Resh(AI)ping Good Administration: Addressing the Mass Effects of Public Sector Digitalisation

Abstract

Public sector digitalisation is transforming public governance at an accelerating rate. Digitalisation is outpacing the evolution of the legal framework. Despite several strands of international efforts to adjust good administration guarantees to new modes of digital public governance, progress has so far been slow and tepid. The increasing automation of decision-making processes puts significant pressure on traditional good administration guarantees, jeopardises individual due process rights, and risks eroding public trust. Automated decision-making has, so far, attracted the bulk of scholarly attention, especially in the European context. However, most analyses seek to reconcile existing duties towards individuals under the right to good administration with the challenges arising from digitalisation. Taking a critical and technology-centred doctrinal approach to developments under the law of the European Union and the Council of Europe, this paper goes beyond current debates to challenge the sufficiency of existing good administration duties. By stressing the mass effects that can derive from automated decision-making by the public sector, the paper advances the need to adapt good administration guarantees to a collective dimension through an extension and a broadening of the public sector’s good administration duties: that is, through an extended ex ante control of organisational risk-taking, and a broader ex post duty of automated redress. These legal modifications should be urgently implemented.

1. Introduction

Much like in every other area of socio-economic activity, the “COVID-19 digital shift” and the mainstreaming of advances in artificial intelligence (AI) have prompted discussion of how the public sector could harness the advantages of digital technologies and data-driven insights. AI brings the abstract promise of a more efficient, adaptable, personalisable, and fairer public administration (Esko and Koulu 2023; Coglianese and Lai 2022; Sunstein 2022). Around the world, States are thus experimenting with AI technology, seeking more streamlined and efficient digital government and public services (OECD.AI 2023; Joint Research Centre AI Watch 2022)—in no small part as a driver for rationalisation or savings-generation in the organisation of their public administrations. The adoption of data-driven approaches, digital technologies, and AI to support or automate decision-making in the public sector is quickly transforming public governance (Yeung 2022; Dunleavy and Margetts 2023).

Such “digital transformation” poses significant risks that require new regulatory approaches (Kaminski 2023). Generative AI, for example, has been shown to create unreliability, misuse, and systemic risks (Maham and Küspert 2023)—which are particularly acute in public sector automated decision-making (ADM) supported by AI (Finck 2020; Kuziemski and Misuraca 2020). The accelerating shift towards new modes of digital public governance, therefore, requires an adaptation of the legal framework—and there is broad support for this view (see, e.g., Curtis et al. (2023)). There are signs of a growing (soft) international consensus on the need to regulate public sector AI adoption as part of broader rules on AI use (AI Safety Summit 2023; Ministry of Foreign Affairs of Japan 2023), with the United States of America recently taking perhaps the most decided approach to date.1 However, progress has generally been slow and tepid so far, particularly in the context of the European Union (EU) and the Council of Europe (CoE), on which this paper will focus.

Pushing for such legal adaptations, much academic work has recently emerged on the need to adjust the regulation of ADM to protect the individual rights of those at the receiving end of these new modes of delivery of administrative (in)justice (Demková et al. 2023). In the European context, the emerging consensus is that the current legal framework is ineffective in tackling some (or most) of these risks, where, e.g., the technology pushes the limits of the General Data Protection Regulation (GDPR)2 or even those of new instruments of EU digital law, including the (at the time of writing, on 19 December 2023) yet to be finalised EU AI Act3—on which there is a burgeoning literature, see, e.g. (Demková 2023a, 2023b; Fink and Finck 2022; Gentile 2023; Cutts 2023). The legal framework is also seen as ineffective in preventing discrimination on grounds not (directly) linked to currently protected characteristics (Wachter 2022), thus leaving a gap in relation to new forms of algorithmic discrimination. The continued preservation of individual rights will thus require adjustments in the current legal framework (Laukyte 2022; Chevalier and Menéndez Sebastián 2022) and will eventually reshape individual rights under current approaches to good administration (Zerilli 2023). This will be part of the “digital transformation” of administrative law, but developments in individual rights cannot provide a full picture. Many other “traditional” administrative law doctrines will require careful reconsideration, and new doctrines and rules may be needed (Bello y Villarino 2023). The effectiveness of all changes and adaptations will, of course, hinge on their understanding and interpretation by practitioners (Røhl 2022).

Crucially, new modes of digital public governance not only jeopardise individual rights but also threaten collective rights and interests in the proper functioning of the public sector as a crucial driver of the legitimacy of administrative action (Smuha 2021; Ranchordás 2022; Coglianese 2023; Kouroutakis 2023; Carney 2023). It has been stressed that there is a need to rethink administrative procedural fairness and to move beyond current individualistic approaches (Meers et al. 2023; Tomlinson et al. 2023). In a similar attempt to go beyond the “individual unit” in reshaping good administration guarantees and taking a critical and technology-centred doctrinal approach to developments under EU and CoE law (Section 2), this paper goes beyond current debates on the regulation of ADM to challenge the sufficiency of existing good administration duties. By stressing the mass effects that can derive from ADM in the public sector, whether as a result of AI adoption or based on the use of less sophisticated algorithms and forms of automation (Section 3), the paper advocates for the need to expand good administration guarantees to a collective dimension through an extension and a broadening of the public sector’s good administration duties: an extended ex ante control of organisational risk-taking (Section 4), and a broader ex post duty of automated redress (Section 5). The paper concludes with a reflection on the urgency of implementing the proposed legal reforms (Section 6). Although the paper focuses on the European context, given that some of the main issues identified in the analysis arise from the individualistic logic followed in the design of good administration guarantees that are common to OECD jurisdictions,4 it is of relevance beyond Europe.

2. European Approach to Adapting the Current Legal Framework

Section 1 stressed how the adoption of data-driven approaches, digital technologies, and AI to support or automate decision-making in the public sector requires an adaptation of existing legal frameworks and, in particular, a reconsideration of the duties arising from the right to good administration. This section focuses on the ongoing efforts to create new safeguards in EU and CoE law, which together determine the “European approach” to reshaping good administration for digital public governance. The section starts by setting out the baseline provided by the existing right to good administration in Article 41 of the Charter of Fundamental Rights of the EU (CFR),5 as interpreted under existing case law of the European Court of Justice (ECJ) and the CoE’s Principles of Administrative Law (CoE Principles)6 (Section 2.1). It then considers the new guarantees under the EU AI Act once it enters into force, which, at the time of writing, are to some extent dependent on details yet to emerge following the political compromise of December 2023 (Council of the EU 2023; European Parliament 2023) (Section 2.2). It then analyses the also ongoing efforts to create further new guarantees under a CoE Framework Convention on AI, Human Rights, Democracy and the Rule of Law (CoE AI Convention)7 (Section 2.3). It concludes with a short recapitulation of the “European approach” to reshaping good administration for digital public governance (Section 2.4).

2.1. Good Administration in Article 41 CFR as the Regulatory Baseline

In establishing a right to good administration, Article 41 CFR encapsulates the eponymous general principle of EU law (Hofmann and Mihaescu 2013). It comprises an “umbrella right” for “Every person … to have his or her affairs handled impartially, fairly and within a reasonable time” by the public administration (Art. 41(1) CFR) (Demková and Hofmann 2022), as well as more specific rights that derive from it, such as the right to be heard, the right to access the file, and the obligation of the administration to give reasons for its decisions (Art. 41(2) CFR). The right to good administration also comprises a duty of care so that the administration has the most complete and reliable information possible and takes it into account in its decision-making (Jan 2023a). The umbrella clause in Article 41(1) CFR includes some flexible elements that could accommodate an expansion and broadening of the right to good administration beyond its current contours. It has been authoritatively argued (Craig 2021, p. 1128) that it is possible “to rely on Article 41(1) for aspects of the right to good administration that do not readily fall within the more specific parts of Article 41(2)” and that an expansive interpretation of Article 41(1) CFR would include, for example, many extensions put forward by the EU Ombudsman (2002). The effectiveness of these rights is underpinned by the right to an effective remedy and to a fair trial in Article 47 CFR. In recent ECJ case law,8 “good administration has been unequivocally accepted as a general principle of EU law, meaning its requirements are binding on both the EU institutions, bodies and agencies, as well as on the EU Member State administrations whenever EU law applies” (Demková et al. 2023). Therefore, Article 41 CFR provides the relevant regulatory baseline under EU law, but the right to good administration could extend beyond its narrow codification inasmuch as it constitutes a general principle of EU law and, thus, a general source of EU law (Art. 6 TEU).

The proper functioning of the public administration is of crucial relevance to the rule of law and the functioning of constitutional democracies (e.g., Lock 2019, p. 2205; Corder 2020; Suksi 2023). However, the CFR does not encapsulate a general or social right to a good public administration. Rather, in simplified terms, the right to good administration in Article 41 CFR follows an individualistic logic to the protection of the interests of those at the receiving end of administrative decision-making. Article 41 CFR needs to be considered in coordination with Article 47 CFR, which provides access to (judicial) remedies when Article 41 CFR protection has been ineffective in avoiding individual harm. Article 47 CFR follows an equally individualistic logic. The overall logic is, thus, one of empowering individuals in their relationships with the public administration, through procedural guarantees seeking to promote adequate decision-making and through the last resort possibility of enforcing them against the public administration, and/or obtaining redress for defective decision-making. This logic and regulatory approach are one of the main shortcomings in the effectiveness of the right to good administration in a digitalised context, as there are open questions “whether individuals are sufficiently equipped to deal with the new challenges posed by AI” (Wolswinkel 2022). Further, I would stress that this individualistic logic leaves two crucially important issues outwith the scope of protection under Articles 41 and 47 CFR.

First, to the exclusion of the right to claim damages (Art. 41(3) CFR; CoE Principle 16), substantive protection is only triggered at the point where an individual situation is susceptible to administrative decision-making through procedural rights (to be heard, to access the file) or, in fact, mostly where a decision has been made (or is to be considered to have been made, e.g., under the rules on administrative silence; CoE Principle 13) through the right to be given reasons for the decision with a view to potentially challenging it. (Earlier) techno-organisational decisions adopted in preparation for such decision-making processes are only to be taken into account if (and to the extent that) they impinge on specific guarantees given to the individual in relation to the specific (potential) decision, e.g., in terms of the objectivity which the organisational setting is capable of ensuring. However, techno-organisational decisions are not capable of pre-emptive challenge, or challenge in abstracto.

Second, for the purposes of Article 41 CFR, it is irrelevant whether the situation triggering a (potential) breach of the right to good administration is unique to the individual facing administrative action or not. Individual rights and remedies do not vary depending on the number of individuals (potentially) affected by equivalent (simultaneous) decision-making, as each of them will (in theory) be capable of individualised enforcement of their own rights. The traditional approach has thus been to distinguish between the rules applicable to single case decision-making from those applicable to administrative rule-making (see, e.g., Craig et al. (2015)). In the digital context, however, there is a clear conflation of these two dimensions, which also relate to the point at which protection is needed—in the sense that the general preparatory aspects of the decision-making process have a more direct bearing on individual outcomes.

I argue that these implications of the individualistic logic underpinning Articles 41 and 47 CFR are of great importance in the use of AI and other forms of technology-supported or automated decision-making for three reasons. First, this is important because, as just mentioned, techno-organisational decisions will have a much more direct bearing on individual decision-making in the AI context than in other settings, as in some ways, the deployment (pre)determines the decision almost invariably (e.g., by establishing the relevant parameters and weightings, by excluding all discretion, etc.). The impossibility of challenging such techno-organisational decisions before they are implemented can thus create a situation where existing Article 41 CFR rights offer “too little, too late” by way of protection. Second, this is also important because, in practice, individual redress may be nearly impossible to obtain in a context of mass decision-making, such as that enabled by AI, potentially leading to extremely large numbers of individual claims capable of choking review procedures and ultimately rendering Article 47 CFR protection ineffective, where such protection by tribunals or courts is significantly delayed or unobtainable. Finally, this is also important because redress for the social interest in the proper functioning of the public administration may not be (pragmatically) actionable under current mechanisms. These issues will be further explored in Section 3, Section 4 and Section 5.

Ultimately, while the right to good administration can offer a springboard for the development of new individual (algorithmic) rights (which are, however, contested; Abrusci and Scott 2023)—barring a very expansive interpretation of the eponymous general legal principle of EU law by the ECJ—as it currently stands, it is unsuitable as a basis for non-individualistic approaches to strengthening good administration duties. There is, thus, a need to develop new guarantees and protective mechanisms on the basis of independent legal rules. The following two subsections will now focus on the most notable efforts currently underway in the European context: the EU AI Act and the CoE AI Convention.

2.2. EU AI Act, Fundamental Rights Impact Assessment, and Blurred Boundaries

At the time of writing, EU legislators have reached a provisional political agreement on the EU AI Act,9 which seeks to create additional mechanisms to protect fundamental rights in the context of AI use. While the EU AI Act can have a positive impact on the protection of individual and collective rights, it also comes with significant limitations (Wróbel 2022). First, the EU AI Act will only apply to AI as defined in the act. The EU has opted to closely follow the OECD’s revised definition of AI (OECD 2023). This creates a first threshold issue to consider in establishing the scope of protection that will result from the EU AI Act—which will depend on whether specific types of decision-making support or automation reach the necessary levels of, e.g., autonomy to be classed as “AI proper”. Consequently, at best, the EU AI Act will only provide a partial solution to the challenges arising from the digitalisation of the public sector and new modes of administrative decision-making, as some of the challenges will also arise in contexts in which the public administration resorts to less sophisticated (i.e., autonomous) algorithms and digital technologies.

