AI Governance Engineer
GitHub

Public sector AI governance: AI that decides about citizens.

For ministries, agencies, municipalities and operators of public services that buy, build or run AI: the duties you meet before buying, before first use and while it runs, in that order.

Who this is for.

Your systems often decide about people who cannot choose another provider, so the law asks more of you than of most deployers: an impact assessment before first use, registration, notice to the people affected and an explanation when they ask. Much of your AI arrives through procurement, so the contract is where evidence is won or lost. This route puts the duties in the order you meet them.

  • Public-sector CIOs and CDOs
  • Service and policy owners
  • Procurement officers
  • Public-sector DPOs
  • Audit and oversight bodies

On the learning path, start at Risk tiers and intake or FRIA and DPIA as code.

New to the field? Read AI governance explained: the definition, the frameworks and where engineering fits.

Three questions you bring.

Each one answered in brief here, and in full in the Body of Knowledge.

  1. Do we need a fundamental rights impact assessment?

    Yes, before first use of an Annex III high-risk system, if you are a body governed by public law or a private entity providing public services; systems for critical infrastructure (Annex III point 2) are excepted. Where your DPIA already meets part of it, the FRIA may cross-reference or include the relevant DPIA sections (Art. 27(1), 27(4)) 1.

    Fundamental rights impact assessment

  2. What has to be public, and to whom?

    Public authorities that deploy high-risk systems register them in the EU database (Arts. 26(8), 49) 1. People subject to decisions an Annex III system makes or helps make are told so (Art. 26(11)) and can ask for an explanation of its role (Art. 86) 1. In the UK, the Algorithmic Transparency Recording Standard is mandatory for government departments and for arm's-length bodies that deliver public or frontline services 2.

    Deployer duties (Article 26)

  3. What about the systems we already run?

    Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 Aug 2030 (Art. 111(2)) 1. The first step is an inventory that shows which of your systems are in scope.

    The post-Omnibus timeline

Your route through the site.

In reading order: chapters at the section that matters, then the patterns, tools, templates, datasets and figures that turn them into work.

Before you buy or build

  1. High-risk through use (Annex III) Chapter 18 · The Annex III areas, public services and benefits among them.
  2. EU AI Act risk classification checker Tool · A first reading of role and risk class for one system, as a document you keep.
  3. The deployment decision Chapter 15 · Start from the use case, not the model, and record the decision.
  4. Where control moves when you buy Figure · Where control moves when you buy instead of build.
  5. Vendor / Model Due-Diligence Gate Pattern · No supplier model in service without answered questions on file.
  6. Vendor due-diligence request Tool · Build the due-diligence request for one supplier and export it.
  7. AI contract clause checklist Template · The terms a procurement should secure, each tied to its obligation.

Before first use

  1. Fundamental rights impact assessment Chapter 18 · Who must do it, what it contains and when to redo it.
  2. FRIA-as-Code Pattern · The FRIA as versioned data, with the triggers that reopen it.
  3. Impact assessment schema Template · One record for the FRIA and the DPIA, cross-referenced.
  4. Impact assessment builder Tool · Draft the assessment in the browser and export it.
  5. Designing human oversight Chapter 04 · Oversight by people with the competence and the authority to overrule.
  6. Human oversight, designed Figure · Where the checkpoint sits, and what the overseer sees.
  7. Deployment decision record schema Template · The go-live decision with its evidence and any dissent.

While it runs

  1. Deployer duties (Article 26) Chapter 18 · Oversight, monitoring, logs, suspension, notice and registration.
  2. Public-sector records in the UK Chapter 21 · The recording standard as a model for a public inventory entry.
  3. Monitoring fairness in production Chapter 16 · The subgroup metrics to keep watching after go-live.
  4. SyRI judgment Case · A fraud risk model struck down because nobody could verify it.
  5. Dutch childcare benefits Case · Nationality as a risk indicator in a benefits system.
  6. NYC MyCity chatbot Case · A city chatbot whose answers ran contrary to city law.

Start this week.

