What does the AI Act say to public bodies?
The AI Act, the EU regulation on artificial intelligence, does not ban AI in public offices. It sorts it into risk levels based on the use, not the technology. The same model can be minimal risk when it sorts mail and high-risk when it helps decide who receives a benefit.
An example case, not a real body. An Italian municipality of 40,000 residents wants an assistant to draft replies to citizens and an agent to sort PEC, the certified email that carries legal value in Italy. The town clerk asks whether this is legal. We answer step by step, with the rules in force and those still to come.
What are the risk levels, with office examples?
- Banned. Social scoring that leads to people being treated worse, crime prediction based only on profiling, emotion recognition at work and in schools. These bans have applied since 2025.
- High-risk. Assessing whether a person is entitled to essential public benefits and services, or granting, reducing or revoking a benefit. The list also covers education, staff, law enforcement and justice.
- Transparency. People talking to an AI assistant must be told, unless it is obvious. This duty has applied since August 2026.
- Minimal risk. Sorting mail, drafting, summarising a case file. There are no specific duties beyond training your staff.
When does an office use become high-risk?
Even within a listed area, a system is not high-risk if it does not materially influence the decision. Article 6 gives four cases: a narrow procedural task, improving work a person has already done, spotting deviations from past decisions without replacing human review, and a preparatory task. A system that profiles people, however, is always high-risk.
Our read: for the municipality in the example, sorting PEC and drafting replies are preparatory or procedural tasks. A system that scores grant applicants is another matter. The European Commission's guidelines on Article 6 are still in draft.
What applies today, and what arrives in 2027?
Today the bans apply, along with the duty to train people who use AI and transparency towards citizens. The duties for listed high-risk systems start on 2 December 2027, after the EU postponed them through the Digital Omnibus on AI regulation. From then on the body must, among other things, use the system according to the supplier's instructions and assign oversight to competent people.
GDPR, on the other hand, already applies to every use that touches personal data. If AI reads citizens' certified email, you need a legal basis and appropriate security, as for any other processing.
What does Italian law add?
Article 14 of Italy's Law 132 of 2025 says public bodies use AI to work more efficiently and shorten procedures. They must make sure its workings are knowable and its use traceable. AI plays an instrumental, supporting role, and the person remains solely responsible for the decisions in which it was used.
Our read: on this point Italy's rule goes further than the AI Act, because it covers every use, not just high-risk ones. In practice an official always signs.
How do you classify a use in your organisation?
- Does the AI decide something about a person, or does it only prepare the work of whoever decides?
- Does it touch benefits, employment, education or safety?
- Does it profile people, meaning it assesses them based on their data?
Our read: if all three answers are no, you are almost always at minimal risk. Write the classification as one line in your register of use cases, with the date and the name of whoever made it. Start with preparatory uses, such as drafting and sorting, and always tell citizens when they are talking to a system.
What about us?
How we would set it up in the example municipality: first PEC sorting, with the agent proposing the office and the officer confirming. Then draft replies, reviewed and signed by an official. Each use goes into the register with its classification before it starts.
So what do you do?
- If AI sorts, summarises or drafts, you can start once training, transparency and GDPR are in order.
- If AI helps decide on benefits, services or staff, prepare for the high-risk duties and involve your data protection officer from the start.
- If AI scores people based on their behaviour, stop and get advice: you may be among the banned practices.
“In a town hall, AI prepares the work and a person signs. Every new use starts from there.”
DBrothers — on the AI Act in public administration
Frequently asked questions
Is an AI assistant on the council website high-risk?
Usually not, if it gives information about services. Citizens must still know they are talking to an AI system, unless it is obvious.
Do you need to train your staff?
Yes. Those who use AI systems take steps so their staff know how to use them, and this duty applies today. Since the Omnibus changes, the text states that a specific level does not have to be guaranteed for each person.
Can the rules still change?
Yes. The guidelines on Article 6 are in draft, and AgID's guidelines on AI adoption in Italian public administration are not yet final. This may change; we will update this page.
List the AI uses your organisation already has or wants to start, and run them through the three questions on this page. You begin with the first preparatory use, and the signature stays with the official.
