A customer is refused a loan, a candidate is screened out, a policyholder gets a higher premium. Behind it sits a scoring system or an AI model. The person writes: "Why?". For the business the question is not whether to answer, but what to explain, by when and in how much depth. The short answer: the GDPR already requires it for solely automated decisions, the Court of Justice raised the bar in 2025, and the AI Act adds a second track for high-risk systems.
Two rules, two different scopes
| GDPR (Reg. EU 2016/679) | AI Act (Reg. EU 2024/1689) | |
|---|---|---|
| Provision | Articles 13–15 and 22 | Article 86 |
| Trigger | decision based solely on automated processing, with legal or similarly significant effects | deployer decision based on the output of an Annex III high-risk system (excluding point 2, critical infrastructure), with legal or similarly significant effects |
| Human involvement | takes it out of Article 22, if genuine | the right applies even if a person decides |
| Who answers | the controller | the deployer |
| What to explain | meaningful information about the logic, significance and envisaged consequences | the AI system's role in the decision-making procedure and the main elements of the decision |
| From when | already in force | 2 August 2026, with classification operative from 2 December 2027 |
The key is how the two interact. Article 86(3) states that the AI Act right applies only to the extent it is not already provided for under Union law. Where the GDPR covers the decision, the GDPR applies; Article 86 fills the gap for "assisted" decisions, where the system proposes and a person signs off.
What the GDPR requires today
For Article 22 decisions the controller must:
- Inform in advance of the existence of automated decision-making, with meaningful information about the logic involved, its significance and the envisaged consequences (Articles 13(2)(f) and 14(2)(g)).
- Answer access requests with the same information (Article 15(1)(h)), normally within one month, extendable by two further months where necessary (Article 12(3)).
- Provide the Article 22(3) safeguards where the decision rests on contract or consent: the right to obtain human intervention, to express one's point of view and to contest the decision.
Mind the scope: in C-634/21 (SCHUFA, 7 December 2023) the Court of Justice held that calculating a score is itself an automated decision when the third party receiving it draws strongly on it. And a "human in the loop" who always confirms the outcome is not enough to escape Article 22.
What "explain" means: the Dun & Bradstreet ruling
In C-203/22 (Dun & Bradstreet Austria, 27 February 2025) the Court clarified what the explanation must contain:
- the procedure and principles actually applied must be described, so the person understands which of their data were used and how;
- the explanation must enable them to understand and contest the decision;
- handing over the algorithm is not enough: it is not a concise and intelligible explanation;
- it may be appropriate to state to what extent a change in the data would have led to a different outcome;
- where trade secrets or third-party data are involved, the information must be provided to the supervisory authority or the court, which balances the interests. Secrecy is not an automatic refusal.
In practice: you need a counterfactual, readable explanation ("the factor that weighed most was X; with a value of Y the outcome would have differed"), not a technical PDF of the model.
What the AI Act adds (and when)
Article 86 gives the affected person the right to obtain from the deployer clear and meaningful explanations of the AI system's role in the decision-making procedure and of the main elements of the decision taken. It applies where the person considers that the decision adversely affects their health, safety or fundamental rights.
The date needs precision. Article 86 follows the general application date, 2 August 2026. But it presupposes an Annex III high-risk system, and after Regulation (EU) 2026/1744 the classification rules and high-risk obligations (Chapter III, Sections 1–3) apply from 2 December 2027. Until then the practical reach of Article 86 remains uncertain: setting up the process now costs little and covers you under either reading.
From 2 December 2027 deployers must also inform people that they are subject to an Annex III high-risk system that makes or assists in decisions about them (Article 26(11)).
A note: the Commission has proposed rewriting Article 22 GDPR in the data Digital Omnibus. It is a proposal still under negotiation, opposed by the EDPB and EDPS: it is not law in force and should not be relied on.
The operational checklist
- Map decisions, not just systems: where does an AI output affect credit, employment, insurance or access to services?
- Qualify each decision: solely automated (Article 22 GDPR) or assisted (potential Article 86 for Annex III systems)?
- Check that human involvement is genuine: competence, time, authority and a documented record of cases where the reviewer departed from the output.
- Get from the vendor what you need to explain: main factors, weights, scoring logic. Put it in the contract.
- Prepare a response template with decisive factors, data used, a counterfactual explanation and a channel to contest.
- Update privacy notices (Articles 13–14 GDPR) and the record of processing.
- Set a process with an owner and a one-month deadline, and keep the answers given.
Where to start
Being able to explain a decision is the most concrete proof that you govern it. An independent gap assessment identifies the automated or assisted decisions in use, checks what you can explain today and turns the two tracks, GDPR and AI Act, into a single process with owners and deadlines.