Explanations and enforcement
Explanations and human intervention
The practical judgement
If AI helped produce a serious adverse decision about you, send parallel requests under the AI Act and the GDPR where personal data were involved. The GDPR route is established and has a normal response timetable. The present reach of the AI Act route may be contested.
Article 86 places the explanation duty on the organisation using the system, called the deployer. From 2 August 2026, an affected person may request a clear account of the system’s role and the main elements of an adverse legal or similarly significant decision based on a listed Annex III high-risk system. The relevant national market-surveillance authority, or the AI Office within its limited remit, enforces that deployer duty.1 A human may have made the final decision. The rule does not require a solely automated process.
The following figure shows the two requests and the different practical results they can produce.
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 590 490" width="590" height="490" font-family="system-ui, sans-serif" font-size="14">
<title>Parallel AI Act and GDPR explanation routes</title>
<rect x="175" y="10" width="240" height="46" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="295" y="39" text-anchor="middle" fill="currentColor" font-size="16">Decision involving software</text>
<line x1="295" y1="56" x2="145" y2="82" stroke="currentColor" stroke-width="2"/>
<polygon points="145,82 155,74 158,87" fill="currentColor"/>
<line x1="295" y1="56" x2="445" y2="82" stroke="currentColor" stroke-width="2"/>
<polygon points="445,82 432,87 435,74" fill="currentColor"/>
<rect x="20" y="84" width="250" height="82" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="145" y="108" text-anchor="middle" fill="currentColor">Adverse legal or similarly</text>
<text x="145" y="131" text-anchor="middle" fill="currentColor">significant decision based on a</text>
<text x="145" y="154" text-anchor="middle" fill="currentColor">qualifying Annex III system</text>
<rect x="320" y="84" width="250" height="82" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="445" y="108" text-anchor="middle" fill="currentColor">Relevant personal data or</text>
<text x="445" y="131" text-anchor="middle" fill="currentColor">qualifying automated</text>
<text x="445" y="154" text-anchor="middle" fill="currentColor">decision-making</text>
<line x1="145" y1="166" x2="145" y2="192" stroke="currentColor" stroke-width="2"/>
<polygon points="145,192 138,180 152,180" fill="currentColor"/>
<line x1="445" y1="166" x2="445" y2="192" stroke="currentColor" stroke-width="2"/>
<polygon points="445,192 438,180 452,180" fill="currentColor"/>
<rect x="20" y="194" width="250" height="64" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="145" y="220" text-anchor="middle" fill="currentColor">AI Act Article 86 request</text>
<text x="145" y="244" text-anchor="middle" fill="currentColor">sent to the deployer</text>
<rect x="320" y="194" width="250" height="64" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="445" y="220" text-anchor="middle" fill="currentColor">GDPR Articles 15 and 22</text>
<text x="445" y="244" text-anchor="middle" fill="currentColor">sent to the data controller</text>
<line x1="145" y1="258" x2="145" y2="280" stroke="currentColor" stroke-width="2"/>
<polygon points="145,280 138,268 152,268" fill="currentColor"/>
<line x1="445" y1="258" x2="445" y2="280" stroke="currentColor" stroke-width="2"/>
<polygon points="445,280 438,268 452,268" fill="currentColor"/>
<rect x="20" y="282" width="250" height="96" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="145" y="308" text-anchor="middle" fill="currentColor">Role of AI and main elements</text>
<text x="145" y="334" text-anchor="middle" fill="currentColor">No set response deadline,</text>
<text x="145" y="358" text-anchor="middle" fill="currentColor">format or appeal route</text>
<rect x="320" y="282" width="250" height="96" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="445" y="308" text-anchor="middle" fill="currentColor">Personal data and applied logic</text>
<text x="445" y="334" text-anchor="middle" fill="currentColor">One-month normal deadline</text>
<text x="445" y="358" text-anchor="middle" fill="currentColor">for the access response</text>
<rect x="90" y="420" width="410" height="42" rx="8" fill="none" stroke="currentColor" stroke-width="2"/>
<text x="295" y="446" text-anchor="middle" fill="currentColor">Neither route guarantees reversal of the decision</text>
</svg>
Figure: Parallel requests can provide different information, deadlines and routes for enforcement.
The AI Act sets no response deadline, prescribed format or express appeal mechanism for an Article 86 request. Its current scope is also disputed because the rule classifying Annex III systems as high-risk was deferred until 2 December 2027. No final guidance or court ruling had resolved that interaction by 12 September 2026.2
Under GDPR Articles 12 and 15, the controller must normally respond within one month to a request for personal data and meaningful information about qualifying automated decision-making. National data-protection authorities and courts have enforced that controller duty since 25 May 2018.3 Article 22 also places duties on the controller concerning solely automated decisions with serious effects. For decisions based on contractual necessity or explicit consent, the controller must provide human intervention, an opportunity to express your view and a way to contest the decision. Data-protection authorities and courts have enforced those duties since 25 May 2018.4
Future AI Act human-oversight rules are different. Articles 14, 16 and 26 require providers to design oversight into high-risk systems and deployers to appoint competent, trained and authorised people. Market-surveillance authorities or the AI Office enforce those duties from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.5 They do not create a general personal right to demand a fresh human decision.
Boundary. Article 86 excludes listed critical-infrastructure systems and allows lawful restrictions. It also applies only insofar as Union law does not already provide the explanation. GDPR Article 22 depends on whether the particular decision was solely automated, which is a fact-specific question. Neither law guarantees that an explanation will reverse the outcome.1
Quellen
Quizze
Personal data and AI contributed to a serious adverse decision. What is the strongest immediate approach?
- Send parallel requests under the AI Act and GDPR
- Wait for every high-risk safeguard to become applicable
- Request information only from the software system’s provider
The GDPR route is established, while a parallel AI Act request preserves the separate explanation claim despite its contested current scope.
An AI Act explanation request may still be relevant where ____.
- a human relied on the system’s output
- the outcome had no significant effect
- no listed high-risk system was involved
Article 86 does not require sole automation. A human decision based on AI output can still fall within its conditions.
The AI Act’s human-oversight duties already give every affected person a personal right to demand a fresh human decision.
- True
- False
Those future rules impose design and staffing duties on providers and deployers. They do not create a universal personal review right.
Kommentare
Noch keine Kommentare. Fang das Gespräch an.