Direct answer
We are a public-sector organisation using AI. What needs to be in place?
You describe: A municipality, executive agency or other public body using AI towards citizens, for example in benefits, enforcement or services. Likely role: body governed by public law (deployer).
This applies now
- Article 4: AI literacyApplicable
- Article 50: transparencyApplicable
Coming up
- Article 27: FRIAfrom 2 December 2027
- Annex III: high-risk AIfrom 2 December 2027
For public bodies the FRIA duty (Article 27) comes on top of classification. It follows the high-risk timeline to 2 December 2027, but the algorithm register, transparency and AI literacy matter now.
Your first actions
- Perform a FRIA before deployment. Assess process, duration, affected persons, risks, oversight, mitigation and complaint mechanisms and notify results where required.
- Classify the use case and document the outcome. Assess Article 5, Article 6 and Annex III in that order and document purpose, context and any Article 6(3) exception.
- Take role- and context-specific AI literacy measures. Determine for each role, system and context which combination of instruction, guidance, practice or training is appropriate.
Record this
- FRIA report and notification
- Article 6 and Annex III classification record
- AI literacy measures record
General interpretation, not legal advice. The official source remains authoritative.
Full map for your situationExecution
Carry out the FRIA in a structured way
A FRIA touches DPIA, register and human oversight. Embed AI runs the assessment together with your team and delivers the evidence file.
See the Embed AI approach