AI Public Sector Liability Claims in Europe

1. Meaning and Scope

AI public sector liability claims arise when a government authority, municipality, public hospital, police authority, welfare agency, tax authority, immigration body, court administration, or other public institution uses an artificial-intelligence system and an individual suffers legally recognizable harm because of that use.

Examples include:

AI-based welfare eligibility or fraud detection;

automated tax-risk assessment;

predictive policing and facial recognition;

AI-assisted immigration and border decisions;

automated public-sector recruitment;

algorithmic allocation of housing or public benefits;

AI-assisted healthcare in public hospitals;

automated administrative decision-making;

AI-supported judicial or prosecutorial systems;

public-sector employee monitoring;

algorithmic risk scoring;

AI systems used for public procurement or licensing.

There is not yet a single European cause of action called “AI public-sector liability.” Liability is instead constructed from several overlapping bodies of law:

administrative/public law;

state liability;

EU law;

GDPR;

European Convention on Human Rights;

equality and anti-discrimination law;

public-service negligence;

product liability;

contractual liability, where applicable;

fundamental-rights law;

increasingly, the EU AI Act.

The central legal question is usually:

Did the public authority exercise its statutory powers lawfully, proportionately, fairly and with adequate human oversight when deploying or relying upon AI?

2. Why Public-Sector AI Creates Special Liability Problems

Public authorities differ from private companies because they exercise coercive or welfare-related governmental powers.

An erroneous commercial recommendation may cause financial inconvenience. An erroneous government algorithm can result in:

loss of social benefits;

wrongful taxation;

immigration consequences;

police surveillance;

denial of public services;

discriminatory treatment;

wrongful employment decisions;

reputational damage;

unlawful processing of personal data;

restrictions on liberty;

wrongful criminal investigation.

Therefore, public-sector AI is subject not merely to ordinary negligence principles but also to legality, proportionality, procedural fairness and fundamental-rights requirements.

3. Main Categories of AI Public-Sector Liability

A. Wrongful Automated Administrative Decisions

A public body may use AI to determine:

benefit eligibility;

tax liability;

housing allocation;

permits;

licenses;

immigration risk;

fraud probability.

If the system produces an erroneous result and the authority automatically adopts it, the affected person may challenge:

the decision itself;

the legality of the algorithm;

the data used;

the absence of human review;

the reasoning supplied;

procedural fairness.

The important European principle is that automation does not eliminate the public authority's legal responsibility.

4. GDPR Liability

Public-sector AI frequently processes personal data.

Relevant GDPR issues include:

lawful basis;

purpose limitation;

data minimisation;

accuracy;

transparency;

profiling;

automated decision-making;

special-category data;

data protection impact assessments;

security;

access and rectification;

compensation.

SCHUFA — C-634/21

The CJEU's decision in SCHUFA, C-634/21 (7 December 2023) is particularly important.

The Court examined automated scoring under Article 22 GDPR. It held, in substance, that a score may constitute a prohibited automated decision-making situation where the recipient of the score gives it a decisive role in making the final decision.

This is highly relevant to public authorities.

For example, if a welfare authority receives an AI-generated fraud score and routinely treats that score as determinative, the authority cannot necessarily avoid Article 22 simply by saying:

“The final decision was formally made by a human.”

The real question is whether the human decision-maker actually exercises meaningful judgment.

5. AI Discrimination by Public Authorities

Government AI may reproduce or amplify discrimination based on:

race or ethnic origin;

sex;

disability;

age;

nationality;

religion;

other protected characteristics.

Liability can arise from both direct and indirect discrimination.

CHEZ — C-83/14

In CHEZ Razpredelenie Bulgaria AD v Komisia za zashtita ot diskriminatsia, C-83/14 (16 July 2015), the CJEU recognized the importance of indirect discrimination and accepted that discriminatory disadvantage can arise from a facially neutral practice.

This has considerable significance for algorithmic systems.

An AI system does not need to explicitly use “race” or “ethnicity” to create discriminatory effects. Proxy variables may produce similar outcomes.

