Worked example: the letter that says your application was unsuccessful

A person applies for a product and is declined. The letter is polite, gives no reason, and offers a phone number. Nothing in it says a model was involved. This example runs the situation from both sides, because the same facts are a rights question for one party and a design question for the other.

From the applicant's side

The first thing to establish is whether the decision was automated, and the applicant is entitled to know that without having to guess. Under Article 21 of the revised FADP, the controller must inform the data subject that a decision is automated where it is based exclusively on automated processing and has a legal consequence or significant effect. A decline on a financial product is the paradigm case of a significant effect.

So the first request is not "why was I declined". It is: was this decision taken exclusively by automated means, and if so, what were you required to tell me?

If the answer is yes, three things follow. The applicant may state their point of view, which is the moment to supply the context the pipeline never saw: the income that is irregular but adequate, the address history that looks unstable and was a secondment. The applicant may request review by a natural person. And under Article 25(2) the right of access extends to information about the logic of the decision.

Article 25(2) is the one that gets resisted. It is worth being precise about what it is not: it is not the model, it is not the source code, and it is not the training data. It is an account of the logic, meaning which factors drove the outcome and in what direction, at a level a person can understand and dispute. "A proprietary algorithm was used" is not that account.

From the organisation's side

Now read the same letter as the firm that sent it. Four defects.

It does not say the decision was automated. If it was, the information duty has been missed, and in the Swiss regime that is a duty whose wilful breach carries a fine on a responsible natural person of up to CHF 250,000.

The phone number goes to a contact centre with no route. The duty to allow a position to be stated requires a place for that position to arrive and a process that does something with it. A line that can only repeat the outcome satisfies nothing.

Nobody has defined what human review means here. If the reviewer sees the same score, has no authority to depart from it, and has three minutes, then review is a formality and the original decision remains exclusively automated. The honest test is whether reviewers ever reach a different answer and what happens when they do.

Nothing in the file states the logic. If the organisation cannot reconstruct which factors drove this decision, it cannot answer an Article 25(2) request at all, and that is not a legal problem to be solved when it arises. It is a system design problem that had to be solved before the system was switched on.

What the AI Act adds

If the system falls within Annex III, Article 26(11) requires the deployer to inform natural persons that they are subject to the use of a high-risk AI system where it is used to make or assist in making decisions relating to them. Note "assist": the duty does not wait for full automation. Article 26(9) requires the deployer to use the Article 13 information from the provider to carry out a GDPR impact assessment where one is required, which is the practical link between the two regimes.

What good looks like

The decline letter states that the decision was made using automated processing. It names the main factors that drove it. It gives a specific route to provide further context and a commitment about what happens then. It states the right to request review by a person, and names the team that performs it. It does all of this in the letter, because a right the person has to discover is a right most people never use, and the duty to inform exists precisely so that they do not have to discover it.

As of 24 September 2026.