The EU AI Act for public bodies: what to prepare by December 2027

01Where things stand in autumn 2026

The AI Act (opens external site), Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. In July 2026 the EU adopted the Digital Omnibus on AI, Regulation (EU) 2026/1744 (opens external site), which postponed the high-risk rules and changed a number of other provisions. It entered into force on 27 July 2026, a few days before the original high-risk date.

The result is a timeline in which some obligations already apply, some arrive at the end of this year and the heaviest ones for public deployers follow in December 2027.

The Omnibus also rewrote Article 4 on AI literacy. Providers and deployers now have to take measures to support the AI literacy of their staff, instead of ensuring a sufficient level of it. The duty remains; what you need to show has changed. Training that fits each role, and a record of it, is still the sensible answer.

02Are you a provider or a deployer?

Most public bodies are deployers: they use an AI system under their own authority. You are a provider when you develop an AI system, or have one developed, and put it into service under your own name. That includes systems built in-house or by a contractor to your specification.

Roles can also shift. Under Article 25, a deployer that substantially modifies a high-risk system, or changes its intended purpose so that it becomes high-risk, takes on provider obligations. Write the intended roles into procurement documents and contracts, so that nobody discovers them during an audit.

03Which of your use cases are high-risk?

Annex III lists the areas in which AI systems are considered high-risk. For public bodies the most relevant are:

• Access to essential public services and benefits: assessing eligibility, and granting, reducing, revoking or reclaiming benefits and services.
• Migration, asylum and border control, law enforcement and the administration of justice.
• Education and vocational training: admission, assessment of learning outcomes, monitoring during tests.
• Employment: recruitment, promotion, task allocation and monitoring of staff. Public bodies are employers too.
• Critical infrastructure: safety components in the management of digital infrastructure, road traffic and utilities.

Being in an Annex III area is not the end of the analysis. Under Article 6(3), a system in such an area is not high-risk when it does not pose a significant risk of harm, for example because it performs a narrow procedural task, improves the result of work a person has already completed, detects patterns without replacing human assessment, or performs a preparatory task. A system that profiles people is always high-risk. If you rely on this exception, document the reasoning.

Many useful tools are not high-risk at all: drafting support, internal knowledge search, translation, summarising. Transparency duties and the GDPR still apply to them, but the high-risk regime does not.

04What deployers of high-risk systems must do

From 2 December 2027, a public body that deploys a high-risk system from Annex III has obligations under Article 26 (opens external site). The main ones:

• Use the system in line with the provider's instructions for use, with appropriate technical and organisational measures.
• Assign human oversight to people with the necessary competence, training and authority, and give them support.
• Make sure input data under your control is relevant and sufficiently representative for the intended purpose.
• Monitor the operation, and inform the provider and the authorities without undue delay of risks and serious incidents.
• Keep the automatically generated logs for at least six months, unless other Union or national law provides otherwise.
• Inform workers' representatives and affected staff before using a high-risk system at work.
• As a public authority, register your use of the system in the EU database before putting it into use (Article 26(8) and Article 49). An unregistered system may not be used.
• Inform people when a high-risk system is used to make, or assist in making, decisions about them (Article 26(11)). People also have a right to an explanation of individual decisions (Article 86).

The fundamental rights impact assessment

Under Article 27 (opens external site), bodies governed by public law, and private organisations that provide public services, carry out a fundamental rights impact assessment before they first use most Annex III systems. Systems for critical infrastructure are excluded. The assessment describes:

1. 01the processes in which the system will be used, in line with its intended purpose;
2. 02the period and frequency of use;
3. 03the categories of people and groups likely to be affected;
4. 04the specific risks of harm to those people;
5. 05how human oversight is implemented;
6. 06what happens if risks materialise, including internal governance and complaint mechanisms.

You notify the results to the market surveillance authority. The assessment complements, and can build on, a data protection impact assessment under Article 35 of the GDPR, so run both together. Article 27(5) asks the AI Office to provide a template questionnaire; check its status before you design your own. Some countries already have methods, such as the Dutch government's Impact Assessment Mensenrechten en Algoritmes (IAMA).

05Transparency duties that already apply

Since 2 August 2026, Article 50 applies. Providers must design systems that interact with people so that those people are told they are dealing with an AI system, unless that is obvious, and must mark synthetic content in a machine-readable way. Deployers must disclose deepfakes, and must disclose AI-generated or manipulated text published to inform the public on matters of public interest, unless a person has reviewed it and someone holds editorial responsibility.

For a public body, the most common case is a chat assistant on a website or in a service channel. Say clearly that it is an AI system, explain what it can and cannot help with, and offer a route to a person.

06A preparation plan for 2026 and 2027

1. 01Inventory, now. List every AI system in use or in procurement, including AI features inside platforms you already license. Record owner, purpose, provider, data used and the people affected.
2. 02Classify, by early 2027. Prohibited, high-risk (with the Article 6(3) reasoning documented), transparency only, or minimal risk. Record your role as provider or deployer for each.
3. 03Fix contracts, during 2027. Ask providers for instructions for use, conformity documentation and access to logs. Make support for your impact assessment and incident reporting a contract term.
4. 04Design oversight. Name the roles, train them, give them authority to override and an escalation path. Design against automation bias; our article on where AI agents need human approval shows how.
5. 05Set up logging and monitoring. Keep logs for at least six months, define what counts as a serious incident and who reports it.
6. 06Before first use. Run the fundamental rights impact assessment together with the DPIA, register in the EU database, and inform staff and the people affected.
7. 07Keep literacy going. Role-based training for users, reviewers and decision-makers, refreshed when systems change, with a record of who was trained.

07Penalties and enforcement

Member States lay down the rules on penalties. Article 99(8) lets each Member State decide whether, and to what extent, administrative fines can be imposed on public authorities and bodies established in that state. That is not a reason to wait. Market surveillance authorities can still require corrective action, and the legitimacy of a public decision depends on whether it can be explained and challenged.

08What to watch in the coming months

• Commission guidelines on the classification of high-risk systems (Article 6(5)), and its existing guidelines on prohibited practices (opens external site).
• Harmonised standards for high-risk requirements, which providers will use to show conformity.
• The designation of market surveillance authorities in your Member State, and their first guidance for public deployers.
• The AI Office template for the fundamental rights impact assessment.

The AI Act Service Desk (opens external site) of the European Commission keeps the official timeline and article-by-article explanations up to date. Bookmark it, and date every internal note you write about the Act: this is a text that is still moving.