Thus:

Technological neutrality does not necessarily produce legal neutrality.

6. Public-Sector Facial Recognition

Police and security authorities increasingly use:

facial recognition;

biometric identification;

predictive analytics;

automated surveillance.

These technologies engage:

private life;

personal data;

freedom of movement;

freedom of expression;

non-discrimination;

procedural safeguards.

Glukhin v Russia

In Glukhin v Russia, Application No. 11519/20 (ECtHR, 4 July 2023), the European Court of Human Rights considered the use of facial-recognition technology in connection with surveillance and identification.

The case is highly relevant to public-sector AI because it demonstrates that technologically sophisticated surveillance remains subject to Article 8 ECHR privacy requirements.

The fact that authorities can technically identify a person does not mean that they may lawfully do so without sufficient legal justification and proportionality.

7. Biometric AI and Data Retention

S. and Marper v United Kingdom

In S. and Marper v United Kingdom, Applications Nos. 30562/04 and 30566/04, Grand Chamber (4 December 2008), the ECtHR examined retention of fingerprints, cellular samples and DNA profiles.

The Court emphasized the importance of safeguards surrounding sensitive personal information.

The case predates modern AI, but its principles apply strongly to:

AI facial recognition;

biometric databases;

predictive policing;

automated identification systems;

biometric risk assessment.

The lesson is:

The governmental ability to store and algorithmically analyze personal information does not eliminate the individual's right to privacy.

8. AI Surveillance by Public Authorities

Big Brother Watch and Others v United Kingdom

In Big Brother Watch and Others v United Kingdom, Applications Nos. 58170/13, 62322/14 and 24960/15, Grand Chamber (25 May 2021), the ECtHR considered large-scale electronic surveillance.

The Court emphasized the importance of safeguards controlling:

selection of communications;

authorization;

supervision;

retention;

examination;

use of intercepted material.

This is directly relevant to AI-powered surveillance because AI can dramatically increase the government's ability to:

search huge datasets;

identify individuals;

detect patterns;

predict associations;

classify behaviour.

Therefore, greater technological capability can increase the need for legal safeguards rather than reduce it.

9. Public-Sector AI and Human Oversight

A particularly important liability question is whether a public authority has meaningfully reviewed an AI-generated result.

Consider a hypothetical:

A government fraud-detection system marks a citizen as high-risk. An official simply accepts the algorithmic result without reviewing the underlying evidence.

If the decision causes loss of benefits, the authority may face arguments concerning:

inadequate human oversight;

failure to investigate;

inadequate reasoning;

procedural unfairness;

GDPR Article 22;

discrimination;

administrative-law unlawfulness.

A nominal human signature may not be sufficient.

The legal importance of meaningful human involvement is therefore one of the central themes in AI public-sector liability.

10. AI and the Right to a Reasoned Decision

Public authorities generally must be able to explain the legal and factual basis for decisions, subject to applicable procedural rules.

AI can create difficulties because:

models may be complex;

outputs may be probabilistic;

data may come from multiple sources;

models may be difficult to interpret;

the official may not understand how the score was produced.

This creates a significant problem:

Can a public authority lawfully impose a legal disadvantage on a person if it cannot adequately explain why the AI generated the relevant result?

The answer depends on the applicable national and EU procedural law, but AI opacity can become a serious problem where it undermines effective legal challenge.

11. Taxquet v Belgium

In Taxquet v Belgium, Application No. 926/05, Grand Chamber (16 November 2010), the ECtHR addressed requirements concerning the reasoning and comprehensibility of criminal verdicts.

Although not an AI case, it illustrates an important principle for algorithm-supported public decision-making:

Affected individuals must have sufficient information to understand and challenge the basis of decisions affecting their rights.

For AI-assisted governmental decisions, this supports the broader argument that authorities cannot simply respond:

“The algorithm says so.”

12. AI and Fair Administrative Procedure

Salduz v Turkey

In Salduz v Turkey, Application No. 36391/02, Grand Chamber (27 November 2008), the ECtHR emphasized procedural safeguards surrounding criminal proceedings and access to legal assistance.

Its direct subject is not AI, but the broader principle is important:

Technological or institutional efficiency cannot displace fundamental procedural guarantees.

Therefore, AI-assisted criminal justice must preserve:

access to counsel;

ability to challenge evidence;

effective defence;

judicial independence;

procedural equality.

13. AI and Public-Authority Privacy

López Ribalda v Spain

In López Ribalda and Others v Spain, Applications Nos. 1874/13 and 8567/13, Grand Chamber (17 October 2019), the ECtHR examined covert workplace video surveillance.

The Court's proportionality analysis is useful for AI-powered public-sector employee monitoring.

Government employers using:

AI productivity monitoring;

facial recognition;

behavioural analytics;

automated attendance systems;

workplace prediction tools

must consider whether the monitoring is:

legally authorized;

necessary;

proportionate;

sufficiently transparent;

supported by safeguards.

14. AI Public-Sector Liability and Compensation

A claimant may seek:

1. Annulment or judicial review

The claimant challenges the legality of the administrative decision.

2. Correction of personal data

Incorrect AI-generated information may be challenged under GDPR.

3. Injunction

The claimant may seek an order preventing continued unlawful processing or deployment.

4. Compensation

Depending on the legal basis, compensation may be available for:

financial loss;

material damage;

non-material damage;

privacy harm;

reputational harm;

discrimination-related injury.

5. Reinstatement

For employment or benefits decisions.

6. Declaration of unlawfulness

A court may determine that the authority acted unlawfully even where damages are separately assessed.

15. Österreichische Post — C-300/21

In Österreichische Post AG v UI, C-300/21 (4 May 2023), the CJEU considered compensation under Article 82 GDPR.

The Court made clear that:

infringement of GDPR alone does not automatically establish compensable damage;

damage and causation remain necessary;

there is no requirement that non-material damage satisfy an additional artificial seriousness threshold.

This is important for public-sector AI.

For example, if a public authority unlawfully processes an individual's data through an AI system, the claimant must establish the relevant damage and causal connection, but cannot necessarily be rejected merely because the non-material harm is considered “too minor” under a generalized seriousness test.

16. NAP v VB — C-340/21

In VB v NAP, C-340/21 (14 December 2023), the CJEU addressed non-material damage connected with cybersecurity and the fear of misuse of personal data.

The case is relevant to public-sector AI because government AI systems can involve large quantities of sensitive personal information.

A sufficiently well-founded fear of misuse can, in appropriate circumstances, constitute compensable non-material damage.

This is particularly relevant where an AI database or governmental information system is compromised.

17. Public Authority Liability Under EU Law

EU law can also impose state liability.

The classic framework is associated with Francovich and subsequent CJEU jurisprudence.

Francovich and Bonifaci v Italy

In Francovich and Bonifaci v Italy, Joined Cases C-6/90 and C-9/90 (19 November 1991), the CJEU established the principle that Member States may be required to compensate individuals for damage caused by breaches of EU law attributable to the state.

The doctrine is important for AI because a Member State could potentially incur liability where:

EU law confers rights on individuals;

the breach is sufficiently serious under the applicable state-liability doctrine;

there is a direct causal relationship between the breach and the damage.

AI therefore does not create an escape from ordinary principles of governmental responsibility.

18. State Liability and EU Rights

The Brasserie du Pêcheur/Factortame line of jurisprudence further developed state liability.

The principle is important where an AI deployment violates an EU-law obligation.

Potential examples could include:

discriminatory public-sector AI;

unlawful data processing;

failure to comply with EU procedural requirements;

unlawful restrictions on fundamental rights;

failure to implement required safeguards.

The claimant must still satisfy the applicable conditions of state liability and prove causation and damage.

19. AI and Public-Sector Competition/Procurement

Government AI procurement creates another liability layer.

