AI in public administration: uses, duties and risks

Public bodies use artificial intelligence (AI) to answer enquiries, sort and read documents, translate, draft text and flag claims that look unusual. Used well, it frees staff for the cases that need judgement; used badly, it can make unfair decisions at scale about people who cannot choose another provider. That is why the AI Act of the European Union (EU) gives public bodies specific duties, and why the quality and meaning of the data underneath matter as much as the model.

How public bodies use AI

An Organisation for Economic Co-operation and Development (OECD) review of AI in government, published in 2025, found that the most common uses in social programmes across OECD countries were automated client support such as chatbots, automation of internal processes such as data entry and document processing, and fraud and anomaly detection in benefit claims.⁴ Many tools support staff rather than replace them. In the United Kingdom (UK), Caddy acts as a copilot for customer service agents, retrieving information from government sources with a human validating the answer; in France, Albert, introduced in April 2024, helps public servants search regulations and draft summaries when responding to citizens.⁴

Language is another common use. Portugal's virtual assistant on the gov.pt portal, expanded in January 2025, gives information on more than 2,300 public services and offers support in 12 languages.⁴ In each of these examples, AI handles information and routine work rather than deciding anyone's entitlements.

What the EU AI Act prohibits and treats as high-risk

Regulation (EU) 2024/1689, the Artificial Intelligence Act, was adopted on 13 June 2024 and entered into force on 1 August 2024.¹³ It sorts AI by risk. Some practices are prohibited outright, including social scoring: evaluating or classifying people over time on their social behaviour or personal characteristics, where the score leads to unfavourable treatment in unrelated contexts or treatment that is unjustified or disproportionate.¹

High-risk systems are allowed but closely regulated. Annex III lists the areas, and several sit at the heart of public administration.¹

Not every system in these areas is high-risk. An Annex III system falls outside the category if it does not pose a significant risk of harm, for example because it performs only a narrow procedural or preparatory task, but a system that profiles people always counts as high-risk.¹ A tool that only routes incoming letters to the right team may fall outside; one that builds risk profiles of benefit claimants does not.

Duties for public bodies using high-risk AI

The Act calls the organisation using a system its deployer. Deployers of high-risk systems must use them according to the provider's instructions and assign human oversight to people with the competence, training and authority to exercise it.¹ Public authorities must also register their use in the EU database and must not use a high-risk system that has not been registered there.¹ Where an Annex III system makes or helps make decisions about people, the deployer must tell those people it is being used.¹

Before first use, bodies governed by public law and private entities providing public services must carry out a fundamental rights impact assessment.¹ It must describe the processes the system will be used in, how often, who is likely to be affected, the specific risks of harm to them, the human oversight measures, and what happens if the risks materialise, including complaint mechanisms.¹ The results go to the market surveillance authority, and since the 2026 amendments a deployer may cross-refer to an existing data protection impact assessment rather than repeat it.¹²

People affected gain a right to an explanation. Anyone subject to a decision based on an Annex III high-risk system that has legal or similarly significant effects on them can ask the deployer for a clear explanation of the AI's role and the main elements of the decision.¹

Transparency duties for chatbots and generated content

Some duties apply whatever the risk level. Providers must design systems that interact with people so that those people know they are dealing with AI, unless that is obvious.¹ Deployers must disclose deep fakes, and must disclose AI-generated text published to inform the public on matters of public interest, unless it has been through human review or editorial control and someone holds editorial responsibility for it.¹ The Commission states that these transparency rules apply from August 2026.³

When the rules apply

The Act applies in stages, and its timetable changed in 2026. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026 and postponed the high-risk obligations.²³

The dates come from Article 113 of the Act as amended, and Article 111 for systems already in use.¹² Public bodies therefore have time before the high-risk duties bite, but the prohibitions already apply.

The UK approach

In the UK, the Algorithmic Transparency Recording Standard (ATRS) gives public sector organisations a standard way to publish information about how and why they use algorithmic tools.⁵ It is mandatory for all government departments and for arm's-length bodies that deliver public or frontline services or deal directly with the public, under a scope and exemptions policy published in December 2024, and the Data Standards Authority recommends it across the wider public sector.⁵ Published records sit in a public repository, and the January 2025 Blueprint for Modern Digital Government committed to building on the standard to increase openness about AI use.⁵

Why data quality and shared meaning shape the results

AI systems inherit the strengths and faults of their data. The OECD notes that some early failures of AI in public services were connected to data quality issues, and points to the need to keep checking that data inputs are accurate, reliable and appropriate.⁴ Data drawn from well-run base registries starts from a better place than copies kept in a dozen local systems.

Meaning matters as much as accuracy. If one agency defines a household or income differently from another, a model trained on both learns the confusion; agreed definitions and semantic interoperability make combined data safe to use. Shared vocabularies also make it easier to document what a system relies on, which helps with impact assessments and transparency records.