In June 2024, the European Union adopted the AI Act, globally the first attempt to comprehensively regulate artificial intelligence (AI). As the uptake of AI increases across all domains, so will the impact of the AI Act. At the national level, experimentation with AI systems in the public realm occurs especially in public administration. Examples include the allocation of public benefits, the prevention of crime, or the granting of visa or asylum requests, where authorities may use AI-created risk profiles of individuals as decision-support. By requiring Member States to bring their laws and practices in this respect in line with its requirements, the AI Act will have a significant impact on national administrative procedures.
This post outlines a related but largely overlooked impact of the AI Act. The AI Act potentially shapes the work of public authorities well beyond the immediate reach of its provisions. As a piece of EU legislation, the AI Act triggers the application of so-called “second order EU law”, that is general principles of Union law and the EU Charter of Fundamental Rights (CFR, “the Charter”). This has significant implications, as it may contribute to the Europeanisation of national administrative law and shift the boundary between the realms of EU public law and domestic public law in the area of digital regulation. Through this analysis, this post also bridges two recent debates hosted by Verfassungsblog: on the transformative influence of the EU Charter of Fundamental Rights on the one hand and the EU AI Act’s impact on national security law on the other.
The “Trigger Function” of the EU AI Act
Absent a general fundamental rights competence of the EU, the Charter can constrain Member State action only within the realm of existing competences. This is reflected in Article 51(1) CFR, which sets out that the provisions of the Charter are “addressed to […] the Member States only when they are implementing Union law”. The broad contours of what this means have been set out in Åkerberg Fransson, where the Court of Justice of the European Union (“the Court”) held that the Charter applies to all Member State activities that fall within the scope of EU law so that, as Lenaerts put it, the Charter “is the ‘shadow ‘ of EU law”.
So, when does a Member State activity fall within the “scope of EU law”? Neither the existence of EU competence nor its exercise through the adoption of secondary law are sufficient, in and of themselves, to trigger the Charter’s applicability. In other words, the adoption of the AI Act alone does not bring all national activities that fall within the scope of the AI Act also within the scope of EU law for the purposes of Article 51(1) CFR. Instead, a “direct relationship” is required between a national activity and Union law to trigger the Charter’s applicability. The most important factor the Court takes into account in this respect is whether there is a specific rule of EU law “which is applicable, independent and different from the fundamental right itself”. For our purposes, this means that a Member State activity comes within the scope of EU law only if a specific provision of the AI Act regulates it in a significant way.
A consequence of this approach is that the question of the Charter’s applicability cannot be assessed in the abstract, but only in relation to a concrete situation. This is particularly true in the case of a complex regulatory instrument like the AI Act where, as explained in detail by Mir, the specific rule applicable depends on the role of the public authority in the “life-cycle” of the AI system and the risk classification of the AI system used.
An additional complicating factor is that, in the public sector, AI systems are often used in the context of complex, multi-stage procedures in areas that are dominated by national law (e.g. public benefits allocation). It is not at all uncommon that an activity is not completely determined by EU law, but only some elements of it are. As a rule, in those situations, the aspects of an activity that are not regulated by a specific provision of EU law remain outside its scope and will also not be governed by the Charter. As the Court held in TSN and AKT, “where the provisions of EU law in the area concerned do not govern an aspect of a given situation […], the national rule enacted by a Member State as regards that aspect falls outside the scope of the Charter” (emphasis added). Notwithstanding this general rule, included in the scope of EU law within the meaning of Article 51(1) CFR are also national rules that are, “instrumental to the effective realisation of an EU law based obligation on the national level”. Most commonly, this occurs where EU law regulates an activity in substance and pre-existing national law fills the vacuum in relation to procedural aspects. Examples include national rules governing access to documents (Ispas), the admissibility of evidence (Steffensen), or the availability of legal aid (DEB).
The AI Act as a “Gateway” for EU Principles of Procedural Justice
How does this play out in relation to the AI Act? As a piece of product safety legislation, the AI Act largely establishes procedural obligations that are to ensure the accuracy, fairness, and legality of outputs, but does not set specific substantive requirements for the outputs themselves. Thus, when AI systems are used in an administrative context, aspects of administrative procedure more clearly fall within the scope of EU law than substantive ones. As a consequence, the most relevant parts of second order EU law that national authorities will be subject to by virtue of the adoption of the AI Act are the principles of procedural justice enshrined in the Charter and general principles of Union law. Moreover, the AI Act’s primary regulatory target are the AI systems themselves, including their development and deployment, rather than the decisions taken on the basis of AI output. For multi-step administrative procedures this means that the stages closest to the use of the AI system are those most likely to also be governed by second order EU law.
Consider, for example, a public authority that uses AI-created risk profiles of individuals to assess their likelihood of committing student loan fraud that they rely on to decide whether to conduct home inspections and, possibly, demand repayment of the amounts received. The activity of deploying an AI system to create risk profiles of students is clearly regulated by specific provisions of the AI Act, which requires the authority, for instance, to conduct a prior fundamental rights impact assessment (Article 27 AI Act) and to assign human oversight to a natural person while the AI system is in use (Article 26(2) AI Act). This activity, including national rules applied to give effect to these safeguards, thus clearly comes within the scope of EU law.
But what about the decisions taken on the basis of the AI-created risk profiles? The AI risk profiles will have “materially influenced” (Article 6(3) AI Act) the decision to conduct a house inspection, possibly also the decision to revoke the student loan. While the AI Act’s provisions concerning high risk applications are thus applicable, there are few provisions that actually concern the decisions taken on the basis of an AI’s output directly. One that does, though, is Article 86 AI Act, which requires deployers of AI systems to provide those affected with “meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken”. We may thus speculate that these procedural aspects of the decision come within the scope of EU law for the purposes of Article 51(1) CFR, whereas substantive aspects might remain outside. By way of example, when the authority using the student loan algorithm provides the explanation required by Article 86 AI Act, it will also have to comply with the principles of good administration under EU law, including the duty reason or the right to be heard, and offer remedies that live up to the right to an effective remedy enshrined in Article 47 CFR. In contrast, whether the home inspections disproportionately interfered with the right to private life or whether the decision complies with the requirements of non-discrimination law probably remain domains for national law, unless governed by rules outside the context of the AI Act.
When and Why This Matters
How significant this is in practice is difficult to predict. To some extent, it depends on the degree to which similar obligations for public authorities exist under national law. Where, for instance, the EU law duty to reason differs or goes beyond its counterparts in national law, national authorities are bound to comply with EU law when AI systems are involved. Similarly, the remedies they have to offer, for example, for individuals to challenge the sufficiency of the explanations they have received, may include remedies that otherwise do not exist in national law. Conversely, where national law and practices already comply with the threshold required by EU law, the substantive effect is practically less noticeable.
Regardless of the practical impact, however, the applicability of EU principles of procedural justice, as opposed to national ones, has consequences for the broader relationship between EU and national public law. As Advocate General Saugmandsgaard Øe pointed out in Commission v Hungary, once applicable, the Charter “has the effect of limiting the regulatory and policy approaches available” to the Member States, “while the power of the EU to set the boundaries of what is possible increases correspondingly”. In addition, institutionally, the applicability of second order EU law also triggers the competence of the Court to monitor Member States’ compliance with fundamental rights and general principles. The Court, then, “take[s] the place of national constitutional courts and the European Court of Human Rights” in that respect.
From this perspective, the AI Act contributes to the Europeanisation of national administrative law not just because of the extensive obligations it sets out, but also by triggering the applicability of EU principles of procedural justice. More broadly, this shifts the boundary between the realms of EU public law and domestic public law in the area of digital regulation.
