EU AI Act for local authorities

Which obligations do local authorities already have today?

Obligation	Since	What it means for the administration
AI literacy (Art. 4)	2 February 2025, revised on 27 July 2026	Train staff who use AI, and document it
Prohibitions (Art. 5)	2 February 2025	no social scoring, no emotion recognition in the workplace
Transparency (Art. 50)	2 August 2026	Make chatbots recognisable as AI; label AI texts on matters of public interest that have not been editorially reviewed
High risk under Annex III	2 December 2027	Obligations for deployers, fundamental rights impact assessment, registration

There is a separate guide with slides and templates for Art. 4: AI literacy under Art. 4.

When is AI in public administration high risk?

Annex III names several areas that concern local authorities:

• Public services (point 5(a)): AI that assesses whether someone is eligible for social benefits or other public assistance, or that grants, reduces, revokes or reclaims benefits. This concerns the social welfare office, the youth welfare office and the housing benefit office.
• Migration (point 7): AI that supports authorities in examining applications for asylum, visas or residence permits. This concerns the immigration office.
• Employment (point 4): AI that screens or evaluates applications, helps decide on promotion or dismissal, or monitors performance. This concerns the human resources office.
• Education (point 3) and critical infrastructure (point 2), for example at municipal utilities.

Not every AI in these offices is high risk. Under Art. 6(3), preparatory or narrowly defined tasks are excluded, such as summarising documents, sorting incoming mail or rewriting a decision in plain language, as long as a person decides and no profiling takes place. Details: Identifying high-risk AI.

What applies if a use is high risk?

As a deployer, from 2 December 2027 you must, among other things:

• use the system in accordance with the instructions for use and assign human oversight to competent staff (Art. 26(1) and (2)),
• keep logs for at least six months (Art. 26(6)),
• inform the staff council and staff beforehand if the system is used in the workplace (Art. 26(7)),
• register the use as a public authority in the EU database (Art. 26(8), Art. 49),
• inform the persons concerned if the system makes or supports decisions about them (Art. 26(11)),
• carry out a fundamental rights impact assessment before first use (Art. 27).

High-risk systems that a public authority already uses before December 2027 must be brought into line by 2 August 2030 at the latest (Art. 111(2)).

Do local authorities face fines?

The AI Act leaves it to the member states whether public authorities pay fines (Art. 99(8)). Germany has ruled this out in the KI-MIG: no fines are imposed on public authorities and other public bodies within the meaning of § 2(1) and (2) BDSG (the Federal Data Protection Act), which include municipalities and associations of municipalities (§ 17(2) KI-MIG). The obligations still apply, and the supervisory authority can order measures. Municipal companies under private law are not automatically covered by the exemption.

How does this work with basebox?

basebox is a platform, not a high-risk system; which obligations you have depends on the use. basebox makes suggestions, people make decisions. Citizen data stays in the EU and is never used to train the AI models; the data processing agreement under Art. 28 GDPR is part of the contract. For the EU AI Act, you get training, logs and a model register. The audit log is kept for six months by default, adjustable from 3 to 36 months. For the staff council, there is a separate package with answers on logging, permissions and codetermination, plus a model service agreement (Dienstvereinbarung) as a non-binding draft. More under AI for local government and Security.

Not legal advice: As of 11 October 2026. State law, the Commission’s guidelines and the practice of the Federal Network Agency may further specify the requirements.