What “Explanation” Means to an Auditor
A researcher explaining a model wants a mechanism. A regulator wants something a specific person can act on: why this decision, about me, and what would have to change. Those are different artefacts, and the most common compliance mistake is producing the first when the obligation asks for the second. This page describes what the instruments say and how the requirement is shaped. It is not legal…
An auditor's explanation varies significantly from a researcher's perspective. For a researcher, the aim is to understand the model's computation, ideally in a way that makes it predictive of interventions. For a regulator, the focus is on a specific decision made about an individual, expressed in terms of the inputs that led to that decision.
The most common compliance mistake is providing what researchers deem an explanation, i.e., something like a circuit diagram or set of ablation results, when regulators require something entirely different. Regulators want plain language, the main factors that influenced the decision, and increasingly, information on what would have changed the outcome.
The General Data Protection Regulation (GDPR) doesn't explicitly grant a "right to explanation," but Article 22 and the subsequent recitals highlight the importance of providing meaningful information about the logic involved in automated decisions that have legal or similarly significant effects. This includes the data used, their relative importance, and the consequences of the decision.
More recently, the EU AI Act has further clarified this requirement. It mandates two separate explanations: one for the deployer and another for the individual affected by a decision made by a high-risk system. The deployer explanation focuses on the documentations and design aspects of the system, while the individual explanation seeks clear and meaningful explanations of how the system contributed to the decision and the main factors involved.
In practice, this means that organizations need to maintain a decision record for each instance, including the inputs used, the model and its version, the output, the threshold or rule applied, the timestamp of the decision, and any human review. Additionally, they must provide reasons for the decision in a controlled vocabulary, ranked and expressed in plain language.
In cases involving high-risk systems, providing counterfactual explanations can be an effective way to satisfy this requirement without disclosing the model itself.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
