Explanation is not justification

This is the distinction that most often goes wrong, and it goes wrong in a way that is very hard to see, because the failure mode produces text that reads better than a true explanation would.

An explanation is a claim about causation: this output happened because of that. A justification is a claim about reasonableness: this output was defensible. The first can be checked against the system. The second is an argument.

Where large language models make this acute

Module 1 walked through an insurer feeding claim narratives to a commercial large language model with a prompt asking for a recommendation and a one-paragraph justification. The mechanism is worth stating again, precisely, because almost every generative deployment has this shape.

The justification paragraph is produced by the same process that produced the recommendation. It is text generated alongside the answer, not a report from some separate faculty that observed the answer being formed. It reads as a reason. It is not the reason.

Two consequences follow, and both are practical rather than philosophical.

The justification can be fluent and wrong at the same time. Nothing in the process constrains the stated reasoning to match whatever produced the answer. A model can give the right recommendation for stated reasons that had nothing to do with it, and it can give the wrong recommendation with a paragraph so orderly that a reviewer stops reading.

Showing it to a customer as the reason is a misrepresentation. If your organisation tells a person that their claim was declined because of the three points in that paragraph, and the paragraph was generated rather than derived, then the organisation has stated something about its own decision process that it cannot support. That is a problem before it is a compliance problem, and it becomes a compliance problem the moment the right of access under Article 25(2) revFADP is exercised and the answer has to describe the logic of the decision.

The same trap in non-generative systems

Do not file this as a generative-AI quirk. A post-hoc attribution method applied to a classifier is also a second process producing a story about the first. It is usually a more disciplined story, and it is still an approximation with error bars that are rarely reported alongside it. When a team says "the model told us why", ask what produced that sentence.

How to hold the line

Three rules, all cheap.

• Label generated rationale as generated. Internally and externally. If it goes to a person outside the organisation and the system produces synthetic text, the Article 50 transparency duties are also in play; Article 50(1) requires people to be told they are interacting with an AI system unless it is obvious, and those duties have applied since 2 August 2026.
• Keep the decision record separate from the generated text. The record says what inputs were present, what the system output, which policy rule the human applied, and who decided. That is reconstructible. The paragraph is not.
• Never let generated rationale be the only thing standing between a decision and a person. If the organisation cannot state a reason without the model's help, it has not made a decision it can defend.

Where this collides with automated decision rights

Article 21 revFADP concerns decisions based exclusively on automated processing with a legal consequence or a significant effect. It requires the controller to inform the data subject that the decision is automated, to allow them on request to state their position, and to allow them to request review by a natural person. The right to state a position is only meaningful if the person is told something they can respond to. A generated justification gives them something to respond to that may not be true, which is worse than telling them less.

Note also that these duties do not depend on AI being involved. A rules engine that declines with no human review is squarely within Article 21. Penalties under the revised Act fall on responsible natural persons, with fines up to CHF 250,000 for wilful breaches including the Article 21 information duty.

As of 24 September 2026.