  1. Inventory every algorithmic system that decides or helps decide about people, including those bought as a service. AI system register entry
  2. Flag which of them fall in an Annex III area. High-risk through use (Annex III)
  3. Start a FRIA for the highest-stakes one, building on its DPIA. FRIA-as-Code
  4. Read two public-sector cases with the service owners. SyRI judgment
  5. Add the AI clause checklist to the next procurement. AI contract clause checklist

The obligations that matter most.

The duties that weigh most on a public deployer: the FRIA, deployer duties, registration, human oversight, the prohibitions (social scoring among them), transparency, literacy, and the UK safeguards for automated decisions.

What switches on, and whenThe obligations that matter most on the Public sector route, on the dates they first apply and on their later steps, against the register's review date.First appliesIn forceDeferredLater stepReachedAhead4already apply2025-02-022026-02-052026-07-272026-08-02As of 2026-09-244still to come2026-12-022027-12-022028-08-022030-08-02EU AI Act Art. 4 · applies from 2025-02-02 · In forceArt. 4EU AI Act Art. 5 · applies from 2025-02-02 · In forceArt. 5UK DUAA UK GDPR Arts. 22A–22D · applies from 2026-02-05 · In forceUK DUAAArt. 4EU AI Act Art. 50 · applies from 2026-08-02 · In forceArt. 50Art. 5Art. 50EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14EU AI Act Art. 26 · applies from 2027-12-02 · DeferredArt. 26EU AI Act Art. 27 · applies from 2027-12-02 · DeferredArt. 27EU AI Act Art. 49 / Art. 71 · applies from 2027-12-02 · DeferredArt. 49 / Art. 71Art. 14Art. 26Art. 14Art. 26Art. 27Art. 49 / Art. 71Source: the obligation register(/obligations)As of 2026-09-24
What switches on, and whenThe obligations that matter most on the Public sector route, on the dates they first apply and on their later steps, against the register's review date.First appliesIn forceDeferredLater stepReachedAheadDateits place on the time axis4already apply4still to come2026202820302025-02-022026-02-052026-07-272026-08-022026-12-022027-12-022028-08-022030-08-02EU AI Act Art. 4 · applies from 2025-02-02 · In forceArt. 4EU AI Act Art. 5 · applies from 2025-02-02 · In forceArt. 5UK DUAA UK GDPR Arts. 22A–22D · applies from 2026-02-05 · In forceUK DUAAArt. 4EU AI Act Art. 50 · applies from 2026-08-02 · In forceArt. 50Art. 5Art. 50EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14EU AI Act Art. 26 · applies from 2027-12-02 · DeferredArt. 26EU AI Act Art. 27 · applies from 2027-12-02 · DeferredArt. 27EU AI Act Art. 49 / Art. 71 · applies from 2027-12-02 · DeferredArt. 49 / Art. 71Art. 14Art. 26Art. 14Art. 26Art. 27Art. 49 / Art. 71As of 2026-09-24Source: the obligation register (/obligations)As of 2026-09-24
What switches on, and when The obligations of this route on the date each first applies, drawn by status, and on its later dated steps (a square, filled once reached); the dashed line is the date the rows were last reviewed. Treat what comes before the line as work for now, and read what comes after it as the time left to prepare.
Data table
When the obligations on the Public sector route apply
DateObligationStepStatus
2025-02-02EU AI Act Art. 4: AI literacyApplies fromIn force
2025-02-02EU AI Act Art. 5: prohibited practices (incl. new NCII and CSAM bans)Applies fromIn force
2026-02-05UK GDPR Arts. 22A–22D: permission-plus-safeguards model for significant, solely automated decisions (Data (Use and Access) Act 2025)Applies fromIn force
2026-07-27EU AI Act Art. 4: AI literacyLater step: Omnibus rewording in force: providers and deployers take measures to support AI literacyIn force
2026-08-02EU AI Act Art. 50: transparency for certain AI systemsApplies fromIn force
2026-12-02EU AI Act Art. 5: prohibited practices (incl. new NCII and CSAM bans)Later step: New bans on AI-generated NCII and CSAM applyIn force
2026-12-02EU AI Act Art. 50: transparency for certain AI systemsLater step: Marking grace for existing systems endsIn force
2027-12-02EU AI Act Art. 14: human oversightApplies fromDeferred
2027-12-02EU AI Act Art. 26: deployer obligations for high-risk systemsApplies fromDeferred
2027-12-02EU AI Act Art. 27: Fundamental Rights Impact Assessment (FRIA)Applies fromDeferred
2027-12-02EU AI Act Art. 49/71: registration of high-risk systems in the EU databaseApplies fromDeferred
2028-08-02EU AI Act Art. 14: human oversightLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 26: deployer obligations for high-risk systemsLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2030-08-02EU AI Act Art. 14: human oversightLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 26: deployer obligations for high-risk systemsLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 27: Fundamental Rights Impact Assessment (FRIA)Later step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 49/71: registration of high-risk systems in the EU databaseLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
Obligation Applies Evidence
EU AI Act Art. 27 Fundamental Rights Impact Assessment (FRIA) AIGE-OBL-EUAIA-ART27 Deferred · FRIA-as-code from a template; cross-reference to a GDPR Art. 35 DPIA
EU AI Act Art. 26 deployer obligations for high-risk systems AIGE-OBL-EUAIA-ART26 Deferred · Deployment registry; monitoring hooks; assigned oversight and logging retention
EU AI Act Art. 49/71 registration of high-risk systems in the EU database AIGE-OBL-EUAIA-ART49-71 Deferred · Agent/model registry with an API that feeds registration; owner and status per entry
EU AI Act Art. 14 human oversight AIGE-OBL-EUAIA-ART14 Deferred · Human-in-the-loop checkpoints; kill switch; override and escalation paths
EU AI Act Art. 5 prohibited practices (incl. new NCII and CSAM bans) AIGE-OBL-EUAIA-ART5 In force · Policy-as-code blocklist; input/output guardrails; refusal and abuse detection
EU AI Act Art. 50 transparency for certain AI systems AIGE-OBL-EUAIA-ART50 In force · Content labelling and machine-readable marking (e.g. C2PA-style); chatbot disclosure banner
EU AI Act Art. 4 AI literacy AIGE-OBL-EUAIA-ART4 In force · Literacy programme as code; role-based training records; onboarding gates
UK DUAA · UK GDPR Arts. 22A–22D permission-plus-safeguards model for significant, solely automated decisions (Data (Use and Access) Act 2025) AIGE-OBL-UK-ADM In force · ADM safeguards: meaningful-human-review path, contest and representation channel, decision notice

