AI Governance Institute
← AI Governance Playbook

Question 14 of 53

What is our explainability standard for AI decisions?

By Cody Maxwell · AI Governance Institute · February 2026 · Updated September 2026

Match transparency requirements to system risk. Build the technical tools and review procedures needed to meet them.

If you only do 3 things, do this:

  1. 1.Define your explainability standard by risk tier before deployment. You can't retrofit explainability into a production model at the scale needed for regulatory or legal response.
  2. 2.For models that work from tables of data (such as credit or claims data), standard tools like SHAP and LIME can explain individual decisions after the fact. For the highest-risk applications, consider a simpler model whose reasoning can be read directly instead.
  3. 3.Build explanation delivery into your decision workflow now. GDPR Article 22 and the US Fair Credit Reporting Act (FCRA) both require that individuals receive meaningful explanations for automated decisions.

The Situation

Who this is for: Data science, legal, and compliance teams designing or auditing AI decision systems

When you need this: When choosing what type of model to use, designing the decision workflow, or preparing for regulatory examination

The Decision

What level of explainability is required for each AI system, and do we have the technical and procedural infrastructure to deliver it?

The Steps

  1. 1Apply your risk-tier framework to determine the required explainability level for each system
  2. 2For high-risk systems, evaluate whether a model whose reasoning can be read directly is feasible, rather than explaining a complex model after the fact
  3. 3For systems that need after-the-fact explanations, have your data science team use a tool such as SHAP or LIME, and check that the explanations accurately reflect how the model behaves
  4. 4Design the explanation delivery mechanism for each audience: customers, regulators, internal reviewers
  5. 5Build explanation generation into the decision workflow, not as a separate process run on demand
  6. 6Test explanation delivery against GDPR Article 22 and FCRA adverse action requirements as applicable

The Artifacts

  • —Explainability requirements matrix (system × risk tier × required explanation type)
  • —Guide to generating explanations (for example with SHAP or LIME) for the models you use
  • —Customer-facing explanation template (plain language, adverse action format)
  • —Regulator/auditor explanation documentation template
  • —Explainability validation checklist (are explanations accurate representations of model reasoning?)
Open the implementation kit

The Output

A documented explainability approach for every AI system, with explanation delivery mechanisms built into workflows and validated against applicable legal requirements.

Explainability is not one-size-fits-all

The appropriate level of explainability depends on the stakes of the decision, the regulatory requirements that apply, and the audience who needs the explanation. A data scientist debugging model behavior needs a different kind of explanation than a customer asking why their application was denied. Both needs are legitimate and require different technical and procedural approaches.

Build your explainability standard around a risk-tiered framework. For minimal-risk systems, basic documentation of the model's purpose and general behavior may be sufficient. For limited-risk systems, transparency about the fact that AI is being used and its general logic is typically required. For high-risk systems, full technical documentation, audit logs, and the ability to provide individual-level explanations are necessary.

Technical approaches to explainability

When a model's reasoning has to be explained after the fact, SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) are the most widely used techniques. Both show which inputs, such as income or payment history, most influenced a specific decision. They work with most types of model but have limits. For very complex models, the explanation is an approximation and may not accurately reflect how the model actually reached its answer.

For the highest-risk applications, consider whether a simpler model whose reasoning can be read directly would do the job. Scorecard-style statistical models, decision trees (a series of yes/no rules), and rule-based systems can all be explained by showing how they work. For data held in tables, the accuracy gap between these and more complex models has narrowed. The legal and operational benefits of a model you can explain can outweigh a small loss in accuracy.

Delivering explanations to affected individuals

GDPR Article 22 and the Fair Credit Reporting Act (FCRA) both require that individuals who are subject to automated decisions receive meaningful explanations. "Meaningful" has not been precisely defined by courts or regulators, but the emerging standard is that the explanation must be specific enough for the individual to understand and potentially contest the decision.

Build explanation delivery into your decision workflow, not as an afterthought. For credit decisions, this means FCRA-compliant adverse action notices that identify the principal reasons for the decision in plain language. For employment decisions, it means documentation that can be provided if a candidate requests an explanation. For customer decisions, it means a customer service process that can retrieve and communicate the relevant information.

Turn this guidance into an implementation plan

Get the free Excel tracker for all 132 governance controls. Score maturity, assign owners, and set deadlines, including this playbook's 3 related controls.

  • 132 controls in Excel
  • Score maturity and assign owners
  • Track deadlines and regulation coverage

Includes AI Governance Weekly every Thursday. Unsubscribe anytime.

Related frameworks

GDPR Applicability to AI SystemsEU AI ActNIST AI RMFISO 42001:2023