EU AI Act for the public sector
Public bodies are deployers far more often than providers, and the deployer obligations that attach to them are heavier than anything a commercial deployer carries. Three of them, the FRIA, deployer registration and public visibility, have no private-sector equivalent.
What is in scope, and what is not
| Detail | |
|---|---|
| Points that most often apply | 5(a) eligibility for essential public assistance benefits and services including healthcare, and granting reducing revoking or reclaiming them; 6 law enforcement; 7 migration, asylum and border control; 8 administration of justice and democratic processes; 3 education where the body operates institutions |
| ‘On behalf of’ matters | Point 5(a) reaches private contractors evaluating eligibility on behalf of a public authority. Outsourcing the delivery does not outsource the classification |
| Article 111 legacy transition | AI systems already placed on the market or put into service by public authorities before the relevant date get an extended transition to 2 August 2030, subject to conditions |
Expert analysis. Classification turns on the intended purpose of each system. This is our reading of common deployments, not an authoritative classification.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Registration makes the deployment public
Under Article 49, deployers that are public authorities, Union institutions bodies offices or agencies, or persons acting on their behalf, must register themselves, select the system, and register its use. That is in addition to the provider’s registration.
The Article 71 database is largely public. Consequences that a commercial deployer never faces:
- Journalists and civil society can enumerate public-sector AI deployments by authority and by system.
- The registered intended purpose can be compared against what the authority has said publicly about the system. Divergence is a story and evidence.
- The Article 27 FRIA results are notified to the market surveillance authority, creating a second record.
Practical recommendation. Write the registration entry, the FRIA and the public communications together. They will be read together.
What else applies
- Article 27 FRIA is mandatory for bodies governed by public law and for private entities providing public services. Before first use, with results notified to the market surveillance authority.
- Law Enforcement Directive (EU) 2016/680, not the GDPR, governs personal data processing by competent authorities for law enforcement purposes.
- Administrative law and duty to give reasons. National rules on how administrative decisions are made and explained constrain these deployments independently, and often more tightly than the AI Act.
- Public procurement. Buying compliant AI is easier than remediating it. Article 6(4) assessments, Annex IV inputs, declared accuracy metrics and log-control terms belong in the tender, not in a later variation.
What applies before December 2027
Article 50 applies now to citizen-facing chatbots and AI-generated correspondence. Article 4 literacy applies across the authority. Article 49 registration has applied since 2 August 2026.
The deferral in Regulation (EU) 2026/1744 covers Chapter III Sections 1 to 3. It does not cover Article 5, Article 4, Chapter V general-purpose AI, Article 49 registration or Article 50 transparency. Full timeline →
Status labels on this page
Verified fact: The Annex III points, article references and dates cited above, checked against the consolidated Regulation and the Commission's AI Act Service Desk.
Expert analysis: The in-scope/out-of-scope allocation, the sector edge case, and the parallel-regulation reading.
Unsettled: Harmonised standards remain in development and the Commission's Annex III guidelines are in draft. Sector supervisory practice has not yet formed.
Procurement is where this gets decided
The cheapest point to secure Annex IV inputs, declared metrics, log-control terms and modification restrictions is the tender document. After award, they are a negotiation.
Classify before you build
Twelve questions mapping your system against Articles 5, 6, 50 and Annex III. No email required.
Frequently asked
What extra obligations do public authorities have under the EU AI Act?
Deployers that are bodies governed by public law, or private entities providing public services, owe an Article 27 fundamental rights impact assessment before first use and must notify the market surveillance authority of the results. Under Article 49 they must also register themselves, select the system and register its use in the EU database, in addition to the provider's registration. The Article 71 database is largely public.
Does the EU AI Act apply to AI already used by government?
Article 111 provides an extended transition for AI systems already placed on the market or put into service by public authorities before the relevant date, running to 2 August 2030, subject to conditions. Systems newly deployed are not covered by that transition.
Does outsourcing public services avoid the AI Act?
No. Annex III point 5(a) covers AI systems intended to be used by public authorities or on behalf of public authorities to evaluate eligibility for essential public assistance benefits and services. Article 27 likewise applies to private entities providing public services. Contracting out the delivery does not change the classification.