Who reads the explanation
A loan officer, an applicant and a reviewer each need something different from the same decision. This system serves the first 2 and partly serves the third.
What each audience needs and receives
The loan officer
- Needs
- Enough reasoning to disagree with the engine and record a different outcome.
- Gets
- A grounded rationale, every figure clickable to the transactions that produced it, and an override that is recorded.
- Answers to
- AI Act Article 26, human oversight capable of changing the outcome
The applicant
- Needs
- Why they were declined, in terms that let them act, and a route to a person.
- Gets
- The outcome, the decisive factor and the figures behind it, plus the right to request human review.
- Answers to
- AI Act Article 86 and GDPR Article 22(3)
The reviewer or supervisor
- Needs
- To re-perform the decision and see that nothing was invented.
- Gets
- Deterministic decision logic, an append-only audit log with export, and a rationale held to 5 programmatic checks.
- Answers to
- Re-performance of the decision from the source transactions
How the explanation is constrained
A wrong figure in fluent prose is harder to catch than an obvious error, so the drafting is held to a written standard and every figure a reviewer reads opens to the transactions behind it.
Every figure traces to its source
The rationale is checked in the harness
The explanation was re-performed
One of the control tests drives applicants through the decision engine until one is declined, then reads back the explanation that applicant would receive and asserts that it states the outcome, names the decisive factor and carries the figures behind it. It produced a declined case for one persona and an explanation of 526 characters, and it passes.
The test checks structure and grounding. Article 86 requires the explanation to be meaningful to the affected person, and that has not been tested with anyone outside the build. See CO9.
Both disclosures are made now, and neither has been read by an outsider
The applicant is told a decision was automated and is offered human review, which serves GDPR Article 22. They are also told a language model categorised their transactions and drafted the reasoning, and that the decision itself was made by deterministic rules. AI Act Article 50 asks for that second disclosure. Article 22 does not. CO10 records both.
The written classification and the impact assessment exist as well, concluding high risk under Annex III point 5(b). Read the assessments.
Making a disclosure is not the same as being understood. Nobody outside this build has read either notice, so whether an applicant takes the meaning from it has never been tested. Meaningfulness is the standard Article 86 sets, and a notice that satisfies a control test can still fail the person it was written for.
The same holds for the rationale a loan officer reads. It passes 5 deterministic grounding checks and has never been compared against what a person would have written, which is finding F2 in the register.