Article 86 of the EU AI Act grants affected persons the right to explanation of individual decision-making made by high-risk AI systems. When a high-risk AI system outputs a decision that produces legal effects or similarly significantly affects a person's health, safety, or fundamental rights, that person has the right to obtain:
This right intersects with GDPR Article 22(3) (right to obtain human intervention, express one's point of view, and contest the decision) and Article 15 (right of access, including the logic of automated processing). DEFONEOS implements this through a structured, multi-tier explanation framework backed by the SIGIL chain's immutable audit trail.
The decision is expressed in plain English at a reading age of 12. No technical terms. No acronyms. Example: "Your application for housing priority was ranked below 14 other households because your current accommodation meets the statutory minimum standard and your household size places you in Band C."
The specific factors that influenced the decision are listed with their individual contribution weights. Each factor is traceable to the source data and the governance rule that authorised its use. Example: "Factor: Household size (weight: 0.23). Source: Housing register entry dated 12 Jun 2026. Governance: Housing Allocation Policy ยง4.2."
A step-by-step trace showing how the factors combined to produce the output. This includes the model's reasoning path, any human override points, and the BFT council vote if one was held. Each step carries a SIGIL hash for tamper-evidence.
What would have needed to be different for the decision to go the other way? This is generated automatically from the model's decision boundary analysis. Example: "If your household included a dependent under 16 with a registered medical need (Band A factor), your application would have been ranked in the top 5."
Complete SIGIL chain entry with Ed25519 signature, model version, training data provenance, inference timestamp, all factor weights, confidence score, calibration metric, BFT vote tally, and human review logs. Available to regulators, independent auditors, and the data subject's legal representative on request.
| Step | Action | SLA | Responsible |
|---|---|---|---|
| 1 | Request โ Affected person submits explanation/redress request through the DEFONEOS portal, in writing or verbally (phone/in-person, transcribed by agent) | Immediate | Defoneos Agent / DPO |
| 2 | Acknowledge โ System confirms receipt, assigns case ID, and provides the Tier 1-2 explanation automatically within 72 hours | 72h | Automated |
| 3 | Review โ A qualified human reviewer examines the decision, the model output, and the affected person's submissions. The reviewer must NOT be the person who made or approved the original decision. | 14d | Human Reviewer (SC-cleared) |
| 4 | Explanation โ Full Tier 1-4 explanation delivered to the affected person, including counterfactual. Technical Tier 5 available on request. | 21d | DPO / Reviewer |
| 5 | Remedy Options โ If the decision is found to be flawed, biased, or not properly explainable, the reviewer can: (a) reverse the decision, (b) request a new decision with corrected data, (c) escalate to BFT council, (d) refer to human appeal tribunal. | 21d | Reviewer + DPO |
| 6 | BFT Escalation โ For decisions with significant legal effects, a 12-of-33 quorum BFT council reviews the case. The council includes the independent reviewer agent (Aegis), the DPO agent, and the care-validation agent. Red line violations are auto-flagged. | 30d | BFT Council (quorum 12/33) |
| 7 | External Referral โ If internal redress is exhausted, the affected person is informed of their right to: ICO complaint (GDPR), judicial review, Parliamentary and Health Service Ombudsman, or the EU AI Office (for AI Act breaches). All evidence from the SIGIL chain is exportable. | As needed | DPO |
| Level | Trigger | Response | Timeline |
|---|---|---|---|
| L1 โ Standard | Affected person requests explanation within 30 days of decision | Tier 1-2 auto-generated, Tier 3-4 within 14 days | 14d |
| L2 โ Expedited | Decision affects housing, benefits, liberty, child welfare, or medical triage | All tiers within 72 hours, human reviewer assigned immediately | 72h |
| L3 โ Critical | Potential red line violation, safeguarding concern, or ICO complaint filed | BFT emergency council (quorum 12/33), DPO personally notified, decision suspended pending review | 24h |
| Requirement | Status | How DEFONEOS Implements |
|---|---|---|
| Right to obtain clear and meaningful explanation | โ MET | Tier 1-2 plain language auto-generated from decision factors |
| Main elements of the decision logic | โ MET | Tier 2-3 factor breakdown with governance provenance |
| Rationale for the specific decision | โ MET | Tier 4 counterfactual + Tier 3 logic trace |
| Right to contest / redress | โ ๏ธ PARTIAL | 7-step process designed. Not yet tested with live data subjects. External referral pathway documented. |
| Human review of decisions | โ MET | Step 3 requires independent SC-cleared human reviewer |
| Audit trail for regulators | โ MET | Tier 5 SIGIL chain with Ed25519 signatures, exportable to ICO/EU AI Office |
| Timely response | โ MET | 72h SLA for L2 expedited, 14d standard, 30d maximum |
| Accessible to vulnerable persons | โ ๏ธ PARTIAL | Plain language tier designed. Layperson UX testing not yet conducted. No non-English language support yet. |
| Framework | Article | Requirement | DEFONEOS Mapping |
|---|---|---|---|
| EU AI Act | Art 86 | Right to explanation of individual decision | 5-tier explanation framework |
| GDPR | Art 22(3) | Human intervention, express point of view, contest | 7-step redress process steps 3-7 |
| GDPR | Art 15(1)(h) | Right of access to logic of automated processing | Tier 3 logic trace + Tier 5 full audit |
| GDPR | Art 13(2)(f) | Information about automated decision-making | Pre-decision privacy notice |
| ECHR | Art 6 | Right to a fair trial / due process | Step 7 external referral to tribunal |
| ECHR | Art 8 | Right to respect for private and family life | Sovereign storage, no foreign transfers |
| UK DPA 2018 | Schedule 1 Part 2 ยง10 | Safeguards for automated decision-making | Full Art 86 + GDPR Art 22 implementation |
| HRA 1998 | S.3 | Interpretation compatible with Convention rights | External referral pathway to courts |
| ICO Guidance | Automated DM | Meaningful information about the logic | Tier 2-4 explanations with plain language |
| EU AI Act | Art 27 FRIA | Fundamental rights impact assessment | Explanation framework is FRIA output |
Every DEFONEOS decision is logged to the SIGIL chain with the following fields, enabling instant explanation generation:
decision_id โ Unique Ed25519-signed hashmodel_version โ Exact model checkpoint and training data provenancefactors โ Dict of {factor_name: {value, weight, source, governance_rule}}threshold โ Decision boundary thresholdconfidence โ Calibration score (Brier score โค 0.15)bft_vote โ Council vote tally (if triggered) with per-voter rationalehuman_reviewer โ Identity of reviewer (if triggered) and decisionred_line_check โ 7 red lines checked, all must be CLEARsigil_hash โ Hash-chained to previous entry, tamper-evidentThe explanation framework described here is the designed system. DEFONEOS has not been deployed in a live public-service context where affected persons have exercised their Article 86 right through this system. The 72h/14d/30d SLAs are design targets, not measured performance. The counterfactual generation algorithm is implemented as a prototype but has not been validated against the EU AI Office's forthcoming guidance on "meaningful explanations." The BFT council escalation (Step 6) is functional in the sovereign substrate but has not been tested with a live redress case. The "plain language at reading age 12" claim is a design specification, not a tested outcome โ layperson UX testing is a documented human gate. No DPO has been formally designated for DEFONEOS under GDPR Art 37.