Point 5(b) settles who is in scope; Article 86 settles who has to explain. Any affected person subject to a decision the deployer takes on the basis of output from an Annex III high-risk system can require clear and meaningful explanations of the role of the system in the decision procedure and the main elements of the decision, and that duty sits on the deployer rather than the vendor. My view is that Article 86(3) is the weak joint: the right applies only to the extent it is not otherwise provided under Union law, so in a Dun & Bradstreet fact pattern the data protection route keeps doing the work.
86(3) does step back where other law already covers it, but the two rights are different. The data protection route needs the decision to be fully automated. Article 86 of the AI Act doesn't. A human can sign the refusal and the explanation is still owed. It has its own limit though. The person has to consider the decision hurt their health, safety, or rights, so it's a bit more narrow.
Agreed on the narrowing. One more edge in the same point: 5(b) excludes systems used to detect financial fraud, so a refusal generated by the fraud model sits outside Annex III and outside Article 86 entirely, while the scoring model next to it sits inside. My view is that this matters more in practice than the automation threshold, because the routing is an internal design choice and the applicant never sees which model answered.
Point 5(b) settles who is in scope; Article 86 settles who has to explain. Any affected person subject to a decision the deployer takes on the basis of output from an Annex III high-risk system can require clear and meaningful explanations of the role of the system in the decision procedure and the main elements of the decision, and that duty sits on the deployer rather than the vendor. My view is that Article 86(3) is the weak joint: the right applies only to the extent it is not otherwise provided under Union law, so in a Dun & Bradstreet fact pattern the data protection route keeps doing the work.
86(3) does step back where other law already covers it, but the two rights are different. The data protection route needs the decision to be fully automated. Article 86 of the AI Act doesn't. A human can sign the refusal and the explanation is still owed. It has its own limit though. The person has to consider the decision hurt their health, safety, or rights, so it's a bit more narrow.
Agreed on the narrowing. One more edge in the same point: 5(b) excludes systems used to detect financial fraud, so a refusal generated by the fraud model sits outside Annex III and outside Article 86 entirely, while the scoring model next to it sits inside. My view is that this matters more in practice than the automation threshold, because the routing is an internal design choice and the applicant never sees which model answered.