Why the public sector needs AI now
Correction notice of 4 September 2026: this article previously cited rates for the automatability of enquiries and for hit accuracy for which no primary source was available. These figures have been removed without replacement. The application scenarios described remain unchanged; they now work without percentages.
A digitalisation backlog, OZG deadlines and the skills shortage are forcing the public sector to act. What an AI platform fit for public authorities should deliver, with an analysis of the EU AI Act, BSI Grundschutz and the GDPR.
Public administration in Germany faces a paradox: on the one hand, it administers the most complex bureaucracy in Europe, with more than 575 administrative services that the Online Access Act (OZG) requires to be digitalised. On the other hand, many public authorities face the task of converting paper files and legacy IT systems into digital processes. The eGovernment MONITOR 2025 by Initiative D21 and the Technical University of Munich shows how little of this reaches citizens: only 15 per cent of respondents in Germany feel their expectations of a modern digital administration are met, compared with 36 per cent in Austria and 46 per cent in Switzerland (Initiative D21 and TU Munich, “eGovernment MONITOR 2025”, survey April/May 2025, initiatived21.de/publikationen/egovernment-monitor/2025).
The OZG was passed in 2017 with the aim of digitalising all administrative services by the end of 2022. The OZG Amendment Act (OZGÄndG), which came into force in July 2024, now takes a phased approach that prioritises the most frequently used services. But the fundamental problem remains: public administration has to catch up within a few years on what the private sector has built over two decades, and with fewer staff than ever before.
The skills shortage hits the public service particularly hard. The dbb beamtenbund und tarifunion puts the staff shortage in the public service at around 600,000 employees, with the dbb survey counting not vacant posts but the staff actually needed to carry out tasks efficiently (dbb, “Monitor öffentlicher Dienst 2026”, as of 17 December 2025, dbb.de). On top of this comes the wave of retirements among the baby-boomer cohorts, which will further thin out staffing levels in the coming years. At the same time, public authorities are competing with the private sector for IT specialists.
At the same time, there is a rise in citizens' expectations. Anyone who makes real-time transfers with their bank, checks an order status on Amazon in seconds and communicates with their insurer via chat no longer accepts that a building permit application sits for six months and that a registration certificate requires a personal visit to a public authority. The policy programme Digital Decade 2030 of the EU (Decision (EU) 2022/2481) sets the target that key public services should be 100% available online by 2030.
In this context, artificial intelligence is neither a gimmick nor innovation theatre. It is the only realistic way to catch up on the digitalisation backlog without doubling staff numbers. But, and this is the crucial point, not every AI is suitable for the public sector. The requirements for data protection, sovereignty and legal certainty in a public authority setting are orders of magnitude higher than in the private sector.
The data protection dilemma: what public authorities look for in AI providers
When a municipality, a district office or a federal ministry wants to use AI, different rules apply than for a medium-sized company. Public authorities process official government data: registration data, social data, health information, tax data, criminal record entries. This data is subject not only to the GDPR but also to the state data protection laws, the Social Code (SGB X), the Fiscal Code (§ 30 AO) and, in security-related areas, the Security Clearance Check Act (SÜG) and the Classified Information Directive (VSA).
Within this legal framework, using AI systems from non-European providers requires careful case-by-case assessment. The CLOUD Act (18 U.S.C. § 2713) provides that US providers of communication and cloud services must hand over data under the conditions specified there, even if it is stored outside the US. If a German public authority processes citizens' personal data using a US AI model, the US Department of Justice can theoretically demand access to this data.
The CJEU stated unequivocally in Case C-311/18 (Schrems II) that the US level of data protection does not meet the European standard. In doing so, it relied on the powers under FISA Section 702 and Executive Order 12333. The EU-US Data Privacy Framework (DPF) of July 2023 is based on an executive order of the US President. For the processing of official government data, this basis must be assessed on a case-by-case basis.
The Federal Office for Information Security (BSI) sets out in its IT-Grundschutz modules clear requirements for cloud services used by public authorities. The module OPS.1.1.5 “Cloud Usage” requires, among other things, that “data sovereignty remains with the cloud user” and that “the cloud service provider may not pass the data on to third parties without the client's knowledge”. These requirements apply to every cloud provider and belong in every selection decision. For classified information, the requirements of the VSA also apply.
