The deadline that moved and the right that did not
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and pushed the high-risk obligations in Chapter III, Sections 1 to 3 of the EU AI Act to 2 December 2027 for Annex III systems and 2 August 2028 for AI inside regulated products. Most compliance plans were rewritten around those dates. Something quieter happened at the same time. Section 4 of Chapter IX, the remedies, was left untouched and has applied since 2 August 2026. Treating the AI Act as dormant until late 2027 means reading half of the amended Article 113.
What does Article 85 let people do?
Article 85 of Regulation (EU) 2024/1689 lets any natural or legal person with grounds to consider that the Regulation has been infringed complain to the relevant market surveillance authority. There is no requirement to be personally affected, no standing test and no restriction to high-risk systems. A customer, a competitor, a union representative or a journalist can all lodge one.
The authority must take the complaint into account when conducting market surveillance and handle it under the procedures in Regulation (EU) 2019/1020. That is a duty to consider, not a duty to open a file, but a documented complaint sitting with a regulator is still a very different exposure from no complaint at all.
Which infringements can someone complain about today?
Only the ones already in force, and there are more of them than most AI inventories assume. The Article 5 prohibitions have applied since 2 February 2025 and the general-purpose AI model obligations in Chapter V since 2 August 2025. The Article 50 transparency duties have applied since 2 August 2026, covering chatbot disclosure, marking of synthetic content, deepfake labelling and notice to people exposed to emotion recognition. Article 4 on AI literacy applies too. That is where live complaints will come from.
What does Article 86 require of a deployer?
Article 86 gives an affected person the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken. It applies where the decision rests on output from a high-risk system listed in Annex III, other than point 2, and produces legal effects or similarly significantly affects that person adversely for their health, safety or fundamental rights. Article 86(3) makes it subsidiary to any equivalent right under Union law.
Our reading of the timing problem
Article 86 was not deferred, but everything that triggers it sits in Chapter III, Section 1, which waits until 2 December 2027. This is the same structural gap we identified in the registration duty under Article 49. An obligation with no operative trigger is hard to perform, so we would not expect Article 86 to bite on its own terms before December 2027.
We would not advise a deployer to rely on that. Article 85 carries no such dependency, and where a decision involves personal data, Articles 13(2)(f), 14(2)(g) and 15(1)(h) of Regulation (EU) 2016/679 already require meaningful information about the logic involved. In Case C-203/22, CK v Dun & Bradstreet Austria, decided on 27 February 2025, the Court of Justice held that a trade secret is not a blanket answer.
Praktiskt exempel
A Gothenburg logistics group runs three AI tools: one that ranks warehouse applicants, a chatbot on its careers page, and a generative tool that drafts rejection letters. The ranking tool falls in point 4 of Annex III, so the group treats it as a December 2027 project, and it is right about that.
A rejected applicant asks why she was screened out. She also notices that the chatbot never said it was a machine and that her rejection letter reads as though a person wrote it. The Article 86 question is arguable. The Article 50 points are not, and she can take them to Post- och telestyrelsen under Article 85 tomorrow.
Vanliga misstag som företag gör
The first is treating 2 December 2027 as the date the AI Act starts working. Complaints, explanation requests and protected whistleblower reports all became available on 2 August 2026.
The second is overlooking Article 87, which applies Directive (EU) 2019/1937 to reports of AI Act infringements. In Sweden that runs through lagen (2021:890) om skydd för personer som rapporterar om missförhållanden, so an employee raising an AI Act concern is protected against retaliation.
The third is assuming a complaint is harmless because Sweden has not yet legislated the penalties Article 99 requires. The five authorities designated in June 2026 can investigate, request information and correspond with you, and none of that needs a sanktionsavgift to be expensive.
The fourth is answering an explanation request with the vendor’s marketing material. If you cannot say what the system contributed to a decision, you probably cannot demonstrate human oversight either.
Rekommenderade åtgärder
Decide now who receives an Article 85 notification or an Article 86 request, and give that person a route to someone who can answer in days rather than weeks. Write a short standing explanation for every AI system that touches decisions about people, covering what the system contributes, what a human contributes and which factors carry weight.
Ask providers in writing, and preferably in the contract, for what you would need to answer an affected person, since Article 13 obliges them to supply instructions for use that make your own duties possible. Check your Article 50 disclosures first, because that is where a complaint is most likely to land, and name the AI Act in your whistleblowing policy.
Vanliga frågor
Do we have to answer an Article 86 request today?
Article 86 was not deferred, but the Annex III classification it depends on applies from 2 December 2027, so the position is contested. Where the decision involves personal data, Article 15(1)(h) of the GDPR usually requires a substantive answer anyway, so a flat refusal is rarely wise.
Can a competitor complain about our AI system?
Yes. Article 85 lets any natural or legal person with grounds to consider there has been an infringement complain, so standing is not limited to people the system affects. Competitor complaints are an ordinary feature of market surveillance under Regulation (EU) 2019/1020.
What happens to a complaint in Sweden right now?
It reaches whichever of the five authorities designated in June 2026 holds that part of the Act, most often Post- och telestyrelsen or Integritetsskyddsmyndigheten. Their assignment runs to 31 December 2026, and Sweden has not yet enacted the penalty rules Article 99 requires.
Slutsats
The Digital Omnibus bought time on the obligations that cost most to build and none at all on the ones that let people push back. Since 2 August 2026 anyone can complain about your AI system, an affected person can ask a deployer to explain a decision, and an employee who reports a breach is protected by whistleblower law. At Lawgent, we help companies work out which AI Act obligations are already live, prepare explanations before anyone asks for one, and handle complaints and regulator contact when they arrive. Get in touch if you would like us to look at where your business is exposed today.
