European UnionAnti-Money-Laundering Regulation, Customer Rights on Decisions Resulting from Automated Processes and AI Systems (Article 76(5))
Regulation (EU) 2024/1624, Art. 76(5)
A data subject rights rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Data subject rights, Governance
As of .
What it requires
- This duty takes effect on (Article 90), except for the obliged entities referred to in Article 3, points (3)(n) and (o), football agents and professional football clubs, for which it takes effect on (Article 90).
- If you are an obliged entity and adopt decisions resulting from automated processes, including profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, or from processes involving AI systems as defined in Article 3, point (1), of the Artificial Intelligence Act, limit the data processed by those systems to data obtained pursuant to Chapter III of the Regulation (Article 76(5), point (a)).
- Subject any decision to enter or refuse to enter into or maintain a business relationship with a customer, or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20, to meaningful human intervention to ensure the accuracy and appropriateness of the decision (Article 76(5), point (b)).
- Let the customer obtain an explanation of the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).
- Let the customer challenge the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).
Who enforces it
Enforcement body
The supervisors, which Article 2(1), point (45), defines as the bodies entrusted with responsibilities aimed at ensuring compliance by obliged entities with the requirements of the Regulation, including the Anti-Money Laundering Authority (AMLA) when it performs the tasks entrusted to it in Article 5(2) of Regulation (EU) 2024/1620.
What this law does
Article 3 of Regulation (EU) 2024/1624 lists credit institutions and financial institutions among the obliged entities. Article 76(5) provides that obliged entities may adopt decisions resulting from automated processes, including profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, or from processes involving AI systems as defined in Article 3, point (1), of the Artificial Intelligence Act, provided that the conditions in points (a) to (c) are met.
The footnote to Article 76(5) identifies the Regulation it cites as the Regulation laying down harmonised rules on artificial intelligence, the Artificial Intelligence Act. Point (a) of Article 76(5) requires that the data processed by such systems is limited to data obtained pursuant to Chapter III of the Regulation.
Point (b) requires that any decision to enter or refuse to enter into or maintain a business relationship with a customer, or to carry out or refuse to carry out an occasional transaction for a customer, or to increase or decrease the extent of the customer due diligence measures applied pursuant to Article 20, is subject to meaningful human intervention to ensure the accuracy and appropriateness of such a decision.
Point (c) requires that the customer may obtain an explanation of the decision reached by the obliged entity, and may challenge that decision, except in relation to a report as referred to in Article 69. Article 90 provides that the Regulation applies from , except in relation to the obliged entities referred to in Article 3, points (3)(n) and (o), to which it applies from .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or provides financial services.