Second, the EU AI Act contains very limited obligations except in relation to prohibited and high-risk uses. High-risk uses will trigger important obligations that some consider excessive, see, e.g., (Ryan-Mosley 2023), such as the need to carry out a fundamental rights impact assessment before a high-risk AI system is put in the market by its deployers or to register in an EU database for high-risk AI systems (Council of the EU 2023). If this was carried out appropriately, this impact assessment could operate as a check on techno-organisational decisions adopted by the public administration seeking to use an AI, and, thus, mitigate some of the shortcomings identified above (Section 2.1). However, by contrast to the original proposal, high-risk uses are no longer established in a closed list. The final text is expected to include “a series of filtering conditions meant to capture only genuine high-risk applications”, especially in sensitive areas such as education, employment, critical infrastructure, public services, law enforcement, border control, and administration of justice (Bertuzzi 2023). This creates a second threshold issue in establishing the scope of protection that will result from the EU AI Act. The coverage of anticipatory measures such as the pre-deployment fundamental rights impact assessment can thus be expected to only cover a fraction of AI uses by the public sector—which has been criticised, e.g., by (Kouroutakis 2023).

A final major limitation is the absence of individual rights to enforce the EU AI Act. The political compromise indicates that “a natural or legal person may make a complaint to the relevant market surveillance authority concerning non-compliance with the AI act and may expect that such a complaint will be handled in line with the dedicated procedures of that authority” (Council of the EU 2023). While this is an improvement over the original proposal, it falls short of guaranteeing procedural rights comparable to those arising from Article 47 CFR. It is also unclear at what stage such a complaint can be realistically expected to be filed with the relevant authority, but it seems unlikely that, even with increased transparency (e.g., of the fundamental rights impact assessment), individuals will have access to the information required to assess non-compliance other than in relation to formal aspects of the EU AI Act’s obligations. Material deviations from the relevant guarantees and, in particular, violations of fundamental rights not captured or incorrectly evaluated in the relevant impact assessment will most likely only be discovered after the fact. This does not do much to address the issue of the (too late) timing and (in)effective access to remedies in the context of mass administrative decision-making identified above (Section 2.1). While it could be argued that other protections under the GDPR are being interpreted expansively10 and could, as a result, offer some level of protection based on the exercise of individual rights (Demetzou et al. 2023), in my view, reliance on individual rights under the GDPR (as would be the case under the EU AI Act) would suffer from the same limits arising from the individual logic discussed above (Section 2.1).

Overall, I would argue that while the EU AI Act will create important additional safeguards in a limited number of high-risk cases, they will be too limited to consider the EU AI Act a sufficient adaptation of the right to good administration under EU law.

2.3. Council of Europe’s AI Framework Convention, Not Much to Add to the EU AI Act

At the time of writing, the CoE is promoting the adoption of an AI Convention to create a minimum set of guarantees to address the challenges of AI to human rights, democracy, and the rule of law.11 The CoE AI Convention will face effectiveness constraints as a result of the “minimum common denominator” approach to setting its content (Bertuzzi 2024), as well as a result of the need for signatory States to take implementing measures over which they will enjoy a (large) degree of discretion. For the purposes of our discussion, it is worth stressing that similar to the EU AI Act discussed above (Section 2.2), the CoE AI Convention also creates an initial threshold issue through the definition of AI that determines its scope of application (Art. 2). The AI definition in the CoE AI Convention also follows the OECD’s and, consequently, aligns with the EU AI Act. This is also a general constraint in the CoE AI Convention’s potential to address the issues identified above (Section 2.1).

Further, the Convention is bound to contain very high-level obligations susceptible to further concretisation at a domestic level through legislation and implementing measures over which signatory States will enjoy a broad margin of discretion. Such measures can be as broad as a general obligation to “adopt or maintain measures to ensure that the activities within the lifecycle of artificial intelligence systems are compatible with obligations to protect human rights, as enshrined in applicable international law, and in its domestic law” (Art. 4). Where the CoE AI Convention seeks to create more specific guarantees, for example, in relation to remedies, it limits the obligations to record-keeping and the disclosure of information, with the possibility to complain to oversight authorities still under discussion (Art. 14). Ultimately, the Convention will not create individual enforcement rights beyond those already existing for the general protection of fundamental rights in any given jurisdiction.

Similarly, in relation to the requirement for States to put in place a risk and impact management framework (Art. 16), the generic obligations are premised on the risk-based approach underpinning the Convention (Art. 1), according to which all “measures shall be graduated and differentiated as may be necessary in view of the severity and probability of the occurrence of adverse impacts on human rights, democracy and the rule of law throughout the lifecycle of artificial intelligence systems” (Art. 1(2)). This comes to reproduce the second threshold issue identified with the EU AI Act (Section 2.2) and can exacerbate it as the risk-based approach will not only guide the identification of uses capable of “severe and probable adverse impacts on human rights” (also known as “high-risk”) but also the design of the relevant measures—similarly, see (Van Kolfschooten and Shachar 2023).

Overall, once again, I would argue that while the CoE AI Convention can create a framework that eventually results in the implementation of important additional safeguards in a limited number of high-risk cases, it is unlikely to generate any obligations or duties beyond those arising from the EU AI Act and, as such and in the EU’s context, the CoE AI Convention will not promote a sufficient adaptation of the right to good administration.

2.4. Recapitulation

The analysis in this Section 2 has shown how, as enshrined in the CFR, the right to good administration follows an individualistic logic that risks creating situations where the adoption of digital technologies to support or automate administrative decision-making is not subjected to timely and meaningful opportunities for individuals to protect their rights. This logic also precludes pre-deployment challenges based on broader collective rights and social interests in the proper functioning of the public administration. The analysis has also shown that neither the EU AI Act nor the CoE AI Convention would do enough to address the relevant issues save in relation to the relatively narrow (and likely to be contested) category of high-risk AI uses by the public sector. Even in that relatively narrow context, both instruments would fall short from the perspective of individual remedies, and their ability to meaningfully address the risks taken with the adoption of digital technologies would depend on the technically complex and likely to-be-contested implementation of novel tools, such as fundamental rights impact assessments. As such, I argue that the “European approach” to reshaping good administration for digital public governance falls short because it does not address the two main shortcomings identified in relation to the regulatory baseline currently provided by Articles 41 and 47 CFR: that is, the risk of granting individual rights only exercisable once the damaging automated or supported decision-making has taken place, and only exercisable in the context of review or appeal procedures at risk of being overwhelmed by the potential sheer number of claims arising from “single points of failure” in the decision-making process. Against this background, Section 3 will focus on the main challenge for the adaptation of good administration guarantees, which stems from the mass effects of the digitalisation of public sector decision-making. Section 4 and Section 5 will detail the additional adaptations of the right to good administration that are, in my view, required to address this challenge.

3. Mass Effects of the Digitalisation of Public Sector Decision-Making as the Crucial Challenge

It is increasingly accepted that regulating AI use by the public sector, and more generally, requires a precautionary or anticipatory approach (Kaminski 2023). At least in part, this stems (or should stem) from the realisation that AI deployment can generate mass effects that are very difficult or simply impossible to correct for after the fact. Experience has already shown that the implementation of defective or discriminatory algorithms by the public sector can generate massive harm thwarting the lives and opportunities of very many citizens—and oftentimes the most vulnerable and marginalised (Sinclair 2023). This has become painfully obvious under the light of scandals such as the Robodebt scheme implemented in Australia (Royal Commission into the Robodebt Scheme 2023), the UK’s Post Office scandal involving the Horizon software (Marshall 2022), or, in the also scandalous deployment of the digital welfare fraud detection system (System Risk Indication, SyRI) in the Netherlands (Fenger and Simonse 2024). These cases show how highly automated and data-driven screening mechanisms deployed at the population level generate extremely harmful levels of mass effects and how difficult it is for individuals to obtain adequate redress and compensation. The standard approach to the enforcement of human and fundamental rights, including the right to good administration through ex post individual claims, is bound to fail in the digital context. Furthermore, there are additional ways in which AI can erode the individualisation of decision-making. AI systems might handle cases in batches rather than giving them individual consideration, or self-learning processes might ensure that future decisions are influenced by past ones (Binns 2021). This lack of individual consideration might be problematic, even if the massified outcomes are not systematically harmful, and there may be further (unobservable) breaches of existing guarantees under good administration duties.

The current (analog) regime developed in a context of “human-exclusive” decision-making that, by definition, is (severely) constrained by limitations in the amount of information that can be processed and by the speed with which decisions can be made, communicated, and executed. This context has provided the implicit paradigm for the conceptualisation and implementation of the right to good administration. In that regard, the unavoidable (slow) pace of administrative decision-making within that paradigm worked to foster good administration, in that the necessary delay between the start of an administrative procedure and the adoption of the relevant (human-exclusive) decision created space (and time) for the exercise of individual rights. Within that paradigm, even faulty approaches to decision-making (e.g., by an official or a branch of the public administration) would have limited effects as a result of constraints on the volume of decisions capable of adoption before a (successful) challenge forced a change of approach. The specific procedural rights (to access the file, to be heard, to obtain reasons for decisions, to challenge them) underpinning the current incarnation of the right to good administration are premised on such paradigm of individualised decision-making (see above Section 2.1).

To be sure, the standardisation of administrative processes and the increased processing capabilities of information and communication technologies (ICT) already exerted pressure on such paradigm, as the cost and the delay of processing information reduced and, as a direct consequence, the volume of (individual) decisions that could be created by a single (still) human decision-maker increased (Dunleavy et al. 2006). However, the threshold for “mass effects” was arguably not crossed until data-driven approaches and the adoption of algorithms, including AI, to support or automate decision-making have become commonplace. This has suddenly changed the relevant paradigm. In the new paradigm, there is little constraint on the volume of (individual) decisions that can be made through human–machine collaboration, or through complete automation. The challenge here is not (primarily) on how to adapt the existing procedural rights because they make little (pragmatic) sense in the context of instant (automated) decision-making. Once the data has been chosen, collected, and structured, and once the algorithm has been chosen (trained and tested), there is barely any delay between the start of a digitalised decision-making process and the generation of the relevant algorithmic output (decision). This renders most specific rights either very difficult to implement or largely irrelevant, as decision-making largely becomes a fait accompli. Specific decisions in relation to the data and the algorithm will pre-determine the relevant decisions. Crucially, given the level of centralisation in decision-making and the negligible marginal costs of each additional decision, techno-organisational decisions preceding the adoption of the (individual) decisions by the relevant supported or automated process can thus irretrievably translate into breaches of the right to good administration (as well as other fundamental rights) of many citizens at once, all “with a simple click of the mouse” so to speak.

In my view, the mass effects generated by decision-making supported or automated through digital technologies constitute the most distinctive feature and the most crucial challenge for the adaptation of good administration duties in the new paradigm of digital public governance. However, the challenges in ensuring individual guarantees derived from the right to good administration in a mass decision-making setting are rarely acknowledged, although there are some exceptions, for example, in relation to the right to access the file (EU Agency for Fundamental Rights 2020). I argue that the focus should be on tackling the issue of mass effects. This would require a dual approach. First, it would require seeking to minimise the risk of such (negative) mass effects materialising through intense scrutiny and testing of the relevant technical solutions pre-deployment (Bello y Villarino 2023). Second, it would require creating proactive duties incumbent upon the public administration to undo such (negative) mass effects so that reversing or compensating for the effects of the supported or automated decision-making does not depend on the ability of the affected citizens to identify and challenge this situation.

Conceptually, this would require both an extension of the right to good administration to phases of decision-making that are not yet directly relevant to the individual (Section 4), as well as the broadening of good administration guarantees to a collective dimension to account for the new risks arising in the AI-driven administrative context and to avoid those risks being internalised by those at the receiving end of the decision-making (Section 5). Whether it would be possible to implement these adaptations on the basis of Articles 41 and 47 CFR, as they stand, could be a relevant consideration in order to implement this proposal. However, in my view, the individualistic logic of the system (above Section 2.1) makes it nigh impossible, and an explicit reform of the CFR would be preferable, in my view. In any case, the remainder of the paper will not be concerned with this level of technical considerations.

4. Ex Ante Control of Organisational Risk-Taking

At its core, the adoption of digital technologies to support or automate public sector decision-making implies organisational risk-taking and, as things stand, this decision can be made without the public sector having to consider (or internalise) the significant externalities that the decision can impose on those at the receiving end of the decision-making process. Given the potential mass effects of discrete techno-organisational decisions discussed above (Section 3), it is not acceptable, or commensurate with the levels of protection desirable in systems of human and fundamental rights, to expect large numbers of citizens—or specific minorities or groups disproportionately impacted by (biased) decision-making—to have to rely on individualised ex post challenges to the implementation of those techno-organisational decisions. The right to good administration—or the mirroring duty of good administration incumbent on the public sector—must encompass a proactive and thorough ex ante assessment of the likely impact of techno-organisational decisions on the ability of the public sector user to respect individual rights when deploying AI. Such assessment needs to take place at the point of organisational risk-taking: or, in other words, ahead or in anticipation of the technological deployment.

In my view, such assessment of the likely (in)compatibility of a planned technological deployment with individual rights needs to be undertaken by an institution with sufficient independence and domain expertise, which rules out a self-assessment by the public sector user and/or its technology providers. Even if the relevant fundamental rights impact assessment was published in full and subjected to public consultation or contestation, there is no guarantee that the process would result in a sufficiently robust control of the planned technological deployment. Both the public sector user and the technology provider would have incentives to gloss over important fundamental rights issues, or could behave strategically in terms of information disclosure or the interpretation of the impact assessment at the later stage of technological deployment. For it to be effective, an ex ante control of the likely impact of a technological deployment on fundamental rights and its broader alignment with the relevant goals of digital regulation, thus, needs to be implemented through a system of licencing or permissioning of public sector AI use. In relation to the public procurement procedures that will usually operate as the conduit for the acquisition of such digital technologies (unless they are developed in-house), I have developed elsewhere a proposal for the system to be managed by an “AI in the Public Sector Authority” (AIPSA) (Sanchez-Graells 2024a) (along similar lines see Martín Delgado 2022; Gavaghan et al. 2019).

