Public sector — AI Act: AI for access to services

What does the AI Act cover?

Annex III of the AI Act targets AI systems intended to assess eligibility for, and to grant, reduce or withdraw essential public benefits and services, as well as several sovereign use cases. These systems are subject to high-risk obligations.

Certain deployers, including public bodies, must also carry out a Fundamental Rights Impact Assessment (FRIA).

Is the 'Public sector' concerned?

Administrations deploying AI for processing applications or granting benefits are concerned as deployers, and as providers if they develop the system.

Informational or internal uses fall under lighter regulatory regimes.

Detailed obligations

Sanctions & risks

Up to €35M or 7% for prohibited practices and €15M or 3% for high-risk infringements. A biased credit-scoring AI can create systemic discrimination.

Application timeline

• 1Entry into force. 1 August 2024.
• 2High risk. From 2 August 2026 for essential public services.

Common mistakes in the sector

• 1High risk not identified. Treating a credit-granting AI as an internal tool.
• 2FRIA omitted. Fail to analyse the impact on rights.
• 3Uncontrolled biases. Creating systemic discrimination.
• 4Superficial oversight. Human oversight without real means.

Practical case

A public authority automates the pre-calculation of a social benefit. As a high-risk system, it requires a FRIA, human oversight of rejections, transparency towards users and bias monitoring, all articulated with the GDPR DPIA.

Compliance roadmap

1. 1

   Inventory. Mapping AI systems used for assessment and approval.

2. 2

   Qualify. Isolate high risk.

3. 3

   FRIA/DPIA. Carry out impact assessments.

4. 4

   Frame. Oversight, transparency, bias management.

5. 5

   Monitor. Post-market monitoring and reassessment.

Frequently asked questions