EU AI Act for the Public Sector: High-Risk Rules for Government AI
Public bodies use AI to assess benefit eligibility, allocate resources, support policing and process migration cases — decisions that directly affect people's rights. The EU AI Act (Regulation (EU) 2024/1689) places much of this squarely in the high-risk tier under Annex III, and adds a duty unique to public authorities: the fundamental-rights impact assessment. Several public-sector uses are also outright prohibited under Art. 5.
Is it in scope?
Multiple Annex III headings reach government AI: access to essential public benefits and services (III(5)(a)), law enforcement (III(6)), migration, asylum and border control (III(7)), and administration of justice (III(8)). Deploying a high-risk system in the public sector triggers Art. 27, requiring a fundamental rights impact assessment (FRIA) before use, plus registration in the EU database. The Act also prohibits certain public uses under Art. 5 — notably social scoring by public authorities and most real-time remote biometric identification in public spaces — in force since 2 February 2025.
Typical AI use cases
- Automated benefit and welfare eligibility assessment
- Fraud and error detection in public programmes
- Predictive and investigative policing support
- Migration, visa and asylum case processing
- Justice and case-management decision support
Risk classification
Most substantive government AI is high-risk, and public bodies are usually deployers under Art. 26. On top of the standard deployer duties they must complete a fundamental rights impact assessment under Art. 27 before putting a high-risk system into use, and register the deployment. Some intended uses are barred entirely: Art. 5 prohibits public-authority social scoring and, subject to narrow exceptions, real-time remote biometric identification. Careful classification is essential because the line between a permitted high-risk deployment and a prohibited practice is legally decisive.
Obligations to prepare for
Your exact duties also depend on whether you build or use the AI. See obligations by operator role — provider, deployer, importer, distributor or GPAI provider.
FAQ
Does our benefits-eligibility system count as high-risk?
Yes. AI used to evaluate eligibility for essential public assistance benefits and services, or to grant, reduce or revoke them, is high-risk under Annex III(5)(a). Deploying it triggers the Art. 26 deployer duties and an Art. 27 fundamental rights impact assessment.
What is the FRIA and who has to do it?
The fundamental rights impact assessment under Art. 27 is required of deployers that are public bodies (and certain private operators providing public services) before putting a high-risk system into use. It documents the affected people, the risks to their rights and the mitigation and oversight measures.
Is AI social scoring by a public authority allowed?
No. Art. 5 prohibits social scoring by public authorities that leads to detrimental or disproportionate treatment. This is a banned practice, in force since 2 February 2025, not a high-risk one that can be mitigated.
Run the free 2-minute risk checker — no sign-up.