GDPR gives no standalone "right to explanation", but it comes close. Where an AI agent makes a solely automated decision with significant effects, people are owed meaningful information about the logic involved, the significance and the likely consequences, plus the right to human intervention and to contest. You produce that from the agent's decision record, not from the model.
What does GDPR actually require?
The duty is spread across several provisions, and it helps to see them together.
- Before or at collection, the privacy information must tell people that automated decision-making, including profiling, exists, and give meaningful information about the logic involved and its significance and envisaged consequences.
- On request, the right of access entitles a person to the same information, applied to processing about them.
- For decisions caught by Article 22, the controller must provide safeguards: at least the right to obtain human intervention, to express their point of view and to contest the decision. GDPR's recitals add that a person should be able to obtain an explanation of the decision reached after such an assessment.
- Throughout, Article 5 requires processing to be fair and transparent, which means information must be clear and in plain language.
What is not required is disclosure of source code, model weights or trade secrets. What is required is enough for the person to understand why the outcome happened and to challenge it.
Who does it apply to?
The controller, which is the firm deploying the agent. The UK applies the same transparency and access duties, though its automated decision-making rules have been amended; see UK GDPR vs EU GDPR for AI agents. The general transparency duty applies to all processing; the decision-specific information applies where Article 22 is engaged, and it is good practice well beyond that.
What changes when the decision is made by an agent?
A traditional scoring model has fixed inputs and a fixed formula, so the explanation is a description of the formula. An agent is different in three ways, and each changes how you explain.
The inputs vary by case. An agent retrieves the data it thinks it needs. Two customers with the same outcome may have been assessed on different documents. The explanation must say which facts this agent actually used for this person, and where those facts came from.
The reasoning is in language. A model's internal process cannot be audited line by line. Its narrative of why it acted is useful, but it is not a reliable account of cause. Base the explanation on what can be verified: the facts retrieved, the criteria in the agent's brief, the limits that applied and who signed off.
The decision may be a refusal by the system, not the agent. Sometimes an agent would have approved, but a limit set by the firm blocked it. The person deserves to know the real reason, which was a policy limit, not an assessment of them.
That is why getting the right data to the agent at the right time matters for explanation as well as accuracy. If you cannot reconstruct what the agent saw, you cannot explain what it did.
How do you produce an explanation?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Tell people automated decisions exist | Privacy notice names the decisions agents make and their effect | Notice versions |
| Meaningful information about the logic | Plain-language description of the criteria in each decision capability, maintained with the brief | Logic statements per capability |
| Significance and consequences | Description of what each outcome means for the person and what they can do next | Decision letter templates |
| Explanation of an individual decision | Per-decision record: facts used with their source, criteria applied, limits that applied, reviewer | Decision record retrievable by case |
| Human intervention | Route to a named person who can change the outcome | Request and outcome log |
| Express a view and contest | Response channel stated in every decision communication | Contest log; outcomes |
| Answer access requests | Search across agent records, memory and logs for the person | Completed request files |
A useful individual explanation has four parts: what we decided, the main facts we relied on and where they came from, the rule or threshold those facts met or missed, and how to challenge it. For example: "We could not increase your limit. Our records show two missed payments in the last six months on this account. Our policy requires none. If this is wrong, reply to this message and a member of the team will review it."
Simple retrieval does not need this machinery. An agent that tells a customer their balance is reporting a fact, as our piece on whether an AI agent can tell a customer their balance explains. The duty bites when the agent evaluates or decides.
What will a supervisor or auditor ask?
- Which agent decisions does your privacy information describe, and is the description accurate for how the agents behave now?
- Pick a decision from last month: can you show what facts the agent used and why the outcome followed?
- How quickly can a person reach someone who can change the outcome?
- How often do challenges succeed, and what do you change when they do?
- Who checks that explanations are understandable to the people receiving them?
The UK regulator has published detailed guidance on this; our article on the ICO and explaining AI agent decisions to people covers what it expects.
What does the right not cover?
It does not entitle people to the model, the code or other customers' data. It does not require a human to make every decision. It does not apply to decisions about companies. It does not guarantee a different outcome on challenge, only a genuine reconsideration. For the other rules that reach agents' decisions, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, every fact reaching an agent carries its provenance, and every verdict names the bound that decided it: role scope, certificate, sources, the customer's own limits or the platform guardrails. Verdicts are filed in an append-only record. That gives you the raw material for an individual explanation, including the case where your own limit, not the agent's assessment, produced the outcome.
Questions people ask
Is the agent's own reasoning text a valid explanation?
It is a useful input but a weak foundation. The reasoning a model writes may not reflect what actually drove the output. Build explanations on verifiable facts, criteria and limits, and use the narrative only where it is consistent with them.
Do we have to explain decisions a person made with an agent's help?
Article 22 safeguards apply only to solely automated decisions. General transparency and access rights still apply, and regulators expect firms to explain outcomes people care about however they were reached.
How detailed should the logic statement in a privacy notice be?
Enough to tell someone which kinds of information count, roughly how they affect the outcome, and what follows. A paragraph per decision type is usually right; a list of every variable is not.