Public bodies that use high-risk AI agents carry the full deployer duties of Article 26 of the EU AI Act, plus extra ones the Act reserves for them. They must assign oversight to people with competence, training and authority, assess fundamental rights impacts and register their use. For public servants, competence means being able to explain and overturn a decision.
What does Article 26 require of a public body?
In substance, every deployer of a high-risk system must use it according to the provider's instructions; assign human oversight to natural persons with competence, training and authority, and support them; ensure input data under its control is relevant and sufficiently representative; monitor operation, inform the provider of risks and suspend use if a serious risk appears; report serious incidents; keep logs under its control for an appropriate period; inform workers' representatives before using it at work; and inform people subject to its decisions where required.
Public bodies carry more. Public authorities using high-risk systems must register that use in the EU database before putting the system into use. Under Article 27, bodies governed by public law, and private bodies providing public services, must carry out a fundamental rights impact assessment first. And public law adds its own duties: to give reasons, to treat like cases alike, and to allow review.
Which public sector agents are high-risk?
The Act treats several public uses as high-risk, in substance: evaluating eligibility for essential public assistance benefits and services, including healthcare, and granting, reducing, revoking or reclaiming them; evaluating and classifying emergency calls and dispatching emergency services; and certain uses in law enforcement, migration, asylum, border control and the administration of justice. Public bodies also use workforce and education agents, which are high-risk on their own terms.
Many public sector agents are not high-risk: one answering questions about bin collection days, drafting minutes or summarising consultation responses. They still need transparency under Article 50 when people interact with them.
What do competence, training and authority mean in a public body?
Competence for a caseworker is the ability to read the agent's recommendation, see the facts behind it and their provenance, and judge whether the outcome is lawful and fair for this person. Much evidence in public services is declared by the applicant; some is sealed in the body's own records; some is signed by another body; and some is external, such as an anonymous allegation. Caseworkers must know that a decision to reduce or reclaim money resting on an external allegation needs checking before anything else happens.
For digital and IT teams, competence means knowing how the agent's bounds are set, how to suspend it, and how to pull the record when a decision is challenged. The Dutch public sector offers a role-level example in AI agent training for IT administrators in the public sector in the Netherlands.
Authority means a caseworker can decide against the agent within the rules, ask for more evidence instead of refusing, or refer a case, without needing approval. Performance targets based on throughput can quietly remove that authority.
Training must keep pace with the agent. An agent's certificate lapses after 90 days and is renewed against the body's real cases; a run that clears no depth drops it to depth 1 the same day. Public services must keep running when that happens, so manual processing capacity is part of competence planning.
Support includes time per case and a culture that treats overturning the agent as normal work rather than a complaint against the system.
How does a public body meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Oversight assigned to named people | Named caseworkers and service owners per high-risk capability | Assignment register |
| Necessary competence | Assessment on the body's own past cases, including wrongly recommended refusals | Assessment records before decision rights |
| Necessary authority | Service rules allow decisions against the agent without approval | Rules; overrides in the record |
| Training kept current | Briefing at each agent recertification or rule change | Briefing records linked to agent changes |
| Monitor and suspend | Service owner suspends processing for a case category on error patterns | Suspension events and triggers |
| Register use | Use registered before go-live | Registration record |
| Fundamental rights impact assessment (Article 27) | Assessment covers the human oversight step and staff competence | Assessment versions and updates |
What counts as proof is set out in what evidence of competence is, and the role in what a deployer is under the EU AI Act.
What will auditors and regulators ask?
Public bodies face auditors, ombudsmen, courts, data protection authorities and market surveillance authorities. Expect: is this use registered? Show the fundamental rights impact assessment and how it describes oversight. Who decided this person's case, and what training did they have? How often do caseworkers decide against the agent? When were patterns of error noticed, and how fast was processing suspended? Can a person get the decision explained and reviewed by someone with authority to change it?
What does Article 26 not cover?
It does not set the rules of each public service, which come from the law governing that service. It does not apply to non-high-risk agents. It does not prescribe training content or credentials. It does not replace administrative law, freedom of information or data protection duties. Related deployer duties are covered in Article 26 duties in healthcare and in telecoms.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's certificates are issued through VerifyDoc.ai and can be checked at source by anyone, by number or QR code, and a public register lists certified people by name, credential and expiry. For a public body that must show an auditor or ombudsman who was competent to decide a case, that is a checkable record rather than an internal claim. The levels are in AI literacy and certification for people who work with agents.
Questions people ask
Do all public servants need Article 26 training?
Only those overseeing high-risk capabilities need the competence Article 26 describes. All staff dealing with AI need a baseline of literacy under Article 4.
Can a public body rely on the provider's training?
It can use it, but the duty to assign competent people is the body's own. The provider does not know the body's cases, rules or residents.
What if caseworkers never overturn the agent?
Treat it as a warning sign. Check whether caseworkers have the time, information and authority to disagree, and seed test cases to see whether they catch wrong recommendations.