Who it is for Public sector
You are assessing the use of AI in a public authority or institution. Alongside data protection and information security, you need to consider requirements for the public sector. Find guidance on procurement, impact assessments, registration and deadlines.
A public authority is normally a deployer and therefore has the 24 deployer obligations. Three obligations apply additionally or in stricter form: registration in the EU database before putting into service under Art. 26(8), the fundamental rights impact assessment under Art. 27, which mainly affects public bodies, and, for post-remote biometric identification, authorisation by a judicial or administrative authority within 48 hours.
The heaviest point is the deadline. For existing systems in the public sector the transition period ends on 2 August 2030, regardless of whether the system was modified. Four years sounds long but in public administration rarely covers more than one procurement cycle.
For existing systems in the public sector the transition period ends on 2 August 2030, regardless of whether the system was modified.
Each step links to the relevant features and information.
Answers with sources and links for further review.
Three points. First, registration in the EU database before putting an Annex III system into service. Second, the fundamental rights impact assessment under Art. 27, which affects the group named in the provision and there mainly public bodies. Third, for post-remote biometric identification, authorisation by a judicial or administrative authority.
By 2 August 2030. Unlike in the private sector, where existing systems are only covered upon a substantial modification, a fixed deadline applies to systems intended to be used by public authorities. An implementation plan per existing system with milestones is the usual evidence.
Before putting the system into service the authority registers itself and enters the system. The registration doubles as a pre-check: if the provider entry is missing, that is a solid signal that the procurement should not yet be concluded.
Anyone using it in the course of an investigation applies in advance or without delay, at the latest within 48 hours, for authorisation by a judicial or administrative authority. What matters is a procedure that holds the 48 hours at night and at weekends too. An annual report to the market surveillance and data protection authorities is also required.
Yes, in advance, where a high-risk system is used at the workplace, under Art. 26(7). Affected persons must be informed under Art. 26(11), and at the point where the decision is made. A note in a general statement usually does not reach them.
As a rule, no. The Community Edition licence permits general public administration activity only where it itself constitutes permitted non-commercial education or academic research. For ongoing administrative work the professional edition is the right one. The three single modules are open for a first orientation.
With the quick check for a first classification, then the application itself for role, risk class, threats and mitigations. The report captures header data, every assessment step with result, reasoning and evidence, and the open points, and it is that report which serves as evidence in the file.
It registers nothing in the EU database and files no application. It replaces neither legal advice nor an assessment of the individual case. It keeps no record of processing activities and replaces no case file. And it makes no decision on a procurement.
These tasks require additional tools or professional review.
Tasks outside the application
For regular work across several systems: reports as PDF and workbook, machine-readable exports, extended evidence packages.
OpenThe complete Community Edition with example data, directly in the browser and without sign-up. For trying out the method; your own work inside a company or a public body is not covered by the Community licence.
OpenCompare the features, licence terms and prices of the Community, Professional and Enterprise editions. Compare editions
Guidance for other responsibilities within your organisation or your clients’ organisations.