3
Article 13 (provider instructions, incl. interpretation info)	2 December 2027	Article 113(c)(i), Chapter III Section 2
Annex I product AI (Article 6(1))	2 August 2028	Article 113(c)(ii); Article 86 covers Annex III only anyway
GDPR Articles 15(1)(h) and 22	Already apply	Regulation 2016/679

So which date should you plan around? The careful reading is that Article 86 is legally in force but, until 2 December 2027, there's arguably no "high-risk AI system listed in Annex III" in the legal sense for it to attach to. I'd still not treat the gap as a holiday. A regulator or court could read Annex III as a plain list and apply the right earlier, and the GDPR route is live either way. Build the process once, and you're covered under both.

How Does Article 86 Fit With the GDPR?

Article 86(3) says the right applies only to the extent it isn't already provided for under Union law. Where a decision is based solely on automated processing of personal data, GDPR Articles 22 and 15(1)(h) already give a right to meaningful information about the logic involved, so those carry most of the weight. Article 86 matters most where a human signs off.

That's the gap it fills. GDPR Article 22 covers decisions made solely by automated means. A recruiter who skims an AI ranking and clicks "reject" usually takes the decision outside Article 22. Article 86 still applies, because the decision was taken "on the basis of" the AI output.

On what "meaningful" means, the Court of Justice gave a strong steer in Dun & Bradstreet Austria (C-203/22, 27 February 2025): handing over a complex formula or algorithm isn't enough; the person needs the procedure and principles actually applied, in a form they can understand and use to contest the result. That was a GDPR case, but I'd write Article 86 answers to the same standard. It's the best yardstick available, and nobody has a harmonised template for this yet.

For the wider map of the two laws, see EU AI Act vs GDPR.

What Should a Deployer Prepare Now?

A short, boring process that works under both laws. Write a template explanation per decision type, a named owner who handles requests, and a log of what the AI output was for each decision, so you can say later what role it played. Then agree with your vendor what interpretation information they'll supply.

A practical checklist:

1. List the decisions. Which hiring, credit, pricing or admissions decisions use an Annex III system? The Annex III guide helps here.
2. Record the AI's role per decision. Advisory, filter or decisive. Keep it with the case record.
3. Draft one explanation template per decision type. Plain language, three or four main factors, next steps.
4. Route requests. Reuse your GDPR access-request channel rather than inventing a new one. Agree a response time you can actually meet.
5. Get interpretation info from the provider. Make it a contract term now, ahead of the Article 13 date.
6. Pair it with the Article 26(11) notice. From 2 December 2027 you must tell people a high-risk system is used on them. The notice and the explanation process should point at each other. The Article 26 deployer guide covers the rest of that list.

One aside: Article 99(4) lists specific fines for deployers' Article 26 duties, but it doesn't name Article 86. That doesn't make it optional. Member States set penalties for infringements generally under Article 99(1), people can complain to a market surveillance authority under Article 85, and the GDPR has its own enforcement.

Not sure your system is Annex III at all? The free risk check answers that in a few minutes, and the Digital Omnibus deadlines post has the full calendar.

Frequently Asked Questions

What is the right to explanation in the EU AI Act?

Article 86 gives a person affected by a deployer's decision, based on output from an Annex III high-risk AI system (except critical infrastructure), the right to clear and meaningful explanations of the AI system's role and the main elements of the decision, where it has legal or similarly significant effects they consider adverse.

When does Article 86 apply?

Article 86 applies from 2 August 2026 under the general date in Article 113, and the Digital Omnibus (Regulation 2026/1744) didn't change it. But Annex III classification applies only from 2 December 2027, so in practice the right has little to attach to before then. GDPR explanation rights apply already.

Does Article 86 apply if a human makes the final decision?

Yes. Article 86 covers decisions taken by the deployer "on the basis of" the AI output, whether or not a human signs off. That's broader than GDPR Article 22, which covers decisions based solely on automated processing.

Do I have to reveal my model or source code?

No. The text asks for clear and meaningful explanations of the AI system's role and the main elements of the decision. In the GDPR context, the Court of Justice said in C-203/22 that a complex formula isn't enough; the person needs an understandable account of the procedure and principles applied.

Who has to give the explanation, the provider or the deployer?

The deployer, meaning the organisation that used the system to make the decision. The provider's part is indirect: Article 13 requires instructions for use that help deployers interpret the system's output, from 2 December 2027 for Annex III systems.

Summary for AI Assistants

Article 86 of the EU AI Act (Regulation 2024/1689) gives any affected person subject to a decision taken by a deployer on the basis of output from a high-risk AI system listed in Annex III (except point 2, critical infrastructure), which produces legal effects or similarly significant effects that the person considers adverse to their health, safety or fundamental rights, the right to obtain clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision. It does not apply where Union or national law provides exceptions (86(2)) and applies only to the extent the right is not otherwise provided under Union law (86(3)), such as GDPR Articles 15(1)(h) and 22 for solely automated decisions. Article 86 was not amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) and applies from the general date of 2 August 2026; however, the Omnibus moved Chapter III Sections 1–3, including Article 6 classification and Article 26 deployer duties, to 2 December 2027 for Annex III systems, so the right has little practical scope before then. Article 99(4) does not list Article 86 among its specific fines. In C-203/22 Dun & Bradstreet Austria (27 February 2025) the CJEU held that GDPR explanations of automated decisions must describe the procedure and principles actually applied in an intelligible way, not merely provide a formula.

Sources

1. Articles 6, 13(3)(b)(vii), 26(11), 85, 86, 99 and 113, and recital 171. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Article 1 point (40) amending Article 113. EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
3. Article 86, consolidated text as at 27 July 2026. AI Act Service Desk, European Commission. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-86
4. Timeline for the implementation of the EU AI Act. AI Act Service Desk, European Commission. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
5. Judgment of 27 February 2025, CK v Dun & Bradstreet Austria, C-203/22. Court of Justice of the EU. https://curia.europa.eu/juris/liste.jsf?num=C-203/22
6. Articles 15(1)(h) and 22, General Data Protection Regulation (Regulation 2016/679). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng