The Right to an Explanation: Why Article 86 of the AI Act Has Applied Since 2 August Although High-Risk Was Postponed

Every summary of the Digital Omnibus published this summer carries the same headline: the high-risk obligations have been postponed to December 2027. That is correct. What almost none of them mention is that the postponement was drafted as a list, that the list names specific chapters, and that the chapter containing the affected person’s right to an explanation is not on it. Article 86 has been in force since 2 August 2026. The obligations that would let a company answer under it arrive sixteen months later.

What the provision actually says

Article 86(1) gives a person affected by a decision that a deployer took on the basis of the output of a high-risk AI system listed in Annex III, other than the systems in point 2 of that Annex, and which produces legal effects or similarly significantly affects that person in a way they consider to have an adverse impact on their health, safety or fundamental rights, the right to obtain from the deployer a clear and meaningful explanation of the role of the AI system in the decision-making procedure and of the main elements of the decision taken.

Two features of that sentence matter more than its length. The duty falls on the deployer, meaning the company using the system, not the vendor that built it. And the trigger is a decision about a person, not the deployment of a system. Nothing has to be reported, registered or certified. Someone has to ask.

Why the postponement does not reach it

Regulation (EU) 2026/1744, in force since 27 July 2026, did not postpone the AI Act. It postponed named parts of it. The amended Article 113(3) works through the Regulation chapter by chapter, and the limb carrying the new dates refers to Chapter III Sections 1, 2 and 3: the classification rules, the requirements for high-risk systems, and the obligations of providers, deployers and other actors.

Article 86 is not in Chapter III. It sits in Chapter IX, Section 4, headed Remedies, alongside Article 85, the right to complain to a market surveillance authority. Neither the chapter nor the articles appear anywhere in the list of exceptions, which means both fall under the opening rule of Article 113: the Regulation applies from 2 August 2026.

Read as a whole, the sequence is unusual: the remedy precedes the substantive regime it refers to. A person may ask today for an explanation of how a system contributed to a decision, while the provider’s duty to supply instructions detailed enough to give that explanation, and the deployer’s own operating duties, are still more than a year away.

The word that is missing from Article 86

This is the part with the most practical consequence, and it turns on a single word. Article 22(1) GDPR gives a person the right not to be subject to a decision based solely on automated processing. That word has done an enormous amount of work over the past eight years. It is the reason so many organisations built a review step into automated processes and concluded, correctly, that the provision no longer applied to them.

Article 86 does not contain it. The text requires only that the deployer took the decision on the basis of the output of the system. A recruiter who reads a ranked shortlist and picks from it has taken a decision on the basis of an output. The human in the loop keeps the case outside Article 22 GDPR and squarely inside Article 86.

Article 86(3) then fits the two together rather than duplicating them: the article applies only in so far as the right is not otherwise provided for under Union law. Where the GDPR already grants the right, it governs. Where it does not, because a person was involved, Article 86 fills exactly that space. The two provisions meet at precisely the seam along which most compliance designs were built.

Who this reaches in a mid-sized company

Article 86 is confined to systems listed in Annex III, with point 2 on critical infrastructure carved out. Six of the remaining seven points concern public authorities, law enforcement, migration and justice, and will never touch an ordinary company. Point 4 does.

It covers systems intended for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications and to evaluate candidates. It also covers systems used to make decisions affecting terms of work-related relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, and to monitor and evaluate the performance and behaviour of persons in such relationships.

That is a description of ordinary HR software as it has been sold since roughly 2023. A company of eighty people running an applicant tracking system whose vendor advertises AI-assisted pre-screening is a deployer of an Annex III system, whether or not anyone in the building has framed it that way. Point 5(b), creditworthiness assessment other than fraud detection, adds the financial services side, and 5(c) covers risk assessment and pricing in life and health insurance.

The rejected applicant is the realistic requester here. Not a regulator, not a competitor: a candidate who was filtered out, has read that such a right exists, and writes to ask how the decision was reached.