To foster the effectiveness of such a system of ex ante control and permissioning of the adoption of digital technologies to support or automate public sector decision-making, the right to good administration would need to be broadened so that it encompasses a right to enforce such licencing mechanism against any planned or implemented AI deployment by the public sector, which is an alternative, but complementary approach to disclosure-based proposals (see, e.g., Smuha 2021; Laux et al. 2023). The right could be framed in negative terms, such as an individual right not to be affected by administrative decisions resulting from the use of unlicenced systems or systems violating the terms of the relevant licence, which would be a variation of the right not to be subjected to automated decision-making, as it would not challenge the what is done, but how AI is deployed by the public sector. The risk of nullity of all relevant administrative decisions, coupled with the obligation to proactively compensate for their negative effects, would work as effective deterrents against the unlicenced adoption of digital technologies by public sector users.

The need to facilitate oversight before mass effects are created has already been stressed in the existing literature, e.g., arguing for the need to facilitate the early review of decisions to adopt AI by setting aside considerations of the “non-regulatory nature of the administrative process in civil law systems, or the ripeness doctrine in common law systems” (Kouroutakis 2023, p. 12). Along similar lines, the need to consider whether express legislative authorisation for the use of ADM technologies may be necessary or desirable has also been stressed (Miller 2023) as an opportunity for a broader assessment of the planned AI deployment and its socio-technical characteristics. The proposal here charts an intermediate path that can be complementary of both such approaches, inasmuch as it seeks to establish a system of ex ante control and permissioning but not at the legislative level, and with the primary goal of avoiding oversight dependency on the viability of (or initiative for) a (judicial) challenge. The crucial aspect of the proposal from the good administration perspective would be that the mechanisms for the public enforcement of the permissioning system would be strengthened by the parallel mechanism based on individual rights under a revised Article 41 CFR. To further facilitate the enforcement of such individual rights, it would be advisable to consider the possibility of their exercise in a collective manner, e.g., through representative institutions. A detailed assessment of those possibilities exceeds the scope of this paper.

5. Ex Post Automated Redress Duty

It is also increasingly accepted that the automation of decision-making and the mass effects that can result from a single techno-organisational decision pose significant challenges to existing remedy systems (e.g., Jan (2023b)). The importance of remedies in ensuring the proper use of AI systems has been receiving increasing attention, including the role of redress as a mechanism to enhance human agency in AI-dominated decision-making environments (Fanni et al. 2023). This can lead to proposals to, e.g., decouple AI adoption from its mass effects by requiring human involvement in the review of challenges against the initial (automated) decision. However, in my view, assessing redress in the context of mass administrative decision-making seems to require a slightly different (albeit complementary) approach.

In a context of mass decision-making, it is easy to see how the tribunals and courts could quickly become overwhelmed and ineffective if they had to deal with thousands or even hundreds of thousands of claims arising from a single techno-organisational decision (e.g., the implementation of a faulty algorithm in any core digital government service to do with taxation or social security). Given the growing interconnectedness of administrative procedures through the multiple uses of data points and increasing data interconnections or feedforward processes in public sector “data lakes”, it is also increasingly clear that the outputs of a techno-organisational solution (e.g., a flag of potential social benefit fraud) can then “snowball” through an increasingly interconnected and data-driven public administration (e.g., to trigger further flags in relation to other administrative procedures), thus further increasing the volume and variety of harms, damages, and complaints that can arise from a single AI deployment (see, e.g., Widlak et al. 2021). This further compounds the mass effects of supported or automated decision-making processes, as the increase in scale of the potential negative impacts not only concerns a plurality of citizens, but also a plurality of interests by any single citizen. The more centralized or interconnected the public sector, the higher the risk of disproportionate effects arising from faulty supported or automated decision-making processes.

Equally, it is increasingly accepted that there are social interests (e.g., in the proper functioning of the public administration as a crucial element in citizens’ assessments of the functioning of the State and the underlying constitutional settlement) that are not amenable to the current system of individual redress (Smuha 2021). Either because the related incentives do not operate in favour of enforcing any existing checks and balances (e.g., where the individual interest is relatively small and would thus not “activate” individual claims), or because the erosion of social interests is the result of compounded techno-organisational processes with interactive effects in the long run that cannot be separately challenged effectively (Yeung 2019, pp. 42, 75). This poses a major difficulty and also risks undermining confidence in the administrative justice system more generally (along the same lines Meers et al. 2023; Tomlinson et al. 2023).

