Right to Explanation

Legal Framework

The right to explanation operates at the intersection of two regulatory regimes. Under Article 22 GDPR, data subjects have the right not to be subject to solely automated decisions producing legal or similarly significant effects, unless an exception applies. Where such processing is permitted, Article 22(3) GDPR requires safeguards including the data subject's right to obtain human intervention, to express their point of view, and to contest the decision. Article 15(1)(h) GDPR complements this by granting a right of access to meaningful information about the logic of automated processing.

The AI Act reinforces these protections through Article 86, which establishes a dedicated right to explanation of individual decision-making for outputs produced by high-risk AI systems. This provision extends the transparency obligation beyond the GDPR's scope, applying to deployers of high-risk AI systems whose outputs produce legal or similarly significant effects for affected persons. The rationale across both instruments is to ensure that individuals subject to algorithmic decisions can understand, challenge, and seek redress against outcomes that materially affect their rights and freedoms.

Key Developments

Dutch case law illustrates the practical thresholds for triggering Article 22 protections. In the ICS Card credit card refusal case, the Hague Court of Appeal examined whether a score model constituted solely automated decision-making. The court found that where a human applied acceptance policy criteria and the decision hinged on a pre-existing spending limit rather than an automated score, Article 22 did not apply. The court declined to treat the application form's reference to an automated assessment as conclusive evidence of solely automated processing, focusing instead on whether a human decision-maker exercised genuine discretion.

This establishes a demanding threshold: Article 22 applies only where the decision is produced without meaningful human involvement. A nominal human review that merely rubber-stamps an algorithmic output would likely qualify, but a decision where human judgment materially influences the outcome may fall outside Article 22's scope. However, such decisions may still trigger Article 15(1)(h) access rights and, where high-risk AI is deployed, Article 86 AI Act explanation rights.

The EDPB's guidance on facial recognition technology further signals that automated processing in law enforcement contexts attracts heightened scrutiny, with human oversight requirements serving as a critical safeguard against unaccountable algorithmic decision-making.

Practical Guidance

• Distinguish between Article 22 and Article 15(1)(h) obligations. Even where decisions are not solely automated and thus fall outside Article 22's prohibition, the Article 15(1)(h) access right to information about processing logic remains independently enforceable. Maintain separate response procedures for each.

• Document the degree of human involvement in every automated-assisted decision. The ICS Card ruling demonstrates that courts will scrutinize whether human intervention was substantive or merely formal. Retain records showing the specific criteria a human decision-maker applied and how they exercised discretion.

• Implement explanation mechanisms proportionate to decision impact. For high-risk AI systems subject to Article 86 AI Act, prepare clear, accessible explanations of how the system functions, the main parameters influencing the output, and the reasoning behind individual decisions affecting data subjects.

• Audit application forms and privacy notices for accuracy. References to automated assessment on customer-facing materials may create expectations or evidentiary burdens. Ensure that descriptions of automated processing accurately reflect the actual decision-making workflow.

• Establish a contestation and human review pathway. Where Article 22 applies, provide a structured process allowing data subjects to express their views, request human reconsideration, and contest the decision with a named individual empowered to override the automated outcome.