"Why did your AI decide this?" An EU AI Act Article 86 explanation request sheet and reply letter for small businesses
What you get: a finished explanation request sheet: a 12-column log, one row per request (decision, AI system, role of the AI output, main elements of the decision, person responsible, logs checked, GDPR route, reply due, outcome), a five-question check on whether Article 86 of the EU AI Act applies, and a reply letter you can fill in and send. Made for small businesses that use AI to screen job applicants, score credit, price insurance or assess learners, and for the accountants and advisers who help them.
The short answer
Article 86 of the EU AI Act lets a person affected by a decision you took on the basis of a high-risk AI system's output (Annex III, except critical infrastructure) ask you for clear and meaningful explanations of the role of the AI system and the main elements of the decision, where the decision has legal or similarly significant effects that they consider adverse to their health, safety or fundamental rights. It applies only where other Union law, such as GDPR, does not already provide that right. Under GDPR, decisions based solely on automated processing already carry rights today: meaningful information about the logic involved (Article 15(1)(h)) and human intervention, a chance to give their view and to contest (Article 22(3)). So the practical step is one log that handles both routes for every request.
Dates: Article 86 is in Chapter IX, covered by the general application date of 2 August 2026 (Article 113). The Annex III high-risk rules in Chapter III, Sections 1 to 3, apply from 2 December 2027 after the Digital Omnibus, Regulation (EU) 2026/1744 (Article 113(c)(i) as amended). The text does not say how those two dates interact for Article 86, so take advice on your case. From 2 December 2027, Article 26(11) also requires deployers of Annex III systems that make or help make decisions about people to tell those people that they are subject to the use of the system. See the deadline sheet.
Step 1: does Article 86 apply? (five questions)
| Question | Source | Answer |
|---|---|---|
| 1. Did you take the decision, using the output of an AI system (a score, ranking, flag or recommendation)? | Art. 86(1): the right is against the deployer that took the decision | Y / N |
| 2. Is that AI system high-risk under Annex III, and not under point 2 (critical infrastructure)? Typical small-business cases: recruitment or selection of applicants and decisions on promotion, termination or task allocation (point 4), creditworthiness or credit scoring of people (point 5(b)), risk assessment and pricing for life and health insurance (point 5(c)), admission or assessment in education and training (point 3). | Art. 86(1); Annex III. Use the Annex III check | Y / N |
| 3. Did the decision produce legal effects for the person, or affect them similarly significantly (e.g. not shortlisted, credit refused, contract ended, course place refused)? | Art. 86(1) | Y / N |
| 4. Does the person say it had an adverse impact on their health, safety or fundamental rights? | Art. 86(1): it is the person's own view that counts ("they consider") | Y / N |
| 5. Is there an exception or restriction in Union or national law, or does other Union law (for example GDPR) already give this right? | Art. 86(2) and (3) | Y / N |
Yes to 1 to 4 and no to 5: Article 86 applies. A no to any of 1 to 4: Article 86 does not apply, but check the GDPR route in column J and consider explaining anyway; an unanswered person can complain to the market surveillance authority (Article 85) or, for personal data, to the data protection authority.
