Deployers that are public authorities, or private entities providing public services, face additional duties for certain high-risk deployments. Article 27 requires a fundamental rights impact assessment before first use, for deployers that are bodies governed by public law or private entities providing public services, and for deployers of high-risk systems in the Annex III areas the article lists, including creditworthiness and insurance pricing. Article 49 requires deployers that are public authorities, or acting on their behalf, to register the use of high-risk systems in the EU database, in the circumstances the article sets. Article 26 information duties to workers and affected persons, and Article 50 transparency duties, also apply with particular force in public-sector deployments, because the affected people often have no choice about the service.
Who is a public-sector deployer for these duties?
The relevant categories include public authorities, bodies governed by public law, and private entities providing public services, as those terms are used in the Act and in Union and national law. A municipality, a health authority, a social security body, and a private company providing a public service under contract can each be within the categories, depending on their legal status and function. The record should state the deployer's legal status, the public service or function involved, and the legal basis for the deployment, because those facts determine whether Articles 27 and 49 apply. A private company that only supplies a system to a public authority is not the deployer on those facts, although it may be the provider, and the deployer duties remain with the authority that uses the system.
What is a fundamental rights impact assessment?
Article 27 requires a deployer within its scope to perform a fundamental rights impact assessment before first use of a high-risk system, describing the deployer's processes, the intended purpose, the period and frequency of use, the categories of persons and groups likely to be affected, the specific risks of harm likely to impact the affected persons, the human oversight measures, and the measures to be taken if risks materialise. The assessment must be notified to the market surveillance authority, and the deployer must, where applicable, publish a summary and inform affected persons. The assessment is distinct from a data protection impact assessment and from the provider's risk management, although the three share facts. It should be updated where the deployment, the affected groups, or the risks change, and should be reviewed by the fundamental rights body where national law provides for it.
For the broader regulatory framework, see deployer responsibilities.
Which deployments require the assessment?
Article 27 applies to deployers that are bodies governed by public law or private entities providing public services, deploying high-risk systems, and to deployers of high-risk systems intended to evaluate creditworthiness or establish a credit score, and to evaluate and price life and health insurance, in the circumstances the article sets. The scope is therefore not every public-sector use of AI, but the listed categories and uses. A public authority using a general productivity tool follows a different analysis from a public authority using a benefits eligibility system. The record should state the category, the Annex III point, and the Article 27 trigger, so that the assessment is not done for the wrong deployment or omitted for the right one. The consolidated Article 27 wording should be checked, because its scope is detailed.
What registration duties apply to public-sector deployers?
Article 49 requires deployers that are public authorities, or that act on behalf of public authorities, to register the use of high-risk systems listed in Annex III in the EU database, with the information Annex VIII requires, including the deployer, the system, the intended purpose, and the fundamental rights impact assessment summary where applicable. Registration must be done before first use or, where the Act provides, within the period it sets, and must be updated where the use changes. The EU database is public in the parts the Act specifies, so registration is also a transparency measure: affected persons can see which systems a public authority uses for which purposes. The registration record should be checked against the deployment record, so that the public entry matches the actual use.
How do transparency and participation fit?
Public-sector deployments affect people who often cannot choose another provider, so transparency and participation carry particular weight. Article 26 requires informing workers and affected persons, Article 50 requires transparency for interaction and synthetic content, and Article 27 requires notifying and, where applicable, publishing the impact assessment summary. National administrative law can add duties of reasoning, consultation, and access to information. A public-sector deployer should therefore plan communication with affected people, worker representatives, and oversight bodies from the start, and should record the consultation carried out, the information provided, and the route for challenge. A deployment that is lawful on paper but opaque in practice will face legitimacy and legal challenge, even where the technical system performs as specified.
Continue with Article 26 deployer duties in depth.
What is not decided by this guide?
This guide explains the public-sector duties in outline. It does not decide whether a particular body is within Article 27 or Article 49, whether an assessment is required, or whether a registration is complete. Those questions need the legal status, the function, the Annex III point, and the deployment facts, read against Articles 27 and 49 in the consolidated text and the applicable national law. Public-sector deployments should be confirmed with the market surveillance authority, the fundamental rights body where applicable, and a competent authority or legal adviser, before first use, because the assessment and registration must precede use, not follow it.
Frequently asked questions
Must every public authority using AI do a fundamental rights impact assessment?
No. Article 27 applies to the deployers and uses it lists, including bodies governed by public law or private entities providing public services deploying high-risk systems, and deployers of the listed credit and insurance systems. The trigger must be checked against the consolidated wording for the specific deployment.
Is a data protection impact assessment enough for a public-sector deployment?
No. A data protection impact assessment, a fundamental rights impact assessment, and the provider's risk management are distinct assessments with different triggers and content. They share facts but must each be completed where required, and kept separate but cross-referenced.
Must public-sector use be registered publicly?
In the circumstances Article 49 sets, deployers that are public authorities or acting on their behalf must register Annex III high-risk use in the EU database, with the Annex VIII information. The database entry is public in the parts the Act specifies, and must match the actual deployment.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