Clean before AIENSL
AI for business · Industry guide

🏛️ AI rules: Public sector and municipalities

Public bodies have extra duties: fundamental rights impact assessments, registration of high-risk AI and, in Slovenia, a public register of high-risk AI in the public sector.

Typical AI uses and their risk level

Minimal
Drafting letters and summaries with AI

Minimal; personal data only in approved tools with a DPA.

High risk
Deciding on social benefits or subsidies with AI

High risk (Annex III, point 5); FRIA; registration.

Transparency
A citizen chatbot on the municipality website

Say it is AI; accessibility rules for public websites.

Transparency
AI-written public announcements

Label unless editorially reviewed.

What to do

  • Adopt an AI policy and train officials (AI literacy).
  • Use MCC-AI clauses in procurement.
  • Plan FRIAs and registration for high-risk uses before 2 Dec 2027.
  • Existing high-risk systems must comply by 2 Aug 2030.

Common pitfalls

  • Free AI accounts for officials — data may leave the EU and be used for training.
  • Automated decisions in administrative procedures need a legal basis.

Examples

A municipality summarises public consultation comments with AI

Minimal risk if officials read the originals; be transparent in the report that AI helped.

Rules that apply

Applies in phasesAI Act

Applies to anyone who develops AI (provider), uses AI in their business (deployer), imports or distributes it in the EU — also to companies outside the EU if the output is used in the EU. Private, non-professional use is excluded.

In forceZIUDHPUI

If you have a question about the AI Act in Slovenia, AKOS is the entry point. Which authority inspects you depends on the area: e.g. the Information Commissioner for prohibited practices and biometrics, the Bank of Slovenia for credit scoring.

In forceGDPR

For most companies GDPR matters more than the AI Act: it decides whether you may put customer or employee data into an AI tool at all. In Slovenia it is supplemented by ZVOP-2 and supervised by the Information Commissioner.

In forceZVOP-2

AI on cameras (face recognition, behaviour analysis) and biometric attendance systems fall under strict ZVOP-2 rules — often they are simply not allowed. The Information Commissioner has published opinions on AI, e.g. on misleading use of AI systems and on accountability.

In forceEuropean Accessibility Act

If a chatbot or voice assistant is the way customers reach your service, it must also be accessible (e.g. usable with a screen reader, with a text alternative to voice). AI can help — automatic image descriptions, captions — but results must be checked.

Get your full list of obligations →
Other industries
👥 HR and recruitment🏦 Banks, insurers, leasing🩺 Healthcare📣 Marketing, media and design🛒 Retail, e-commerce, customer service🎓 Schools, universities, training🏭 Manufacturing, machines and products💻 Software and IT services⚖️ Lawyers, accountants, consultants

General information, not legal advice — consult a lawyer for borderline cases. Regulations reviewed on 29 Sep 2026.