Visa and asylum decisions

AI assistance with asylum, visa or residence-permit applications, related complaints and evidence-reliability assessments is high-risk, not prohibited. Main duties are scheduled for 2 December 2027. Until then, existing asylum, immigration, administrative, equality and data-protection law does most practical work.¹²

From that date, Articles 9 to 16 will require providers of qualifying systems to manage risks and datasets, maintain logs and documentation, support human oversight, and address accuracy, robustness and cybersecurity. Article 26 will require immigration and asylum deployers to appoint competent oversight, monitor operation, suspend risky use and retain controllable logs. Article 74(8) authorities will enforce both sets of duties.¹²

Article 27 will require a public immigration or asylum authority to assess fundamental-rights effects before first deploying such a system and notify the market-surveillance authority. The deployer bears the duty, the Article 74(8) authority enforces it, and it starts on 2 December 2027. Article 26(11) will also require the deployer to inform affected applicants that high-risk AI is being used, unless the Law Enforcement Directive information regime applies. The same authority and date govern that duty.¹ These duties regulate authorities and system providers. They do not guarantee a visa, protection status or successful complaint.

You may have routes now. Since 2 August 2026, Article 86 has provided a significantly and adversely affected applicant with a right to a clear, meaningful explanation from the deployer about a qualifying system’s role and the decision’s main elements, subject to legal restrictions and only where Union law does not already provide that right. Article 85 permits a complaint to the relevant market-surveillance authority.¹ The Act supplies no prescribed request format, response deadline or dedicated appeal route. Its operation before the Annex III rules begin is unresolved, and the national contact list remained incomplete in September 2026.³

Where the GDPR governs, Article 15 allows access to personal data and information about qualifying automated decision-making, while Article 16 supports correction of inaccurate data. Article 22 restricts solely automated decisions producing legal or similarly significant effects. The controller bears these duties, national data-protection authorities and courts enforce them, and they have applied since 25 May 2018. Article 77 provides a complaint route.⁴ This may be more useful than waiting for the AI Act machinery.

The Commission’s AI Office complaint form is not a universal portal for national visa or asylum systems. It accepts only matters within the AI Office’s exclusive competence, while ordinary Article 85 complaints go to the relevant national authority.⁵

Boundary. National-security and qualifying international-cooperation systems can fall outside the AI Act. Some older components of specified large-scale EU migration systems have until 31 December 2030 to comply, so not every system receives the full regime in 2027 or 2028.¹