The Conference of the Independent Data Protection Supervisory Authorities of the Federation and the federal states (DSK) has also repeatedly pointed out that the use of US cloud services by public bodies requires special justification. The specific use case, data categories, contracts, regions and technical controls are decisive for the selection. Deriving blanket personal liability, or the legal suitability of a platform, solely from the company's registered office is not appropriate.
What an AI platform fit for public authorities must deliver
The technical requirements for an AI platform in a public authority setting go far beyond what is customary in a private sector context. The IT-Grundschutz standards of the BSI, the requirements profile of the IT Planning Council and the circulars of the Federal Commissioner for Data Protection and Freedom of Information (BfDI) define a framework that allows no compromises. Every AI platform that is to be used in public administration must not only be aware of these requirements but also demonstrably meet them.
1. Hosting on German or EU servers, without exception
Data processing must take place entirely on servers that are located in the EU and operated by an EU company. As well as the server location, what matters is which legal system the operator is subject to. For public authorities with increased protection requirements (e.g. police, judiciary, intelligence services), only servers in Germany come into consideration, operated by German companies that do not belong to a non-European group structure. The BSI certifies such data centres according to ISO 27001 on the basis of IT-Grundschutz.
2. Strict tenant separation
If several public authorities use a shared platform, technical tenant separation must ensure that the data of one municipality is not visible or accessible to another, not even by accident. A simple database filter is not enough here. Separation must take place at infrastructure level: separate database schemas, separate vector spaces for AI search, JWT-based isolation in which the tenant assignment cannot be manipulated. For classified information at VS-NfD level and above, the VSA prescribes physical separation.
3. Complete audit logs and record-keeping
Public administration is subject to the registry-keeping obligation and the principles of proper record-keeping. Every interaction with an AI system (whether a search query, a generated answer, an analysed document or automated decision support) must be fully documented. The Audit trail must be tamper-proof and contain at least a timestamp, user ID, action performed, input and output. Archiving is subject to the retention periods of the relevant filing regulations, ten years or more for some administrative acts. Art. 5(2) GDPR (accountability) and Art. 26(6) of the EU AI Act (retention of logs by deployers of high-risk AI) interlock here.
4. Granular role concepts
Public authorities work with clearly defined responsibilities. A caseworker may see different data than a head of office, and a data protection officer needs access to the audit logs but not to the case data. An AI platform fit for public authorities must support a role-based access control model (RBAC) that is aligned with the organisational structure of the authority. At least four roles are needed: administrator, specialist user, read-only user and auditor. Better still: a configurable role system that can be adapted to the particular features of each authority. The BSI module ORP.4 “Identity and Access Management” requires the consistent implementation of the principle of least privilege.
5. European AI model
The underlying language model should come from a European provider that is subject to European law. Mistral AI is a French Société par actions simplifiée based in Paris that develops language models for business use. As a European company, Mistral AI is subject to the GDPR and to supervision by the French CNIL. Whether a provider is additionally subject to US law, for example through group companies, infrastructure or subcontractors, is part of the assessment. For public authorities, this question is a central selection criterion. A European model provider simplifies the data protection assessment of processing official government data.
Concrete application scenarios for public authorities
AI in public administration is not a future scenario. There are already clear, practical use cases today that can fundamentally improve everyday work in public authorities. The following scenarios show typical areas of application that can be implemented with an AI platform built in line with data protection requirements.
Knowledge management: making laws, regulations and administrative provisions searchable
A caseworker at the social welfare office works every day with SGB II, SGB XII, the associated implementing regulations, the instructions of the Federal Employment Agency and the municipal guidelines. That is thousands of pages of legal text that change constantly. When a citizen asks a question about their entitlement to benefits, the caseworker has to find the right provision, check the current version and take the interpretation guidance into account. This search takes up a considerable part of the daily working time.
An AI-powered knowledge base changes this fundamentally. All relevant legal texts, administrative provisions, interpretation guidance and internal guides are loaded into the knowledge base. The AI understands the content semantically, not as a full-text search but with genuine contextual understanding. The caseworker asks in natural language: “Which income limits apply to housing benefit entitlement for a family of three in Bonn?” The AI finds the relevant sections in the WoGG, the current rent level for Bonn and the applicable income limits, in seconds rather than minutes.
Automating citizen enquiries
Every citizens' office, every municipality and every district administration answers hundreds of similar enquiries every day: opening hours, responsibilities, required documents, processing times, fees. These enquiries tie up qualified staff who are then not available for more complex tasks. An AI-powered chatbot on the municipality's website or a VoiceBot at the switchboard can answer such recurring questions automatically, around the clock, without waiting times, in plain language. The chatbot accesses the authority's knowledge base and answers questions such as: “Which documents do I need to register a change of address?”, “How long does it take to process a passport?” or “Who do I contact about an objection to my property tax assessment?”