Every obligation in the register

Sources

  1. [1] Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026 (Arts. 26(8), 26(11), 27(1), 27(4), 49, 86 and 111(2); Annex III). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary)
  2. [2] Algorithmic Transparency Recording Standard hub (mandatory for government departments and for arm's-length bodies that deliver public or frontline services or deal directly with the public). Government Digital Service (GOV.UK). 2025-05-08. https://www.gov.uk/government/collections/algorithmic-transparency-recording-standard-hub (verified: primary)

Other routes.

  1. For engineers ML, platform, MLOps, application and security engineers who build and run AI systems.
  2. For CISOs and risk leads CISOs, heads of risk, model risk managers, internal audit and third-party risk managers.
  3. For legal counsel and DPOs In-house counsel, data protection officers, privacy and compliance leads, and contract managers.
  4. For executives and boards Board members, executive committees, and chief AI, data and technology officers.
  5. For SMEs and start-ups Small and medium-sized companies and start-ups, most of them buying more AI than they build.
  6. AIGP candidates The public AIGP body of knowledge read against this site. Not affiliated with or endorsed by IAPP.
  7. Certifications Certifications and assessments in AI governance, and what each one evidences.

Start at the top of the route.

Step 01 is High-risk through use (Annex III). Each step after it builds on the one before.

Open step 01 All routes