Regulation (EU) 2024/1689 on Artificial Intelligence — known as the AI Act — establishes the world's first horizontal legal framework for artificial intelligence. For systems classed as "high-risk", the full obligations apply from August 2026. For public administrations, this means that many tools already in use or about to be adopted become subject to a demanding regime of transparency, oversight and documentation.
What counts as "high-risk" in public administration
Annex III of the Regulation lists the uses of AI considered high-risk. Several of them directly affect public administration:
- Remote biometric identification in publicly accessible spaces (including facial recognition on municipal cameras, except for narrowly defined law-enforcement exceptions).
- Decision-making systems governing access to essential public services (social benefits, healthcare services, etc.).
- Systems used in the administration of justice and democratic processes.
- Systems for the management and operation of critical infrastructure (traffic control, utilities).
- Systems used by law enforcement authorities to assess individual risks or detect emotions.
There are also outright prohibited practices, with no possible exception for administrations: government "social scoring", biometric categorisation by racial origin, emotion inference in workplaces or educational establishments, and the creation of facial recognition databases through indiscriminate scraping.
Obligations for high-risk systems
When a system falls within Annex III, the provider (Labrax, in our case) and the deployer (the administration that puts it into use) take on different obligations:
Provider obligations
- A documented quality management system, with procedures covering the whole life cycle.
- Comprehensive technical documentation: design, training data, performance metrics, identified risks and mitigations.
- Log retention throughout the system's service life, with traceability of decisions.
- CE marking and EU declaration of conformity before placing on the market.
- Registration in the EU database of high-risk AI systems.
Obligations of the deploying administration
- Effective human oversight: trained staff must be able to override any decision made by the system.
- Informing the people affected: when a person is subject to an AI-based decision, they must be informed.
- A fundamental rights impact assessment before deployment.
- Log retention for a minimum of 6 months.
- Cooperation with the market surveillance authorities.
The Spanish case: AESIA and the regulatory sandbox
Spain is the first EU country to have set up a dedicated national authority for AI, the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), headquartered in A Coruña. AESIA is the competent authority for monitoring compliance with the AI Act in Spain and for authorising the regulatory sandbox that allows AI systems to be tested in controlled environments before large-scale deployment.
For Spanish public administrations, there are three key elements:
- AESIA as the market surveillance authority.
- AEPD as the competent authority whenever personal data is processed (which is almost always).
- A single point of contact in each administration to manage AI Act obligations.
Common AI systems in local government
Let's review the most common uses and the level of risk that applies:
| Use case | Risk | Implication |
|---|---|---|
| Number plate OCR (ANPR) without identifying individuals | Limited | Basic transparency |
| General-purpose municipal facial recognition | High / prohibited | Only narrowly defined cases |
| Residents' enquiries chatbot | Limited | Label as AI |
| Predictive analytics for social services | High | Documentation + oversight |
| Automatic pattern detection in vandal graffiti | High | Documentation + oversight |
| Automated crowd counting at events | Limited | Basic transparency |
The fine line lies in the detail. For example, an ANPR camera that only reads number plates and checks permits is limited risk. The same camera with added facial recognition becomes high risk or even prohibited, depending on the case.
How to prepare: four steps
1. Take stock of the AI systems in use
Many administrations are unaware of how many AI components they are running. Start with an inventory: which systems use models? Who supplied them? Is technical documentation available?
2. Classify by risk level
Each system must be placed in one of the Regulation's categories: prohibited, high risk, limited risk, minimal risk. The administration's consultants or the provider itself can advise.
3. Request the documentation from the provider
For high-risk systems, the administration must be able to demonstrate that the provider complies. Request the technical documentation, the declaration of conformity and the operational logs.
4. Appoint a point of contact and train staff
The AI Act requires the people operating the system to have adequate training. Appointing an internal lead and planning training is mandatory for high-risk systems.
How we approach it at Labrax
At Labrax we have products with AI components — notably Grafiti-ID and OCR-ID — designed to comply with the AI Act from the very first day the obligations apply. As our reference framework we work with ISO/IEC 42001, the international standard for artificial intelligence management systems, which provides the governance structure (roles, risk assessment, control of training data, oversight and continual improvement) underpinning much of what the European regulation requires. This includes:
- Complete technical documentation available to clients and authorities.
- Exportable operational logs, retained throughout the system's life cycle.
- Built-in human oversight mechanisms (no system takes final decisions affecting rights without the possibility of human review).
- Specific training for the operators of each product.
- Registration in the EU database of high-risk systems where applicable.
- AI management in line with ISO/IEC 42001, a certification Labrax holds.
If your administration is evaluating or deploying AI systems, we can help you navigate the AI Act and structure your compliance.
