EU AI Act Article 86: The Right to an Explanation of Individual Decisions
Article 86 of the EU AI Act gives any person affected by a decision taken by a deployer on the basis of output from a high-risk AI system listed in Annex III — where the decision produces legal effects or similarly significantly affects them — the right to obtain from the deployer a clear and meaningful explanation of the role of the AI system in the decision-making procedure and the main elements of the decision taken. Operationally this requires per-decision records rather than aggregate documentation: the deployer must be able to explain one specific decision to one specific person. AIAgentree answers Article 86 requests with the Decision Record, a self-verifying PDF per decision whose explanation narrative is currently draft pending legal sign-off. Explanation access is not an admin privilege — every role that can read the PDF can read the explanation. Article 86 applies to high-risk systems under Annex III from December 2, 2027, following the deferral introduced by the Digital Omnibus on AI.
Article 86 is an individual right: a person affected by a high-risk AI decision can demand a clear and meaningful explanation of the AI's role in it. Aggregate documentation cannot answer it — only per-decision records can.
- •Who can ask — any affected person, when a high-risk AI system's output informed a decision with legal or similarly significant effects.
- •What they get — the role the AI played and the main elements of the decision. Clear and meaningful, not a model card.
- •What it demands of you — the ability to explain one decision, months later, to a non-expert.
- •The answer artifact — a per-decision Decision Record, readable by every role, not just admins.
Traceability tells you what an agent did. This cluster is about the next step: records that stand up — under the EU AI Act, NIST AI RMF and ISO/IEC 42001.
- 1.Defensible AI Decisions: The Complete Guide to Records an Auditor Can Act On
- 2.They Made Agents Traceable. We Make Their Decisions Defensible.
- 3.The Decision Record: the PDF an Auditor Actually Opens
- 4.Inside the Signed Decision Packet (the JSON)
- 5.Inside an EU AI Act Evidence Package (Folder by Folder)
- 6.Human Oversight You Can Prove (Because Machines Can't Hold the Permission)
- 7.Article 86: What Affected Persons Can Demand From Your AIYou are here
- 8.From First Trace to Evidence Package: an EU AI Act Flow Walk-Through
- 9.A NIST AI RMF Self-Assessment You Can Actually Finish
- 10.ISO/IEC 42001 Readiness: 38 Controls, One Honest Score
- 11.Agent-Native Onboarding: Tracing in 10 Lines (and Agents Can Sign Themselves Up)
Most EU AI Act obligations point inward — logs, documentation, oversight processes. Regulators may never read most of it.
Article 86 points outward. It hands a right to the person your AI just decided about — and they do not need a lawyer or a regulator to use it.
Which makes it the article most likely to arrive in your inbox first.
Disclaimer: Informational content, not legal advice. AIAgentree supports compliance work with Article 86; whether a given explanation satisfies the obligation in a specific case is a legal question for qualified counsel. Regulation text current as of August 2026.
What Article 86 Actually Says
Article 86(1) of Regulation (EU) 2024/1689 gives any affected person the right to obtain from the deployer "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken" — when three conditions line up:
- •The decision was taken by a deployer on the basis of output from a high-risk AI system listed in Annex III (with narrow exceptions such as certain critical-infrastructure systems) — the classification we cover in the Annex III guide;
- •The decision produces legal effects on the person, or similarly significantly affects them — health, safety, or fundamental rights;
- •An affected person requests it — a customer denied credit, a candidate rejected by a screening system, a claimant whose insurance claim was scored.
Note who owes the answer: the deployer — the organization using the system — not the model vendor. If your team deploys a high-risk agent, this obligation is yours, regardless of whose model runs underneath. The deployer-vs-provider split has its own guide: who owes what.
Why Nobody Writes About Article 86
Search the compliance literature and you will find hundreds of treatments of Articles 6, 12 and 14 — and almost nothing on 86. There are reasons. It sits in the enforcement-and-remedies chapter, far from the requirements sections vendors build features against. It creates work only when someone asks. And it resists the standard compliance move of writing one document that covers all cases.
But that last property is exactly why it matters architecturally. Every other documentation obligation can, in principle, be answered in aggregate — one technical documentation set, one logging policy, one oversight procedure. Article 86 cannot. It is the only obligation that arrives as a question about one decision, from the person it happened to. Aggregate answers to individual questions read as evasion — because they are.
The Operational Test: One Decision, One Person, Months Later
Translate the legal text into an engineering requirement and it reads like this: for any individual decision your high-risk system informed, you must be able to produce — months later — a clear, non-expert-readable account of what role the AI played and what the main elements of the decision were.
Run that test against common architectures and the failure modes are predictable:
| If your record is… | Your Article 86 answer is… |
|---|---|
| Execution logs | A reconstruction project per request — engineering time, and the result explains the mechanics, not the decision |
| Model documentation | An aggregate answer to an individual question — how the system works in general, not what it did in this case |
| A post-hoc generated explanation | A narrative produced after the fact, with no proof it matches what actually happened at decision time |
| A per-decision sealed record | An export: the account of this decision, captured when it happened, with integrity proof attached |
The last row is the design conclusion this whole cluster keeps arriving at from different directions: obligations phrased about individuals can only be answered by records kept per decision. The artifact that implements it is the Decision Record — one self-verifying PDF per sealed decision, containing the explanation narrative and the signed evidence together. The explanation prose in it is currently a draft pending legal sign-off, and we flag that in the document itself.
