Local authority · AI Act

Local Authority — AI Act: governing AI in local services

Local authorities are deploying AI in citizen-facing services and, in some cases, in the pre-assessment of benefit applications. The AI Act may classify certain such use cases as high-risk where they relate to access to services. This guide clarifies their classification, the FRIA, and applicable obligations.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Local authorities deploying AI for access to public services are concerned as deployers.
  • Qualify use cases.
  • Conducting an FRIA.
  • Supervise.
  • Up to €35M or 7% for prohibited practices and €15M or 3% for high risk.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act classifies as high-risk any AI assessing eligibility for essential public benefits and services. Local use cases involving user relations or information provision generally fall under limited risk.

Certain public deployers must carry out an FRIA for high-risk systems.

Is the 'Local Authority' sector affected?

Local authorities deploying AI for access to services are concerned as deployers. Informational chatbots fall under limited risk.

Developing a system under the local authority's brand would place it in the role of provider.

Detailed obligations

Qualify use cases

Distinguish access to services (high risk) from information access (limited risk).

Conduct a FRIA

Conduct the fundamental rights impact assessment for high-risk systems.

Supervise

Ensuring effective human oversight of decisions.

Ensure transparency

Informing users about AI usage.

Control biases

Monitoring data representativeness.

Sanctions & risks

Up to €35M or 7% for prohibited practices and €15M or 3% for high risk. A biased local credit-granting AI directly affects end users.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2High risk. From 2 August 2026 for access to benefits.

Common mistakes in the sector

  • 1High risk not identified. Treating a credit-granting AI as a simple chatbot.
  • 2FRIA omitted. Fail to analyse the impact on rights.
  • 3Absent transparency. Failing to inform users.
  • 4Uncontrolled biases. Create local discrimination.

Practical case

An inter-municipal authority deploys an AI system for pre-screening social welfare applications. As a high-risk use case, it conducts a FRIA, provides for human oversight of rejections and informs users, pooling expertise with other local authorities.

Compliance roadmap

  1. 1

    Inventory. Map local AI uses.

  2. 2

    Qualify. Isolate high risk.

  3. 3

    FRIA. Conduct the assessment for high risk.

  4. 4

    Frame. Oversight, transparency, bias.

  5. 5

    Pool resources. Sharing resources between local authorities.

Frequently asked questions

No, generally limited risk (transparency).

Back to the Local authority guideLocal authority & GDPR Local authority & NIS2

Take action on AI Act

Free assessment or a chat with an expert dedicated to local authority.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the local authority sector secured their compliance with DCO.

See testimonials