What does the EU AI Act mean for companies that sell AI to the public sector?

Which public-sector uses are high-risk?

• Those Annex III lists, and several of its points are public-sector uses by definition: point 5(a) on public assistance benefits; points 6 and 7 on law enforcement and on migration, asylum and border control; and point 8(a), systems used by or on behalf of a judicial authority or in a similar way in alternative dispute resolution.
• Points 6 and 7 name public authorities or Union bodies in every point.
• Points 3 and 4, education and employment, reach public bodies as they reach private ones.
• Chapter III, Sections 1, 2 and 3, which hold the high-risk requirements and the deployer duties of Article 26, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, with the exception of Article 6(5) (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Point 5(a) of Annex III: AI systems intended to be used by or on behalf of public authorities to evaluate the eligibility of natural persons for essential public assistance benefits and services, including healthcare services, as well as to grant, reduce, revoke or reclaim them.

What will the customer need from you?

What its own duties rest on: the registration of the system, the instructions for use its Article 26 duties are measured against, and what Article 13 obliges you to give it, which its Article 27 assessment draws on.

• Article 49(1) and (3): before placing on the market or putting into service a high-risk AI system listed in Annex III, the provider registers itself and the system in the EU database; before putting into service or using one, a deployer that is a public authority, a Union institution, body, office or agency, or a person acting on their behalf, registers itself, selects the system and registers its use. Both exclude systems in point 2 of Annex III, which are registered at national level (Article 49(5)).
• Article 26(8): deployers of high-risk AI systems that are public authorities, or Union institutions, bodies, offices or agencies, comply with the registration obligations in Article 49. A deployer that finds the system it envisages using is not registered in the EU database does not use it, and informs the provider or the distributor.
• Article 27(1): before deploying a high-risk AI system referred to in Article 6(2), deployers that are bodies governed by public law or private entities providing public services, and deployers of systems in points 5(b) and (c) of Annex III, perform an assessment of the impact on fundamental rights, with the exception of systems intended to be used in the area in point 2 of Annex III.

What about a system the customer already uses?

Article 111(2) is the transitional rule, and the public-authority case is its last sentence.

• Article 111(2), as replaced by Regulation (EU) 2026/1744: without prejudice to Article 5, the Regulation applies to operators of high-risk AI systems placed on the market or put into service before the date of application of Chapter III only if, from that date, the systems are subject to significant changes in their designs. In any case, providers and deployers of high-risk AI systems intended to be used by public authorities take the necessary steps to comply by 2 August 2030.