The EU AI Act for local authorities: what must you already have in place?

Updated 15 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), published in the Official Journal of the EU on 24 July 2026 and entered into force on 27 July 2026. Through the Omnibus, the application dates for high-risk AI move to 2 December 2027 (stand-alone Annex III systems) and 2 August 2028 (AI in regulated products). The AI literacy obligation of Article 4 continues to apply, as it has since 2 February 2025; the Omnibus does reword that obligation slightly (see below).

Why local authorities are different from other organisations

For most organisations, the EU AI Act mainly revolves around Article 4, the obligation around AI literacy of staff; what Article 4 of the EU AI Act requires is something we set out elsewhere. What the law itself requires is set out on our pillar page about Article 4.

For local authorities it is different. Local governments take decisions about citizens, about benefits, permits, social services, enforcement. As soon as AI is introduced into these decision-making processes, each application must be evaluated against Annex III of the regulation. For public assistance, essential services, law enforcement and migration or asylum procedures, the chance of a high-risk AI classification is considerable.

That is not a matter of interpretation. Annex III lists the high-risk AI applications explicitly, and among them are: AI for access to essential public services, AI for assessing or granting public assistance, AI for law enforcement, AI for migration and asylum procedures. Local authorities touch all these areas in their daily practice.

What local governments often do not realise

In conversations with municipal secretaries and IT coordinators, the same pattern keeps coming up: people know that the EU AI Act exists, but underestimate the sheer breadth of the term "AI system". The law applies not only to spectacular applications such as facial recognition or predictive policing. It also applies to everyday tools, with very different risk levels:

Where these tools qualify as AI systems and are used by or on behalf of the local authority, the authority will generally be the deployer. The Article 4 obligation applies to all cases. For the applications that turn out to fall under Annex III, the specific high-risk AI obligations come on top.

How much of that use happens out of the organisation's sight is a story of its own.

What is already mandatory now, what is still to come

Already in force. Article 4 on AI literacy has applied since 2 February 2025. Providers and deployers of AI systems must take measures that support the AI literacy of their staff and of those who work with AI on their behalf, tailored to role, experience and context of use. The Omnibus is intended to clarify that this is an obligation of means: you do not have to guarantee a specific level per person, but you do have to take demonstrable measures. For local authorities, this is the most concrete obligation at this moment. We set out separately what the Digital Omnibus did and did not change. Our free EU AI Act Compliance Checklist takes you through what "demonstrable" means in practice.

On 2 December 2026. The Digital Omnibus adds a new obligation: a ban on AI systems for non-consensual intimate-content generation, often referred to as "nudification", and on AI that can generate child sexual abuse material. Relevant for IT procurement policy and for what ends up in the municipal AI tool inventory.

On 2 December 2027. The high-risk AI obligations for stand-alone systems under Annex III become enforceable on this date. Originally, 2 August 2026 was set in Regulation 2024/1689. That date fell away with the Digital Omnibus and the new date has been binding since 27 July 2026. We set out separately what did and did not change on 2 August 2026.

On 2 August 2028. On that date, the high-risk AI obligations become applicable for AI systems embedded in regulated products.

The extra time is not a free pass. For systems that will later be classified as high-risk AI, the provider obligation to carry out a conformity assessment lies primarily with the supplier. For local authorities as deployer, something else applies: using the system in line with the instructions, arranging human oversight with people trained for it, keeping input data under control, monitoring use, reporting serious incidents, keeping logs, checking that required EU database registration has been completed before use, informing affected persons where the law requires it, and cooperating with supervisory authorities.

Who supervises, which rights do citizens get

In Belgium and the Netherlands, supervision is being organised through national and sectoral authorities. For local governments, privacy supervision, sectoral supervision and market surveillance will overlap in practice. In Belgium, the list of fundamental rights authorities under Article 77 has now been published, and it concerns several designated bodies. FPS Economy acts as the official publication and coordination point, not as the sole regulator. The broader supervisory structure (market surveillance, national competent authorities) is being further filled in. In the Netherlands, the supervisory structure is still being finalised through national implementation legislation. We track what changes around the AI Act every working day in the EU AI Act Monitor.

For citizens, Article 86 can create a right to a clear and meaningful explanation where a decision is taken on the basis of output from an Annex III high-risk AI system, and that decision has legal or similarly significant adverse effects. This does not apply to every AI-supported administrative step. In addition, for high-risk AI, local authorities must arrange human oversight and keep their existing objection and appeal procedures in order. Complaints are inevitable.

The four roles that must be trained differently in every local authority

One generic training for all officials is not enough for Article 4, and certainly not for local authorities that are going to work with high-risk AI. The law requires the level of training to fit the role. In practical terms, there are four groups that each need their own approach:

The foundation for that is our AI literacy training under the AI Act. The in-depth material for local authorities is on our public sector page.

A local authority that does not address these four roles separately will find it hard, at an audit, to demonstrate that the Article 4 obligation has been taken seriously.

What you can realistically do now

The postponement of the high-risk AI deadlines to 2027 and 2028 changes the time pressure, not the task. The Article 4 obligation already applies, and the time until 2 December 2027 is exactly what a local authority needs to take the high-risk steps carefully rather than in a rush.

Coming months:

The rest of 2026:

2027:

What it brings your local authority

It is tempting to see the EU AI Act as compliance overhead, yet another obligation on top of the GDPR and NIS2. For local authorities there is a second side. A local authority that has its AI use in order takes better decisions, protects citizens against unjustified decisions, and builds trust with residents who are becoming ever more critical of algorithmic government. That is not a luxury, that is the basic legitimacy of local government in 2026 and beyond.

At AIAdopt, we have tailored the base package and the Public Services sector extension (M3-PD) specifically to the reality of Belgian and Dutch local governments. Every training ends with an assessed certificate that lists the AI Act articles covered, the very evidence a supervisory authority may ask for. We calculated separately what training delivers. And otherwise, you can simply get in touch.

Written by Rob Ummels in collaboration with Claude (Anthropic). Editorial responsibility: AIAdopt.