K0NSULT — Public Sector: EU AI Act Deployer Support

What the EU AI Act requires of public deployers

When a public body uses a high-risk AI system, it acts as a deployer and inherits specific obligations. The two that most often get missed:

Deployer obligations Art. 26

Use per instructions, ensure human oversight, monitor operation, keep logs, inform affected persons where required, and cooperate with authorities.

Fundamental Rights Impact Assessment Art. 27

Public-sector deployers (and providers of essential public services) must assess the impact on fundamental rights before putting a high-risk system into use.

Transparency to citizens Art. 50

People interacting with AI, or exposed to AI-generated content, must be told. Deadline in scope: 2 Aug 2026.

This page is guidance, not legal advice. Every obligation above maps to a verifiable control in the K0NSULT Trust Center.

Typical high-risk public-sector uses

Benefit-eligibility scoring — social assistance, subsidies, allowances.
Education — admission, assessment, or proctoring systems.
Public-sector employment — recruitment, task allocation, evaluation.
Access to essential services — where an AI decision gates a citizen's access.
Safety components of critical infrastructure managed by public bodies.

What K0NSULT delivers

FRIA support

Templates and a guided assessment for Art. 27, tied to the specific use case and the citizens affected.

Control matrix

Each obligation mapped to a status: met / partial / gap — the claim never exceeds the proof.

LIVE monitoring

Continuous, public status instead of a point-in-time audit that ages the day it is signed.

Evidence room

Trust Center: security, GDPR, DPA, retention, incident response — one place, so InfoSec asks once.

K0-CST — Common Source of Truth (Polish institutions)

For Polish public administration we run a dedicated public program: K0-CST. It maintains a live, verifiable record of AI-Act / NIS2 / KSC readiness across institutions, with a strict rule:

The system records entries; it does not send filings to any authority. Dispatch is performed by the operator through e-Doręczenia / ePUAP, and the only proof of delivery is the UPP receipt in the operator's e-Delivery mailbox — never an email, never the timeline.

Understand the common source of truth and the claim ≤ proof method.

Verify the evidence, then measure your institution's readiness.

Assign an owner, run a P0 pilot, and move to LIVE monitoring.

Open K0-CST Read the call to action

Talk to us

Public-sector engagement, FRIA, or a readiness review — start here.

Book a review Trust Center

Public Sectorhigh-risk AI, done accountably