A public authority may purchase AI from a private provider. Problems may arise concerning:

defective software;

inadequate specifications;

biased systems;

undisclosed limitations;

cybersecurity failures;

improper procurement;

vendor lock-in;

insufficient testing.

The fact that a public authority purchased an AI system from a private company does not automatically transfer all public-law responsibility to the vendor.

The public authority may remain responsible for the lawfulness of the governmental decision.

20. AI Provider Versus Public Authority

A particularly important distinction is:

A single harmful event may therefore generate multiple parallel claims.

21. Important European Case Laws

The following authorities are particularly useful for analysing AI public-sector liability.

22. Six Particularly Important Cases Explained

1. Francovich and Bonifaci v Italy

CJEU, Joined Cases C-6/90 and C-9/90, 19 November 1991

Importance

Foundation for EU state liability.

AI relevance

If a governmental AI deployment results from a serious breach of EU law and causes compensable damage, state-liability principles may become relevant.

2. SCHUFA

CJEU, C-634/21, 7 December 2023

Importance

One of the most important modern authorities for algorithmic decision-making.

AI relevance

An apparently human decision may still involve automated decision-making where an AI-generated score effectively determines the outcome.

This is particularly important for:

welfare systems;

government fraud detection;

tax scoring;

immigration risk assessment;

public-sector credit or eligibility decisions.

3. Österreichische Post

CJEU, C-300/21, 4 May 2023

Importance

Clarifies compensation under GDPR Article 82.

AI relevance

A person affected by unlawful governmental AI processing must establish compensable damage and causation, but non-material damage does not require an additional judicial threshold of seriousness.

4. Glukhin v Russia

ECtHR, Application No. 11519/20, 4 July 2023

Importance

Modern authority involving facial recognition.

AI relevance

Demonstrates that government use of AI-based biometric identification can engage Article 8 ECHR and must satisfy legality and proportionality requirements.

5. Big Brother Watch v United Kingdom

ECtHR, Grand Chamber, 25 May 2021

Importance

Major surveillance case.

AI relevance

AI can make mass surveillance substantially more powerful. The case demonstrates the importance of independent safeguards, authorization and controls over governmental surveillance systems.

6. CHEZ

CJEU, C-83/14, 16 July 2015

Importance

Important indirect-discrimination authority.

AI relevance

Algorithmic discrimination can occur without explicitly programming discriminatory criteria. Neutral-looking variables may generate disproportionate disadvantage.

23. Liability Test for AI Used by a Public Authority

A useful analytical framework is:

Step 1 — Identify the public function

What governmental function is the AI performing?

Step 2 — Identify the legal authority

What statute, regulation or administrative power authorizes the use?

Step 3 — Identify the AI role

Is the AI:

advisory;

classificatory;

predictive;

determinative;

surveillance-oriented?

Step 4 — Examine the data

Was the data:

accurate?

relevant?

lawfully obtained?

sufficiently representative?

excessive?

Step 5 — Examine human involvement

Did a genuine official review the result?

Step 6 — Test fundamental rights

Potential rights include:

privacy;

equality;

property;

fair trial;

freedom of expression;

family life;

effective remedy.

Step 7 — Establish causation

Did the AI materially contribute to the harmful governmental decision?

Step 8 — Establish damage

Examples:

financial loss;

denial of benefits;

privacy injury;

discrimination;

reputational injury;

emotional distress;

unlawful surveillance.

Step 9 — Determine remedy

Possible remedies include:

annulment;

correction;

injunction;

cessation of processing;

reconsideration by a human official;

compensation;

declaratory relief.

24. AI Act and Public-Sector Liability

The EU AI Act significantly strengthens governance requirements for high-risk AI and certain public-sector applications.

Particularly relevant areas include:

risk management;

data governance;

technical documentation;

record keeping;

transparency;

human oversight;

accuracy;

robustness;

cybersecurity;

post-market monitoring.

However, an important distinction must be maintained:

Regulatory non-compliance and civil liability are related but not identical.

