REVIEW OF AI RISKS IN THE EUROPEAN UNION PUBLIC SECTOR: TAXONOMY, GOVERNANCE ARCHITECTURE AND CASE STUDIES (2018–2025)

Abstract

European public administrations increasingly deploy artificial intelligence (AI) services for social-benefit and service eligibility screening, fraud and anomaly detection, citizen-service triage, and multilingual document processing. Because these deployments operate inside a complex constitutional and administrative order, the principal risks are not purely technical: they also implicate legality and mandate, proportionality, due process and reasons-giving, equality and non-discrimination, privacy and data protection, cybersecurity, and democratic accountability. This paper reviews AI risks in the European Union (EU) public sector over 2018–2025 by analyzing technical, legal, and policy literature that connects observed risks in administrative practice to the evolving governance architecture. Methodologically, it triangulates EU-level evidence on adoption and capacity constraints, the EU “governance stack” centered on the Artificial Intelligence Act (AI Act) and complemented by the General Data Protection Regulation (GDPR), the Data Governance Act, the Data Act, the Digital Services Act (DSA), the Digital Markets Act (DMA), and Network and Information Security Directive 2 (NIS2), and four selected cases: the Netherlands’ SyRI welfare-fraud analytics, the EU-funded iBorderCtrl border pilot, justice/probation automation debates with Estonia as an illustrative boundary-setting instance, and Madrid’s use and experimentation with facial recognition in mobility/security contexts. The analysis produces a risk taxonomy spanning technical, organizational, legal-accountability, and sovereignty dimensions and maps it to lifecycle duties under the AI Act. The paper concludes that the EU governance architecture is conceptually coherent and comparatively advanced, but its effectiveness will depend on procurement, integrated impact assessments, and sustained capacity-building so that AI adoption delivers public value without shifting risk onto citizens or undermining trust. It also identifies recurring administrative pressure points—such as auditability, logging, human oversight, and vendor dependency—that shape whether lifecycle obligations translate into day-to-day safeguards.