Anatomy of a Request Being Answered
Here is the flow, deliberately mundane, for an illustrative credit-decline request:
The request arrives
The affected customer writes: 'I was declined and I understand AI was involved. Explain the decision.' No legal formalities are required of them.
Locate the decision, not the logs
Support looks up the sealed decision for that customer and date. Because records are per-decision objects, this is a lookup, not an investigation.
Export the Decision Record
One export produces the PDF: the AI's role, the main elements — reasoning, evidence references, the human approval — and the integrity verification result.
Review and send
Compliance or legal reviews the draft narrative, adapts it where needed, and sends the explanation. The person receives an account of their decision — not a description of your model.
One structural detail with outsized effect: in AIAgentree, explanation access is not an admin privilege. Every role that can read the PDF can read the explanation. An explanation right implemented as an admin-only feature quietly reintroduces the asymmetry the article exists to remove.
"Don't We Already Handle This Under GDPR?"
Partly — and the overlap is real. GDPR Article 22 and its transparency provisions already constrain solely-automated decisions with legal or similar effects, and much of the debate about a GDPR "right to explanation" ended unresolved. Article 86 settles the question for the high-risk AI domain: the explanation right is explicit, it attaches to decisions based on high-risk AI output (not only solely-automated ones), and it names its content — the AI's role and the decision's main elements.
So a GDPR-ready process is a head start, not an answer. The operational gap is the same one as above: GDPR compliance workflows are built around data (access, rectification, erasure), while Article 86 asks about reasoning. If your subject-access pipeline cannot produce the arguments for and against one specific decision, it will not produce an Article 86 answer either.
Diagnostic question: if an affected person's explanation request landed today for a decision made three months ago, who in your organization would answer it — and from which record?
Preparing Before the First Request
- ✓Classify first — Article 86 attaches to Annex III high-risk systems. Know which of your agents are in scope before deciding what to record. Start at the EU AI Act hub.
- ✓Record per decision — capture reasoning, evidence references and oversight at decision time. Post-hoc reconstruction fails the credibility test.
- ✓Make the explanation portable — a document the person can keep beats a portal they must log into.
- ✓Route requests — decide today which inbox owns explanation requests and what the review step is, so day-0 is a lookup, not a scramble.
Sources & Further Reading
- •Regulation (EU) 2024/1689 (EU AI Act) — Article 86, Annex III — EUR-Lex (2024)
- •Regulation (EU) 2016/679 (GDPR) — Article 22, automated individual decision-making — EUR-Lex (2016)
Frequently Asked Questions
What is Article 86 of the EU AI Act?
Article 86 gives any person affected by a decision taken by a deployer on the basis of output from an Annex III high-risk AI system — where the decision produces legal effects or similarly significantly affects them — the right to obtain a clear and meaningful explanation of the role the AI system played in the decision and the main elements of the decision taken.
Who can request an explanation under Article 86?
The affected person themselves — a declined credit applicant, a rejected job candidate, a scored insurance claimant. No regulator, lawyer, or formal procedure is required to make the request; the right belongs to the individual the decision affected.
Who is obliged to answer an Article 86 request — the deployer or the AI vendor?
The deployer: the organization that used the high-risk AI system's output in its decision. The obligation does not shift to the model provider. Deployers therefore need per-decision records for systems they operate, even when the underlying models are third-party.
What must an Article 86 explanation contain?
A clear and meaningful account of two things: the role the AI system played in the decision-making procedure, and the main elements of the decision taken. In practice that means this specific decision's reasoning basis and the AI's part in it — not general model documentation, and not a technical log dump.
How is Article 86 different from GDPR's rules on automated decisions?
GDPR Article 22 constrains solely-automated decisions with legal or similar effects and grants safeguards around them, but the scope of any GDPR explanation right remained contested. Article 86 is explicit and broader in its trigger: it covers decisions taken on the basis of high-risk AI output — including ones with a human in the loop — and names what the explanation must contain.
How does AIAgentree support Article 86 requests?
With the Decision Record: a self-verifying PDF exported per sealed decision, containing a plain-language account of the decision, the reasoning and evidence references, the oversight status, and the signed machine packet embedded for verification. Explanation access is not an admin privilege — every role that can read the PDF can read the explanation. The narrative prose is currently draft pending legal sign-off, which the document flags. This supports the obligation; it does not discharge it automatically.
Related Topics
Related Articles
AIAgentree Team
AI Compliance
The AIAgentree team is building decision tracing infrastructure for AI agents. Our mission is to make AI reasoning visible, auditable, and improvable.
Could you answer an explanation request today?
Book a 30-minute Article 86 readiness check: we walk one of your real decision types through the request flow and show you the Record it would produce.
Book a Readiness Check