Benefits and healthcare

Core judgement

The AI Act does not prohibit automated benefit administration. It lists systems used by a public authority, or on its behalf, to decide eligibility for essential public assistance as high-risk. It also covers granting, reducing, revoking or reclaiming those benefits or services, including covered public healthcare access.¹ The main provider and deployer duties for this category begin on 2 December 2027.²

This category is narrower than all healthcare AI. A clinical recommendation is not covered merely because it relates to health.¹

Article 86 has applied since 2 August 2026, but whether its Annex III high-risk trigger operates before the classification rules apply on 2 December 2027 remains unsettled.¹² If the trigger operates now, the public authority or other deployer must explain AI’s role and the main elements of a legally or similarly significantly adverse covered decision; national competent authorities enforce the duty.¹ Article 85 complaints follow national procedures, but as of 12 September 2026 this dossier did not map them.¹ Article 86 applies only where EU law does not already provide an equivalent explanation right. It sets no request format, response deadline or appeal route, so a person must identify the competent national authority and any separate benefit appeal process.¹

The figure distinguishes covered public-assistance decisions from other healthcare uses and identifies the duties attached to covered decisions.

flowchart TD
    A["Public authority or body acting for it uses AI"] --> B{"Decision concerns eligibility, granting, reduction, revocation or reclaiming?"}
    B -->|Covered kind| C["Annex III public-assistance listing"]
    B -->|Other healthcare use| G["This category alone does not establish high-risk status"]
    C --> D["Since 2 August 2026<br/>Article 86 applies; interim Annex III trigger unsettled<br/>If triggered, deployer explains qualifying adverse decision<br/>Market authority enforces"]
    C --> E["From 2 December 2027<br/>Article 26: deployer gives an AI-use notice<br/>Market authority enforces"]
    C --> F["Before first use from 2 December 2027<br/>Article 27: public-service deployer assesses rights and notifies<br/>Market authority enforces"]

Figure: Covered public-assistance decisions have an unsettled interim explanation trigger, followed by notice and assessment duties from December 2027.

The GDPR can provide a more established route now. Since 25 May 2018, Article 22 has restricted legally or similarly significant public-service decisions based solely on automated processing of personal data. The public body or other controller bears the duty, and data-protection authorities and courts enforce it.³ Where law authorises the automation, that law must provide suitable safeguards, but Article 22 does not itself specify human intervention for this ground. A person can complain to the data-protection authority in their residence country, workplace country or the country of the alleged infringement.³

From 2 December 2027, Article 26 requires the public authority or other deployer to tell a person that high-risk AI is making or assisting the decision. Article 27 requires public-law bodies and private entities providing public services to assess fundamental-rights effects before first use and notify the authority. Articles 10 and 16 require the provider to use sufficiently representative data and address harmful bias. The designated market-surveillance authority enforces these duties.¹

Boundary. These duties do not guarantee that a benefit will be granted or restored. National benefit and healthcare appeal rights vary and were not researched here. Nor does this category cover every clinical system. Qualifying medical-device AI follows a separate Article 6 route, with its high-risk application date set for 2 August 2028 and sectoral market surveillance.⁴