New EU Law Lets Citizens Demand Explanations When AI Denies Credit, Jobs or Benefits

A bank rejects a loan application, an employer skips a candidate after automated CV screening, or an agency denies a benefit following a points-based system assessment. If an artificial intelligence system was behind such a decision, the EU's AI Act gives the affected person concrete legal tools to demand an explanation and, if necessary, file a complaint.

What the right to an explanation covers

Article 86 of the AI Act applies to situations where an automated system classified as high-risk plays a role in a decision affecting a specific individual. This covers, among other things, creditworthiness assessments, recruitment and workforce management, access to public benefits, and insurance risk assessment. Systems related to critical infrastructure are excluded.

The explanation a person can request must address the role the AI system played in the decision-making process and the main factors that led to the specific outcome. The provision doesn't require a company or institution to disclose source code or model weights, but it is meant to give people genuine insight into the logic behind a decision, rather than a vague statement that "the system decided so."

How to file a complaint

Article 85 of the AI Act gives any natural or legal person with grounds to believe the regulation has been breached the right to complain to a market surveillance authority. In practice, this means you don't need to be formally harmed yourself - a reasonable suspicion that an AI system is malfunctioning is enough.

A complaint should include a description of the incident, identification of the system or service and the responsible entity, the date of the incident, the content of the decision received, and the reason for suspecting a violation. It's advisable to keep screenshots, messages, terms of service, case numbers, app versions, and the content of any earlier requests for explanation.

It also helps to note whether the outcome changed after modifying a single detail in the application, whether people in similar situations received different decisions, whether the system operated fully autonomously or a staff member contacted the applicant, and whether there was an option to submit additional data, appeal, or obtain a justification.

Who will handle complaints in Poland

In Poland, the role of national market surveillance authority and single point of contact for AI matters will be filled by the Commission for the Development and Security of Artificial Intelligence. President Karol Nawrocki signed the law establishing KRiBSI on July 24, 2026, concluding a years-long legislative process to implement the EU's AI Act into Polish law.

According to statements from Deputy Digital Affairs Minister Dariusz Standerski, the commission's chair should be appointed within two months of the law taking effect, with the full body in place within three months - meaning KRiBSI is realistically set to begin work in November 2026. Until then, existing institutions and procedures continue to support affected individuals.

What to do until November

Until KRiBSI is operational, a complaint about an AI system does not replace a standard complaint to the service provider, an appeal against an administrative decision, a complaint to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Poland's data protection authority), or a damages claim. People affected by an automated decision can already invoke Article 22 of the GDPR, which grants the right not to be subject to a decision based solely on automated processing, as well as sector-specific procedures in banking, insurance, or social assistance.

For Polish companies using AI systems in decision-making processes, this means preparing procedures for providing explanations even before KRiBSI launches - a customer or job candidate who asks about the algorithm's role in a rejection will have an increasingly solid legal basis to demand a specific answer rather than a generic response.