Failure to comply with an AI Act obligation may provide important evidence of unlawfulness, breach, foreseeability or failure to exercise reasonable care, but the claimant must identify the applicable liability mechanism and satisfy its requirements.

25. Public Authority Cannot Simply Blame the Algorithm

One of the most important principles is:

“The algorithm made the decision” is generally not an adequate legal defence for a public authority.

The government remains responsible for the exercise of its statutory powers.

For example:

AI says: “Person is likely committing welfare fraud.”

Authority: Automatically terminates benefits.

Potential questions:

Was the AI legally authorized?

Was the data accurate?

Was the person notified?

Could the person challenge the result?

Was there human verification?

Was the system discriminatory?

Was the decision proportionate?

Was the AI score legally determinative?

Was the authority required to provide reasons?

Did the authority cause compensable damage?

26. Evidentiary Problems

AI litigation creates special evidence problems.

Claimants may not know:

which model was used;

what data was used;

how the score was generated;

which variables affected the outcome;

whether human review occurred;

whether the system had known error rates.

Consequently, disclosure and access to administrative records can become crucial.

A claimant may seek:

decision records;

audit logs;

model documentation;

impact assessments;

procurement specifications;

human-review records;

accuracy statistics;

discrimination testing;

data sources;

system alerts;

internal risk assessments.

27. Causation Problems

AI cases frequently involve multiple causal factors.

Suppose:

AI risk score → official investigation → administrative decision → financial loss.

The authority may argue that the AI merely supplied information and that the official independently decided the case.

The claimant may argue that the AI score was effectively determinative.

Therefore, courts may need to investigate the actual causal role of AI, rather than merely examining the formal structure of the decision.

This is precisely why the reasoning of SCHUFA is particularly significant.

28. Direct and Analogical Authorities

It is important not to overstate existing jurisprudence.

More directly relevant to algorithmic/public-sector AI

SCHUFA

Österreichische Post

NAP v VB

Glukhin

Strong analogical authorities

CHEZ

Big Brother Watch

S. and Marper

López Ribalda

Taxquet

Salduz

Francovich

There is still no mature European body of case law specifically called “AI public-sector liability law.” Courts are currently applying established principles of data protection, administrative law, discrimination, privacy, state liability and fundamental rights to AI-related technologies.

29. Overall Legal Position

AI public-sector liability in Europe can be summarized as follows:

Public authority + AI system + unlawful deployment/decision + breach of legal duty + causation + damage = potential public-sector AI liability.

The most important principles are:

Government responsibility cannot simply be delegated to an algorithm.

Human oversight must be meaningful where legally required.

Automated scoring can trigger GDPR protections.

Algorithmic discrimination can constitute unlawful indirect discrimination.

Facial recognition and biometric AI engage strong privacy protections.

Mass AI surveillance requires safeguards and proportionality.

AI-generated decisions must remain capable of effective legal challenge.

GDPR violations can result in compensation where damage and causation are established.

EU state-liability principles may provide compensation for sufficiently serious breaches of EU law.

AI Act compliance does not automatically eliminate civil or public-law liability.

Government procurement of an AI system does not automatically transfer responsibility away from the public authority.

The more serious the governmental power exercised through AI, the stronger the need for legality, transparency, oversight and effective remedies.

Core cases to remember

Francovich (C-6/90 & C-9/90) — EU state liability
SCHUFA (C-634/21) — automated scoring
Österreichische Post (C-300/21) — GDPR compensation
NAP v VB (C-340/21) — non-material data-related damage
CHEZ (C-83/14) — indirect discrimination
Glukhin v Russia — facial recognition
S. and Marper v UK — biometric data
Big Brother Watch v UK — governmental surveillance
López Ribalda v Spain — technological monitoring
Taxquet v Belgium — reasoned/fair decision-making
Salduz v Turkey — procedural safeguards

These authorities together provide a strong European framework for analysing governmental responsibility for AI-assisted decisions, surveillance, profiling, discrimination, data processing and administrative harm.