Step 2: the request log (one row per request)
| Column | Fill in | Why |
|---|---|---|
| A. Request no. and date received | [2026-001] · [dd/mm/yyyy] | Starts your reply clock (column K) |
| B. Person and channel | [name] · [email / letter / phone / in person] · identity confirmed: Y / N | Do not disclose to the wrong person; GDPR Art. 12(6) lets you ask for information to confirm identity where you have reasonable doubts |
| C. Decision concerned | [what was decided, when, by whom], e.g. application not shortlisted on [date] | Art. 86(1): "the decision taken" |
| D. AI system and Annex III point | [tool, provider, version] · Annex III point [4(a) / 5(b) / ...] or "not high-risk" | Art. 86(1); Annex III; your AI register entry |
| E. Five-question result | Q1–Q5: [Y/N each] → Article 86 applies / GDPR route only / neither (explain anyway) | Art. 86(1)–(3) |
| F. Role of the AI system | What the output was [score 41/100, ranked 23 of 60, flagged "incomplete"], how staff used it [shortlist cut-off at top 15], whether a person could and did override it | Art. 86(1): "the role of the AI system in the decision-making procedure" |
| G. Main elements of the decision | The criteria and facts the decision rested on [required certificate missing; 2 years' experience asked, 1 shown] | Art. 86(1): "the main elements of the decision taken"; Recital 171: a basis on which the person can exercise their rights |
| H. Person responsible | Who took or reviewed the decision [role]; human oversight assigned to [role] | Art. 26(2): oversight by people with competence, training and authority (high-risk deployers) |
| I. Logs and records checked | [log export ref, date range]; kept at least six months: Y / N | Art. 26(6): deployers keep logs under their control for at least six months (high-risk); see the logs guide |
| J. GDPR route | Decision based solely on automated processing? Y / N · asked for human review or to contest? Y / N · Art. 15 access request too? Y / N | GDPR Art. 22(1) and (3), Art. 15(1)(h) |
| K. Reply due | House rule: one month from A, e.g. =EDATE(A2,1); extension (GDPR only): up to two more months, tell the person within the first month with reasons | GDPR Art. 12(3). Article 86 itself sets no time limit |
| L. Reply and outcome | Sent on [date] by [role] · outcome [explained / human review done / decision changed / upheld] · status =IF(L2<>"","Answered",IF(TODAY()>K2,"Overdue",K2-TODAY()&" days left")) | Evidence for your register; GDPR Art. 5(2) accountability |
Example row, made up: A. 2026-001 · 12/01/2028 · B. Applicant, by email, identity matched to application · C. Not shortlisted for warehouse supervisor role on 05/01/2028 · D. CV-screening tool [provider, v3], Annex III point 4(a) · E. Q1–Q4 Y, Q5 N → Article 86 applies · F. Tool ranked applicants; applicant ranked 23 of 60; recruiter reviewed the top 20 only · G. Forklift licence listed as required, not shown in CV · H. Recruitment lead reviewed shortlist · I. Ranking log exported for 02–05/01/2028 · J. Not solely automated; asked for review: Y · K. 12/02/2028 · L. Sent 20/01/2028; recruiter re-read CV, licence found on page 2, applicant invited to interview.
Step 3: the reply letter (fill in)
Dear [name],
Thank you for your request of [date] about our decision on [decision, date]. Here is how the decision was made.
Role of the AI system. We use [tool type, e.g. a CV-screening tool] supplied by [provider]. For your [application / request], it produced [the output: a ranking / a score / a flag]. [Name of role] then [how the output was used, e.g. reviewed the 20 highest-ranked applications]. The tool did not take the decision on its own: [or: the decision was based solely on the tool's output].
Main elements of the decision. The decision rested on: [criterion 1 and the fact about you], [criterion 2 ...]. [Information you gave or that we hold that was used: ...]
What you can do. If you think a fact is wrong or missing, reply to this letter by [date] and a member of staff who was not involved will review the decision. [If solely automated: you can ask for human intervention, give your point of view and contest the decision (GDPR Article 22(3)).] You can also ask for a copy of your personal data (GDPR Article 15), and you can complain to [supervisory authority / market surveillance authority].
Kind regards, [name, role, business]
Do this week
- List every AI tool that scores, ranks or flags people, and mark its Annex III point (or "not high-risk") in your AI register
- Ask each provider how to export the output and logs for one person and one date range; write "not offered" rather than guess (vendor questions)
- Write the main criteria for each decision type down once, so column G is quick to fill
- Name who answers requests and who reviews contested decisions (column H; human oversight log)
- Add one line on how to ask for an explanation to your staff and applicant notice and your privacy notice
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Articles 26, 85, 86, 113, Annex III, Recital 171) and Regulation (EU) 2016/679 (Articles 5(2), 12, 15, 22). National law and sector rules (employment, credit, insurance) can add obligations or set exceptions. Checked on 23 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
If your small business clients use AI for hiring, credit decisions or pricing, hand them this sheet next to their client AI inventory. Stay inside your professional rules and refer legal questions on.
Keep each request next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep each request row and reply as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this log. Related: GDPR Article 22 decision sheet · Article 15 access request sheet · Annex III high-risk check · Article 27 FRIA: who must · AI incident and complaint log.
Sources
- Regulation (EU) 2024/1689 (AI Act): Articles 26(2), (6), (11), 85, 86, Annex III, Recital 171
- Regulation (EU) 2026/1744 (Digital Omnibus on AI); consolidated text on the Commission's AI Act Service Desk, Article 86 and Article 113
- Regulation (EU) 2016/679 (GDPR): Articles 5(2), 12(3) and (6), 15(1)(h), 22(1) and (3)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.