Sector

AI in municipalities and public authorities

The second subparagraph of Art. 6(1) GDPR rules out the balancing exercise for authorities performing their tasks, so the legal basis has to come from sector law. An administrative act may issue fully automatically under section 35a VwVfG only where a legal provision allows it and there is neither discretion nor a margin of assessment. And the fundamental rights impact assessment under Art. 27 AI Act binds bodies governed by public law, while private deployers largely do not owe it.

The system pre-assesses, the case handler decides

In a municipality, a system is to take over the initial assessment of applications for a social benefit. Case handlers are to look at the proposal and issue the decision. The supplier points to an assessment under the AI Act which it prepared for corporate customers. Three points are missing from it.

The balancing exercise is not available to authorities

What an authority can base the processing on is decided by a half-sentence that rarely appears in publications aimed at companies. The second subparagraph of Art. 6(1) GDPR provides that point (f) does not apply to processing carried out by public authorities in the performance of their tasks.

What is left, and what follows from it

Point (c) or (e)
A legal obligation or a task in the public interest. For the performance of tasks there is no third option.
A basis in sector law
Art. 6(3) GDPR requires it to be laid down by Union or member state law, with the purpose laid down there as well.
The purpose limits the tool
Where sector law covers the initial assessment of applications, it does not automatically cover analysing the same data to detect fraud.

3 von 3

In practice that shifts the work from balancing to interpretation. What has to be established is which provision assigns the task and whether it covers the intended deployment. Where it does not, the deployment is not to be weighed but to be dropped or enabled by statute.

A fully automated decision needs a permission of its own

Whether a decision may issue fully automatically is answered not by the AI Act but by procedural law. Section 35a VwVfG allows it only on two conditions, and the corresponding provisions of the states are worded alike.

Two conditions, and both are narrow

Permitted	Merkmal	Not permitted
A legal provisionA provision has to allow the fully automated issue expressly. General procedural law does not suffice.	Permission	Without permission
A bound decisionNeither discretion nor a margin of assessment. A hardship clause in sector law therefore regularly rules the fully automated issue out.	Scope for decision	Discretion or margin
Through paragraph 2(b)The legal provision has to lay down suitable measures to safeguard rights.	Art. 22 GDPR alongside	ProhibitedWithout an exception under paragraph 2, the right not to be subject to such a decision remains.
Not a case of section 35a VwVfGProvided a human being actually decides and can reject the proposal.	Assistance system	Signing offWhere a proposal is adopted in nearly every case, in case of doubt no decision of one's own remains.

The most frequent case in practice is the fourth, and it turns not on how the system is built but on the rate at which proposals are adopted. That rate should be measured before somebody else measures it.

The fundamental rights impact assessment binds the public sector

What obligation additionally binds public bodies is set out in Art. 27 AI Act, and that provision is missing from almost every account written for companies. It binds deployers that are bodies governed by public law or private entities providing public services.

Six items required by Art. 27(1) AI Act

The deployer’s processes in which the system will be used in line with its intended purpose
The period of time and frequency of use
The categories of natural persons and groups likely to be affected
The specific risks of harm to those categories
How human oversight is implemented in accordance with the instructions for use
The measures to be taken if those risks materialise, including complaint mechanisms

Three points in time under Art. 27 AI Act

Before putting into service
The assessment
Paragraph 1 requires it before the system is put into service, and paragraph 2 makes clear that the obligation concerns the first use.
After the assessment
The notification
Paragraph 3 requires the result to be notified to the market surveillance authority, using a template from the AI Office.
On any change
The update
Where the deployer comes to consider during use that an element is no longer up to date, the information has to be updated.

How we support you in public administration

The three points belong in the specification and not in the acceptance test. Before the tender it has to be established which provision assigns the task and whether it covers the deployment. Then it has to be settled whether a human being decides, and how that can later be shown. And for a system from Annex III the assessment under Art. 27 AI Act has to be scheduled, with the date of the notification to the market surveillance authority. All three can be framed as requirements, and the supplier then assesses them too.

Frequently asked questions

Which administrative use cases appear in Annex III?

Among others, systems deciding on access to and enjoyment of essential public services and benefits, systems used in law enforcement, and systems in migration, asylum and border control. For municipalities the first group matters most, because it covers benefit decisions.

Does the data protection impact assessment replace the fundamental rights one?

No. Under Art. 27(4) AI Act the fundamental rights impact assessment complements one already carried out under Art. 35 GDPR, in so far as individual obligations are thereby already met. Both remain separate, and the results of the second have to be notified to the market surveillance authority.

What does human oversight mean in case handling?

Under Art. 26(2) AI Act it has to be assigned to natural persons who have the necessary competence, training and authority. Signing off without any possibility of rejecting the proposal does not meet that, and the same question arises under data protection law with Art. 22(1) GDPR.

Does this also apply to assistance systems with no power to decide?

For the legal basis, yes, because assistance is processing too. For Art. 22 GDPR and section 35a VwVfG what matters is whether a human being actually takes the decision. Where a proposal is adopted in nearly every case, that is in case of doubt no longer a decision of one's own.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.