Date: 2026-08-31 Legal basis: Regulation (EU) 2024/1689 (AI Act), in force since 01.08.2024, phased application until 2026/27 Responsible: Leibniz University Hannover (LUH), Institute of Landscape Architecture Project: BlueGreenCity-KI (BMUKN Grant 67KIA4032B)
The system is not a high-risk system within the meaning of the AI Act. Rationale:
| Criterion | Assessment |
|---|---|
| Annex III (high-risk use cases) | Not met – no use in education, employment, credit scoring, law enforcement, critical infrastructure, or biometric categorisation |
| Significant impact on fundamental rights | No – decision support for urban tree care, no automated decision about individuals |
| Significant impact on public services | No – the tool supports the prioritisation of irrigation measures; the final decision rests with the specialist staff of the City of Hanover (LHH) |
| Generative AI / biometric categorisation | No |
| Human oversight (HITL) | Yes – Phase 3 explicitly provides for human review and approval |
The system is a decision support system for urban tree care. It computes an AI-based drought risk score for street trees and provides explanations (SHAP). The final decision on irrigation measures is made by the LHH specialist staff.
Obligation: Users must be informed that they are interacting with an AI system or receiving AI-generated results.
Implementation:
README.mdStatus: ✅ Implemented (2026-08-31)
Requirement: AI systems must be designed so that natural persons can effectively oversee them.
Implementation:
overall_drought_risk), not a replacementStatus: ✅ Meets the requirements
Requirement: Training, validation, and test data must be relevant, representative, and as free from errors as possible.
Implementation:
bluegreencity_ki/plausibility/checker.py)objectid), out-of-time holdoutdocs/validation/validation.md, docs/risk_assessment_ml/reports/Status: ✅ Meets the requirements
Requirement: Sufficient documentation for traceability.
Implementation:
docs/config/config.yaml (versioned)docs/risk_assessment_ml/reports/docs/risk_assessment_ml/automl_features.mdStatus: ✅ Meets the requirements
| Obligation | Reason |
|---|---|
| Conformity assessment (Art. 43) | Not a high-risk system |
| CE marking | Not a high-risk system |
| Registration in the EU database (Art. 49) | Not a high-risk system |
| Post-market monitoring plan (Art. 72) | Not a high-risk system |
| Reporting of serious incidents (Art. 73) | Not a high-risk system |
| Date | Milestone |
|---|---|
| 01.08.2024 | AI Act in force |
| 02.02.2025 | Prohibition of unacceptable AI practices (Art. 5) |
| 02.08.2025 | Obligations for General Purpose AI (GPAI) |
| 02.08.2026 | Full applicability incl. limited-risk transparency obligations (Art. 50) |
| 02.08.2027 | Applicability to high-risk systems in critical infrastructure |
Relevance for BGC-KI: From 02.08.2026 the transparency obligations for limited-risk systems apply in full. The implementation (Section 2.1) has already been carried out.
The pipeline processes predominantly non-personal (factual) data:
No personal data in the core process (no names, addresses, photos, or citizen reports).
The irrigation_planning module stores reviewer, approved_by, and
reported_by in PostGIS. Per Issue #214 (Option A), these columns hold
role identifiers (e.g. R1, F1), never real person names. No
identifier-to-person mapping is stored in the system and no technical means
of re-identification are kept, so within the system the values are
anonymised in the GDPR sense (Art. 4 No. 1) and do not constitute
personal data. (Had a revocable mapping been retained they would be
pseudonymised and still personal data — that is deliberately not the
case here.) The UI labels enforce this
(“Rollen-Kennung … kein echter Name”).
The tree inventory originates from the City of Hanover. The joint processing (LUH + LHH) is governed by the cooperation agreement. A separate data processing agreement (Art. 28) or an arrangement under Art. 26 (joint controllers) is not required for the prototype, since no personal data is processed.
The system runs entirely locally on the project workstation:
Benefit for the AI Act: Substantially simplifies the data-governance rationale (Art. 10 by analogy).
ALKIS/LBEG data are subject to the usage terms of the Lower Saxony State Survey. Reuse in outputs (GPKG, GitHub Pages) is licence-compliant provided the source attribution is retained (see NOTICE).
The SHAP outputs and validation reports simultaneously serve as evidence for:
| Aspect | Status |
|---|---|
| Risk classification | Limited Risk (Art. 50) |
| Transparency notice in outputs | ✅ Implemented |
| Human oversight (HITL) | ✅ Phase 3 |
| Data governance | ✅ Local, documented |
| Technical documentation | ✅ docs/ |
| Conformity assessment | Not required |
| GDPR: personal data | ✅ None – irrigation_planning uses pseudonymised role IDs (Issue #214, Option A) |
| GDPR: Art. 30 record of processing | Not required (no personal data) |
| GDPR: DPIA | Not required (no high risk) |
docs/risk_assessment_ml/archive/ML Initial Plan.md (Phase 5, item 18)