What is crucial here is the transparency obligation under Art. 50 of the EU AI Act: the chatbot must identify itself as an AI system at the start. And just as crucial: for complex matters, a seamless handover to a human caseworker must be possible. AI does not replace the civil servant; it relieves them so that they can concentrate on the cases that require human judgement.
Document analysis and case processing
Public authorities process mountains of documents: applications, administrative decisions, statements, expert reports, submissions. Many of these documents contain structured information that has to be transferred manually into specialist applications: name, file reference, application data, amounts, deadlines. AI-powered document analysis can extract this data automatically, check it against the specialist application and present it to the caseworker as a pre-filled record for review and approval. Manual typing is where transcription errors occur, and it is precisely this step that is eliminated. We are happy to show you how extraction works in your organisation using your own documents. In every case, the record is approved by the caseworker, and human review remains the final step.
Process automation
Administrative processes follow defined procedures: application, completeness check, case processing, hearing, issuing of the decision, formal delivery, notice of legal remedies. Many of these steps are rule-based and can be automated. An application for housing benefit, for example, goes through defined checking steps (proof of income available, rent certificate available, household size plausible) that an AI platform can work through automatically. The caseworker receives a pre-checked case with a recommendation instead of starting from scratch. This speeds up processing, reduces errors and frees up capacity for the cases that require a genuine exercise of discretion.
EU AI Act and public administration: special obligations
The EU AI Act (Regulation (EU) 2024/1689) affects public administration to a particular degree. Legislators recognised that AI systems in the hands of the state have a different impact than in the private sector, because state action is not optional. Anyone who receives an administrative decision from a public authority cannot simply avoid it the way they would avoid a product they do not like. That is why stricter rules apply to the public sector.
Art. 6 and Annex III: high-risk AI in public authorities
Annex III of the EU AI Act lists the areas of use in which AI systems are automatically placed in the high-risk category. Several of these areas directly concern public administration:
- Access to essential public services and benefits (No. 5(a)): AI systems that decide on, or significantly influence, access to or the granting of social benefits, public services or healthcare
- Law enforcement (No. 6): AI systems for risk assessment, the detection of criminal offences, profiling or the evaluation of evidence
- Migration, asylum and border control (No. 7): AI systems used in the examination of asylum applications, in risk assessments or in the verification of documents
- Administration of justice and democratic processes (No. 8): AI systems that assist courts in applying legal provisions or assessing facts
When a public authority uses AI in one of these areas, it is subject to the strictest requirements of the EU AI Act (Art. 8-15): risk management system, data quality requirements, technical documentation, record-keeping obligations, transparency, human oversight and evidence of accuracy. These are not optional best practices. They are legal obligations with fines of up to €15 million or 3% of annual turnover (Art. 99(4)).
Transparency and documentation obligations
Art. 26 of the EU AI Act sets out the obligations of deployers, that is, the public authorities that use AI systems. The obligations are extensive: deployers of high-risk AI must ensure that a data protection impact assessment under Art. 35 GDPR is carried out (Art. 26(9) of the EU AI Act). They must retain the automatically generated logs of the AI system for at least six months (Art. 26(6)). And they must inform natural persons who are affected by automated decisions about the use of AI (Art. 26(11)), an obligation that goes beyond the general transparency obligation under Art. 50.
For public administration, there is a further dimension: the Administrative Procedure Act (VwVfG). § 35a VwVfG governs the fully automated issuing of administrative acts and requires the authority to document its decision-making in a traceable way. If AI is used to prepare decisions, the authority must be able to prove which data the AI drew on, which recommendation it gave and how the final decision was reached. An AI platform without complete audit logs is simply not usable in this context.
Updated on 23 August 2026 following Amending Regulation (EU) 2026/1744, in force since 27 July 2026. It postpones the high-risk obligations under Art. 6(2) and Annex III to 2 December 2027 and those under Art. 6(1) and Annex I to 2 August 2028.
The deadlines are clear: the high-risk requirements for public authorities apply from 2 December 2027. The transparency obligations for chatbots and VoiceBots have applied since 2 August 2026. Public authorities that are starting their evaluation now are best advised to plan the procurement process under EVB-IT and public procurement law at an early stage.