What clear and meaningful is likely to mean

No court has interpreted Article 86, so anyone claiming to know the standard precisely is guessing. There is, however, a close benchmark. On 27 February 2025 the Court of Justice ruled in Case C-203/22, Dun & Bradstreet Austria, on the neighbouring right of access to meaningful information about the logic involved in automated decision-making.

The Court set the standard in both directions. The controller must present the procedures and principles applied in a concise, transparent, intelligible and easily accessible form, such that the person can understand how the result was reached and can contest it. But disclosure of the algorithm itself is not required, and commercially sensitive detail does not have to be surrendered wholesale.

Applied to a hiring case, the shape of an adequate answer becomes reasonably clear: which categories of information the system evaluated, what it produced, how heavily that output weighed against the human assessment, and what would have had to differ for the outcome to change. What is not adequate is the answer most companies would give today, which is that the software made a recommendation and a colleague looked at it.

What happens if you cannot explain

Directly, no fine. Article 99(4) enumerates the finable infringements and names Articles 16, 22, 23, 24, 25, 26, 31, 33, 34 and 50. Article 86 does not appear. Any account of this provision that leads with penalties has not read the penalty article.

The consequences run along three other paths. Article 85 lets any natural or legal person with grounds to consider that the Regulation has been infringed complain to the market surveillance authority, and requires that such complaints be taken into account in market surveillance activity. A complaint therefore does not resolve into nothing; it puts the company on a list. Second, the civil courts remain open, and an unexplained rejection in a hiring context sits uncomfortably close to the burden-of-proof rules in discrimination law. Third, and most consequential in the medium term, a company that cannot answer in 2026 will not be able to answer in December 2027 either, when the Chapter III duties arrive with fines of up to EUR 15 million or 3 % of worldwide turnover attached, reduced for SMEs to whichever figure is lower.

The question this article does not settle

Honesty requires marking the open point. Article 86 refers to a high-risk system listed in Annex III. The classification rules in Article 6(2), which govern when a system is treated as high-risk, sit in Chapter III Section 1 and are among the provisions postponed to December 2027. A defensible counter-argument therefore exists: that until the classification machinery applies, there are no Annex III high-risk systems in the legal sense, and Article 86 runs empty.

The better view, we think, is the other one. Article 86 refers to systems listed in Annex III, and that Annex is part of a Regulation in force. It does not refer to systems classified under Article 6(2). Chapter IX was deliberately left out of a list that was drafted item by item. But this is an interpretive question that no court has yet answered, and a company acting on it should know it is doing so.

For practical purposes the dispute matters less than it appears. If the narrow reading is right, the duty starts in December 2027 rather than in August 2026, and everything below still has to be in place. Nothing about the preparation changes; only the date by which it is overdue.

What to do now

• Find out where AI already touches decisions about people. Usually recruitment, occasionally performance review or shift allocation. The question is not what you have procured as an AI system, but which of your existing tools has acquired such a function through an update. That is where most of them entered the building.
• Write one page per system that a non-specialist can follow. What goes in, what comes out, how the output enters the decision. If you cannot write it because the vendor has not told you, that answer is itself worth having now rather than in December 2027, when you will be entitled to demand it.
• Decide who answers, and within what period. Article 86 sets no deadline, which is not a licence to leave letters unanswered. Assign it to whoever already handles data subject access requests; the process exists and the route is the same.
• Check whether the human step is real. A reviewer who confirms a ranking without the time or the information to depart from it is documentation, not a decision. That distinction matters under Article 22 GDPR and will matter under Article 86 as soon as anyone asks how the main elements of the decision were weighed.

Conclusion

The interesting thing about Article 86 is not its severity, because it carries no fine and no deadline. It is the timing. A legislature that postpones the obligations of companies while leaving the rights of individuals in force has produced a window in which someone can ask a question that the addressee is not yet equipped to answer. Sixteen months is long enough to close that gap quietly, and short enough that a company which waits for December 2027 will be closing it under pressure. The work is documentation rather than technology, which is the main reason it keeps being deferred. If you want to know where your own AI-supported decisions would fail this test, that is exactly what an initial conversation is for, and the wider picture is in our piece on the AI Act labelling duty.

Frequently asked questions on the right to an explanation