The Right to an Explanation: Why Article 86 of the AI Act Only Bites in Practice from December 2027

Every summary of the Digital Omnibus published in summer 2026 carries the same headline: the high-risk obligations have been postponed to December 2027. For Annex III, that is correct. What almost none of them mention is that the postponement was drafted as a list, that the list names specific chapters, and that the chapter containing the affected person’s right to an explanation is not on it. On our reading, Article 86 has therefore formally applied since 2 August 2026. In practice it only bites from December 2027: under Article 111(2), the Regulation applies to operators of high-risk systems placed on the market or put into service before that date only once those systems undergo a significant change in design. Preparing now still pays, because from then on new and significantly changed systems are caught.

What the provision actually says

Article 86(1) gives a person affected by a decision that a deployer took on the basis of the output of a high-risk AI system listed in Annex III, other than the systems in point 2 of that Annex, and which produces legal effects or similarly significantly affects that person in a way they consider to have an adverse impact on their health, safety or fundamental rights, the right to obtain from the deployer a clear and meaningful explanation of the role of the AI system in the decision-making procedure and of the main elements of the decision taken.

Two features of that sentence matter more than its length. The duty falls on the deployer, meaning the company using the system, not the vendor that built it. And the trigger is a decision about a person, not the deployment of a system. Nothing has to be reported, registered or certified. Someone has to ask.

Why the postponement does not formally reach it

Regulation (EU) 2026/1744, in force since 27 July 2026, did not postpone the AI Act. It postponed named parts of it. The amended Article 113(3) works through the Regulation chapter by chapter, and the limb carrying the new dates refers to Chapter III Sections 1, 2 and 3: the classification rules, the requirements for high-risk systems, and the obligations of providers, deployers and other actors.

Article 86 is not in Chapter III. It sits in Chapter IX, Section 4, headed Remedies, alongside Article 85, the right to complain to a market surveillance authority. Neither the chapter nor the articles appear anywhere in the list of exceptions, which means both fall under the opening rule of Article 113: the Regulation applies from 2 August 2026.

That, however, is only half the answer. Article 111(2) as amended by Regulation (EU) 2026/1744 provides that the Regulation applies to operators of high-risk AI systems placed on the market or put into service before the date of application of Chapter III only if, as from that date, those systems are subject to significant changes in their designs. Under Article 3(8), operators include deployers, the very addressees of Article 86. For Annex III systems Chapter III applies from 2 December 2027, and according to recital 39 of the amending Regulation what counts is when the first unit of the same type and model was placed on the market. Before 2 December 2027, Article 86 therefore binds practically no one. After that it reaches systems newly placed on the market from that date, and existing systems only after a significant change in their design. For high-risk systems intended to be used by public authorities, the same paragraph requires compliance in any case by 2 August 2030. The right and the duties thus arrive together, not one after the other.

The word that is missing from Article 86

This is the part with the most practical consequence, and it turns on a single word. Article 22(1) GDPR gives a person the right not to be subject to a decision based solely on automated processing. That word has done an enormous amount of work over the past eight years. It is the reason so many organisations built a review step into automated processes and concluded, correctly, that the provision no longer applied to them.

Article 86 does not contain it. The text requires only that the deployer took the decision on the basis of the output of the system. A recruiter who reads a ranked shortlist and picks from it has taken a decision on the basis of an output. The human in the loop keeps the case outside Article 22 GDPR and squarely inside Article 86.

Article 86(3) then fits the two together rather than duplicating them: the article applies only in so far as the right is not otherwise provided for under Union law. Where the GDPR already grants the right, it governs. Where it does not, because a person was involved, Article 86 fills exactly that space. The two provisions meet at precisely the seam along which most compliance designs were built.

Who this reaches in a mid-sized company

Article 86 is confined to systems listed in Annex III, with point 2 on critical infrastructure carved out. Points 6 to 8 (law enforcement, migration, asylum and border control management, administration of justice and democratic processes) and point 5(a) (public assistance benefits) will rarely touch an ordinary company. Point 1 (biometrics, for example emotion recognition), point 3 (education and vocational training) and point 5(d) (emergency calls and triage) can also reach private deployers. What reaches an ordinary company above all is point 4.

It covers systems intended for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications and to evaluate candidates. It also covers systems used to make decisions affecting terms of work-related relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, and to monitor and evaluate the performance and behaviour of persons in such relationships.

That is a description of ordinary HR software as it has been sold since roughly 2023. A company of eighty people running an applicant tracking system whose vendor advertises AI-assisted pre-screening is a deployer of an Annex III system, whether or not anyone in the building has framed it that way. Point 5(b), creditworthiness assessment other than fraud detection, adds the financial services side, and 5(c) covers risk assessment and pricing in life and health insurance.

The rejected applicant is the realistic requester here. Not a regulator, not a competitor: a candidate who was filtered out, has read that such a right exists, and writes to ask how the decision was reached.

What clear and meaningful is likely to mean

By mid-October 2026 no court had interpreted Article 86, so anyone claiming to know the standard precisely is guessing. There is, however, a close benchmark. On 27 February 2025 the Court of Justice ruled in Case C-203/22, Dun & Bradstreet Austria, on the neighbouring right of access to meaningful information about the logic involved in automated decision-making.

The Court set the standard in both directions. The controller must present the procedures and principles applied in a concise, transparent, intelligible and easily accessible form, such that the person can understand how the result was reached and can contest it. But disclosure of the algorithm itself is not required, and commercially sensitive detail does not have to be surrendered wholesale.

Applied to a hiring case, the shape of an adequate answer becomes reasonably clear: which categories of information the system evaluated, what it produced, how heavily that output weighed against the human assessment, and what would have had to differ for the outcome to change. What is not adequate is the answer that, in our assessment, most companies would give today, which is that the software made a recommendation and a colleague looked at it.

What happens if you cannot explain

The Regulation itself sets no fine. Article 99(4) enumerates the finable infringements and names Articles 16, 22, 23, 24, 25, 26, 31, 33, 34 and 50. Article 86 does not appear. Article 99(1), as amended by Regulation (EU) 2026/1744, does however require Member States to lay down penalties, which may include administrative fines, applicable to any infringement of the Regulation. Whether national penalties attach to Article 86 therefore depends on national implementing law.

The consequences run along three other paths. Article 85 lets any natural or legal person with grounds to consider that the Regulation has been infringed complain to the market surveillance authority, and requires that such complaints be taken into account in market surveillance activity. A complaint therefore does not resolve into nothing; it puts the company on a list. Second, the civil courts remain open, and an unexplained rejection in a hiring context sits uncomfortably close to the burden-of-proof rules in discrimination law. Third, and most consequential in the medium term, a company that cannot answer in 2026 will not be able to answer in December 2027 either, when the Chapter III duties arrive with fines of up to EUR 15 million or 3 % of worldwide turnover attached, reduced for SMEs to whichever figure is lower.

The question this article does not settle

Honesty requires marking the open point. Article 86 refers to a high-risk system listed in Annex III. The classification rules in Article 6(2), which govern when a system is treated as high-risk, sit in Chapter III Section 1 and are among the provisions postponed to December 2027. A defensible counter-argument therefore exists: that until the classification machinery applies, there are no Annex III high-risk systems in the legal sense, and Article 86 runs empty.

The better view, we think, is the other one. Article 86 refers to systems listed in Annex III, and that Annex is part of a Regulation in force. It does not refer to systems classified under Article 6(2). Chapter IX was deliberately left out of a list that was drafted item by item. But this is an interpretive question that no court had answered by mid-October 2026, and a company acting on it should know it is doing so.

For practical purposes the dispute hardly matters, because Article 111(2) leads to the same result on either reading: for systems placed on the market before 2 December 2027, Article 86 binds the deployer only after a significant change in design from that date, and for new systems it applies together with Chapter III. Nothing about the preparation changes: everything below has to be in place as soon as such a system is in use.

What to do now

• Find out where AI already touches decisions about people. Usually recruitment, occasionally performance review or shift allocation. The question is not what you have procured as an AI system, but which of your existing tools has acquired such a function through an update. In our project experience, that is where most of them entered the building.
• Write one page per system that a non-specialist can follow. What goes in, what comes out, how the output enters the decision. If you cannot write it because the vendor has not told you, that answer is itself worth having now rather than in December 2027, when you will be entitled to demand it.
• Decide who answers, and within what period. Article 86 sets no deadline, which is not a licence to leave letters unanswered. Assign it to whoever already handles data subject access requests; the process exists and the route is the same.
• Check whether the human step is real. A reviewer who confirms a ranking without the time or the information to depart from it is documentation, not a decision. That distinction matters under Article 22 GDPR and will matter under Article 86 as soon as anyone asks how the main elements of the decision were weighed.

Conclusion

The interesting thing about Article 86 is not its severity, because the Regulation itself attaches no fine and no deadline to it. It is the gap between formal application and effect. On our reading, the right has formally applied since 2 August 2026; under Article 111(2) it only bites from 2 December 2027, and then for new or significantly changed systems. The time until then is long enough to build the necessary explainability quietly, and short enough that a company which waits for December 2027 will be building it under pressure. The work is documentation rather than technology, which is the main reason it keeps being deferred. If you want to know where your own AI-supported decisions would fail this test, that is exactly what an initial conversation is for, and the wider picture is in our piece on the AI Act labelling duty.

Frequently asked questions on the right to an explanation