AI in Public Authorities

A national agency, a region, or a municipality that deploys AI operates under constraints that no private enterprise faces in the same combination: a legal mandate that must exist before a system does, administrative law that demands reasons for every decision, transparency owed to citizens, procurement rules, and a sovereignty question that is also a national security question. The chapter builds on Architecture as Code (Chapter 21), which treated the digitalisation of public administration as codified, auditable infrastructure (66, Nordqvist, 2025). It closes Part IV because public authorities face every organisational question of Chapters 12 to 16A and several of their own; the algorithm register, for example, is the public counterpart of Chapter 16's portfolio register.

A private company may deploy a model because it expects a return; a public authority may deploy one only because the law permits it to perform the task, and only in the way the law permits. The architect therefore asks whether the output can lawfully ground an administrative decision, whether the citizen can be told why, and whether the decision can be appealed to a person who did not depend on the model. Authorities act under a principle of legality and need an explicit legal basis for processing, deciding, and often automating. The people affected cannot go elsewhere, so the state owes a higher duty of explanation and redress, and it answers to parliaments, ombudsmen, auditors, and courts in public. The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law binds its parties, which are states, to ensure that AI systems used by public authorities respect human rights, democratic processes, and the rule of law (21, Council of Europe, 2024); its obligations land on the architects who design what governments run.

Any public-sector AI system starts from lawful authority. The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR), requires a lawful basis for every processing operation; for authorities this is normally Article 6(1)(e), a task carried out in the public interest or in the exercise of official authority, which must itself be laid down in Union or Member State law under Article 6(3) (2, European Union, 2016). The legal department identifies this basis, and the architecture records it as a property of the system: which statute, which section, which processing operations.

Primary topics explored

1. Why the public sector is different
2. Legal basis and administrative law
3. Transparency and algorithm registers
4. What the system does
5. What the system does not do
6. What information it uses