The EU AI Act for the Public Sector: Heavier Duties, Mandatory FRIA
Public bodies face the AI Act's heaviest side: a mandatory FRIA (Art 27), heavy Annex III exposure, a registration duty, and prohibited uses to avoid.
Public bodies sit on the heaviest side of the EU AI Act, Regulation (EU) 2024/1689. They concentrate the high-risk use cases, they face duties private deployers do not, and they are most exposed to the outright prohibitions. If you run AI in a government, agency, municipality or public-service body, the obligations are real and several of them are mandatory where they are merely advisable elsewhere.
The mandatory FRIA (Article 27)
The headline difference: public-body and public-service deployers of high-risk AI must carry out a Fundamental Rights Impact Assessment (Article 27) before first use. For private employers a FRIA is usually not mandatory; for the public sector it is. The FRIA assesses the system's impact on fundamental rights — non-discrimination, due process, data protection — and the measures to mitigate harm, and it can build on an existing GDPR DPIA (Article 27(4)).
Heavy Annex III exposure
Public bodies operate many of the Annex III high-risk categories at once: access to essential public services and benefits (eligibility decisions), law enforcement, migration, asylum and border control, administration of justice, and education. Each high-risk use brings the Article 26 deployer duties — instructions, human oversight (Article 14), log retention, monitoring — plus the FRIA. The exposure is broad, so the inventory work matters even more.
The registration duty
Unlike most private deployers, public authorities (and bodies acting on their behalf) must register the high-risk systems they use in the EU database under Article 49. So a public deployer has a registration touchpoint that a private deployer typically does not.
The prohibited temptations
The public sector is where several Article 5 prohibitions bite hardest, and they must be avoided outright: social scoring (5(1)(c)); real-time remote biometric identification in public spaces for law enforcement (5(1)(h), narrow exceptions); predictive policing from profiling alone (5(1)(d)); and untargeted facial-image scraping (5(1)(e)). These are not high-risk to be documented — they are banned, in force since 2 February 2025, at the €35 million or 7% tier.
Worked example: a municipal benefits agency
A municipal agency uses AI to help assess eligibility for social benefits — Annex III essential-services high-risk. As a public deployer it must run an Article 27 FRIA before use, ensure genuine human oversight so no benefit is refused on the system's output alone, register the system under Article 49, and keep logs. It also confirms it is nowhere near a social-scoring use, which would be prohibited. The result is a real but defined programme, anchored on the FRIA.
How Confir helps
Confir classifies each public-sector AI use, flags the mandatory Article 27 FRIA and the Article 49 public-deployer registration, assembles the Article 26 duties, and tests every use against the Article 5 prohibitions first — so a banned use is caught rather than documented. The engine is deterministic and rule-based, with each finding cited.
Frequently asked questions
Is a FRIA mandatory for the public sector?
Yes. Public-body and public-service deployers of high-risk AI must carry out a Fundamental Rights Impact Assessment under Article 27 before first use. This is mandatory for the public sector, unlike most private employers, and it can build on an existing GDPR DPIA under Article 27(4).
Which high-risk categories affect public bodies most?
Access to essential public services and benefits, law enforcement, migration/asylum/border control, administration of justice, and education — all Annex III categories. Public bodies often run several at once, each bringing the Article 26 deployer duties plus the FRIA.
Do public authorities have to register the AI they use?
Yes. Public authorities and bodies acting on their behalf must register the high-risk systems they deploy in the EU database under Article 49 — a duty most private deployers do not have, where the provider registers instead.
What prohibited uses must the public sector avoid?
Social scoring (Article 5(1)(c)), real-time remote biometric identification in public spaces for law enforcement (5(1)(h)), predictive policing from profiling alone (5(1)(d)), and untargeted facial-image scraping (5(1)(e)). These are banned outright since 2 February 2025 at the €35 million or 7% tier.
When do the high-risk duties apply?
Stand-alone high-risk Annex III obligations apply from 2 December 2027, under the Digital Omnibus deferral, now formally adopted by the European Parliament (16 June 2026) and Council (29 June 2026), pending only Official Journal publication expected before 2 August 2026. Prohibitions and AI literacy are already in force.
Related guides
- The FRIA under Article 27
- Annex III high-risk use cases
- Article 5 prohibited practices
- EU database registration
- Predictive policing: prohibited or high-risk?
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →