How Does the AI Act Apply to Benefits and Essential Services?

Which benefits and services functions are listed?

Annex III point 5 lists, in outline, systems intended to evaluate eligibility for essential public assistance benefits and services and to allocate those benefits and services, systems intended to allocate essential private and public services including electricity, gas, heating, water and emergency services, and systems intended to classify emergency calls and dispatch emergency and first response services. Each function is consequential: eligibility evaluation decides who receives support, allocation decides who receives a scarce service, and emergency classification and dispatch decide the speed and nature of the response to a person in need. A system that only provides information about benefits, only handles an application form, or only stores records, without evaluating eligibility, allocating a service or classifying a call, is assessed differently, and the distinction must be recorded from the actual function. The record should describe the decision, the data, the output and the person who acts on it, so the listed function, if any, is visible.

How is a benefits system classified?

Classification follows the Article 6 route, with profiling as the decisive question. A benefits eligibility system that evaluates a person on the basis of personal data will ordinarily involve profiling, which means the Article 6(3) route is unavailable and the system is always high-risk where it falls within the listing. The classification record should address profiling directly, citing the data, the evaluation and the output, and should not rely on a narrow-task claim where the system materially influences an eligibility or allocation decision. The provider's documentation and the public authority's assessment should describe the same system, and the authority should obtain the provider's classification and conformity information and record its own assessment for its population, eligibility rules and decision process. Where the system is developed in-house, the authority can be both provider and deployer, and the duties of both roles must be recorded separately, with the handover between development and deployment visible in the file.

For the broader regulatory framework, see finance, insurance and critical infrastructure.

What must a public authority deployer do?

A public authority deployer must register its use under Article 49(3) before putting the system into service or using it, must carry out a fundamental-rights impact assessment where Article 27 requires it, must assign human oversight, use the system in accordance with instructions, monitor its operation and retain logs, and must take the necessary steps to comply with the high-risk requirements by 2 August 2030 under Article 111(2). It must also satisfy administrative law duties, including giving reasons for decisions, informing the person affected, and providing a route to challenge a decision, and data protection duties, including a data protection impact assessment where required. The deployer should plan those duties together, with a single deployment file, a named owner for each duty, and a timetable that meets the earliest applicable date. A deployment that meets the AI Act file but cannot give reasons for a benefits decision, or cannot handle a challenge, is not ready for use.

What oversight and explanation are needed for benefits decisions?

Oversight for a benefits decision means a competent person, with time and authority, reviews the system's output, considers information beyond the output, including the person's circumstances and evidence, and decides whether the eligibility or allocation outcome is correct. The person affected should be told, in clear terms, that an AI system was used, what it did, what data were used, what the outcome was and how it can be challenged, subject to the information and reasons duties in administrative and data protection law. The explanation should allow the person to understand the decision and to provide further information or correct an error, and the deployer should record the explanation given, the decision, the reviewer and the outcome of any challenge. A benefits decision that follows a system output automatically, without oversight, reasons or a challenge route, risks an unlawful decision and a loss of public trust, even where the system itself was classified and documented correctly.

How should outcomes be monitored?

Outcomes should be monitored for accuracy, consistency and fairness across the population served, including whether outcomes differ across groups in ways that were not intended or justified, whether overrides are frequent or rare, and whether appeals reveal patterns that require action. Monitoring should include the system's performance in the deployment context, the quality of the data, the handling of edge cases and changes in eligibility rules, and the feedback from staff and from people affected. Where monitoring shows a pattern, the deployer should escalate it to the provider, reassess the deployment, and record the action taken, including any change to the system, the rules or the oversight design. Monitoring findings should feed into the post-market monitoring system, the fundamental-rights impact assessment review and the administrative law record together, so a single pattern is not treated as three separate issues by three separate teams. The monitoring record should be reviewed at defined intervals and when the eligibility rules or the population change.

Continue with public sector deployer duties and impact assessment.

What does this guide not decide?

This guide does not decide whether any benefits or essential services system is high-risk, does not determine whether an eligibility or allocation decision was lawful, and does not give administrative, social security or data protection advice. Those questions depend on the system's function, the eligibility rules, the decision process and the law of the Member State concerned, applied to the specific facts with qualified advice. The guide also does not assess the fairness or accuracy of any benefits system. Where a benefits or essential services system is to be deployed, confirm the classification, registration, impact assessment, oversight, reasons and challenge position with a competent authority or legal adviser before the system affects a person's entitlement.

Frequently asked questions

Continue through this AI Act cluster

• finance, insurance and critical infrastructure
• public sector deployer duties and impact assessment
• which deployers must register their use
• sector oversight, evidence and impact assessment
• deployer responsibilities
• high-risk AI systems