While ex ante controls on the adoption of AI by the public sector (as above, Section 4) should reduce the likelihood or frequency of such mass and/or collective and social harms, they would not be altogether excluded. It is thus necessary to think about ways to tackle the issue. In my view, a broadening of the right to good administration to encompass a proactive duty on the public administration using an AI deployment to undo the harms arising from techno-organisational decisions would go some way in that regard (similarly, Widlak et al. 2021). A public administration that was put on notice of a (potential) harm arising from an AI deployment would immediately become duty-bound to (a) suspend or discontinue the use of the AI, and (b) proactively redress the situation for everyone affected without the need for any individual claims. To facilitate this, the existence of a mechanism to discontinue the technical deployment and adequate records of the effects and outputs it has generated would be required and would need to be established as conditions for the permission to use the relevant technology (above Section 4). The user public administration put on notice would also be (c) under a duty to report to the licencing or permissioning authority (AIPSA) so that relevant duties to revisit the assessment of equivalent or compounded AI deployments potentially affected by the same problem are triggered. All public authorities using such AI deployments would be under (d) a duty to collaborate in the efforts to proactively undo the damage and to “fix the system” going forward. For this to be implemented, there should be adequate records and inventories on the use of data and digital technology solutions across the public sector, which would require the creation of registries more comprehensive than, e.g., the narrow registers of high-risk AI use foreseen in the EU AI Act.

The implementation of this proposal would require a modification of Articles 41 and 47 CFR, as well as, most likely, the creation of additional legislation at domestic level. A detailed assessment of those implementation issues exceeds the possibilities of this paper.

6. Conclusions

In this paper, I have stressed the “individual rights logic” underpinning the promotion of good administration, which is a common basis of, e.g., OECD jurisdictions. By focusing on European legislation, I have shown how the limitations of the current incarnation of the right to good administration in the CFR will not be sufficiently addressed through the adoption of the EU AI Act or by the adoption of the CoE AI Convention. The emerging “European approach” to reshaping good administration for digital public governance is significantly constrained due to the threshold issues that result from having placed the regulatory focus on high-risk AI uses, as well as by the absence of strictly enforceable individual rights. This will do little to address the broader gaps in the regulation of good administration.

Such gaps are particularly visible when the focus is put on the mass effects that the digitalisation of public sector decision-making is bound to generate. Such mass effects risk depriving good administration rights from any practical effect where supported or automated decision-making systems present administrative decisions as a fait accompli and where the sheer numbers of potentially affected citizens and related (snowball) claims are bound to overwhelm existing mechanisms for the review or appeal of those decisions.

To try to address the challenge of mass effects, I have put forward a proposal to both extend and broaden good administration rights under the CFR. First, I have proposed an extension of the right to good administration to the control of techno-organisational decisions, that is, to (preparatory) phases of administrative decision-making that are not yet directly relevant to the individual. The new (extended) right would be a mechanism to reinforce the creation of a mechanism of external oversight of public sector adoption of digital technologies through ex ante permissioning or licencing (Sanchez-Graells 2024a). It would consist of an individual right not to be affected by administrative decisions resulting from the use of unlicenced systems or systems violating the terms of the relevant licence. Second, I have proposed a broadening of the existing right to obtain redress for the damages arising from defective decision-making, which would have to encompass a proactive duty on the public administration to undo the damage arising from supported or automated decision-making, as well as a duty of inter-administrative cooperation to mitigate or compensate for consequential damages (or risks) arising from the increased centralisation and interconnection of a data-driven public sector.

In my view, both interventions are closely interrelated and, if implemented properly, could offer significant mitigations of the risks inherent in the digitalisation of the public sector. A final reflection is that such interventions—or equivalent ones proposed by others—are urgent. While the legislative framework adapts at a slow pace, the public sector is quickly accumulating a stock of data and digital technology supported or automated decision-making solutions that will be very difficult to dismantle once it gets embedded. Even if it can be dismantled, such dismantling will be very costly. More importantly, the accelerating process of digital transformation is currently externalising significant risks on citizens and, most likely, disproportionately on the most vulnerable citizens. This mere fact is in itself a threat to the existing obligations to protect and promote a broad array of human and fundamental rights. We should not need to wait for the next big scandal to happen before we take decisive action. Much like the EU has been keen to be a trendsetter in the regulation of (some uses of) AI, it should also be willing to be a trendsetter in shaping good administration for the new digital governance paradigm.