Case Studies

Chapter 17 closed Part IV with the constraints that public authorities face. This chapter opens Part V, which turns from what should be done to what has been observed, with eight case studies. The first five are anonymised composites: each combines several organisations and engagements, details have been altered, and none describes a real, named organisation, although the pattern is real. The last three are real, documented European cases the reader can check: a Dutch judgment on government risk scoring, UK government evaluations of an embedded workplace assistant, and Italian enforcement against a conversational assistant that crossed borders through the GDPR's one-stop-shop.

The outcomes are deliberately modest: each organisation moved one or two systems to a state in which the evidence was in the repository and the controls were in the pipeline. Every case is read through three lenses: the usage mode of Chapter 2 (usage mode matrix), the organisation's role under Regulation (EU) 2024/1689, the AI Act, and the controls that worked, failed, or were missing. The documented cases predate the AI Act's obligations or fall outside its reach, so reading them through it asks what it would require, not whether it was breached.

A national authority handles well over a million sickness and parental benefit claims a year, under administrative procedure law that permits automated decisions in defined circumstances and requires reasons for every decision.

Primary topics explored

1. How to read the cases
2. Case 1: A Nordic social insurance authority introduces decision support
3. Case 2: A pan-European bank builds a model risk platform under DORA
4. Case 3: A university hospital group deploys clinical AI within the European Health Data Space
5. Case 4: A manufacturing group adopts agents for maintenance
6. Case 5: A municipality runs a citizen chatbot