Design Exploration · Public sector · Medium-High stakes
Municipal Benefits Navigator
One resident, two AI systems, two different EU AI Act deadlines, and an interface that has to keep the boundary between them visible.
This is a scrollytelling walkthrough of a fictional council benefits chatbot. Thirteen design decisions, each one shown next to the alternative it beat. It follows one resident’s conversation from first message to handoff, then the caseworker who inherits the case file. Every decision links to a named pattern in the library, or states plainly why none currently fits.
Follows two roles: Resident and Caseworker.
Municipal Benefits Navigator
Introduction
Two systems, one journey
Fenbridge Council runs an AI assistant on its benefits pages. It explains what support exists and can produce a personalised summary. It decides nothing: a caseworker does, possibly with a separate eligibility-scoring tool behind them. Those two systems sit under different parts of the same law, on different clocks. This follows Marion, 54, looking into help with her heating bill before winter.
Two systems, one journey
Fenbridge Council runs an AI assistant on its benefits pages. It explains what support exists and can produce a personalised summary. It decides nothing: a caseworker does, possibly with a separate eligibility-scoring tool behind them. Those two systems sit under different parts of the same law, on different clocks. This follows Marion, 54, looking into help with her heating bill before winter.
Disclosure includes the way out
The identity line sits at the top and stays there, whatever the conversation does. A banner that scrolls away has quietly reverted to a one-time disclosure, exactly what an audience under strain skims once and never sees again.
The route to a person is docked right below it, above the keyboard, present whether Marion is reading or typing, because leaving is a decision she can make at any moment.
A splash message at session open, and escalation gated behind a menu.
Disclosure includes the way out
The identity line sits at the top and stays there, whatever the conversation does. A banner that scrolls away has quietly reverted to a one-time disclosure, exactly what an audience under strain skims once and never sees again.
The route to a person is docked right below it, above the keyboard, present whether Marion is reading or typing, because leaving is a decision she can make at any moment.
A splash message at session open, and escalation gated behind a menu.
Coming back is a new first impression
Marion puts her phone down and returns forty minutes later. The disclosure re-surfaces rather than assuming the banner she saw earlier is still doing its work. The same applies on idle timeout and on any switch of channel.
Info: re-surfacing
A silent resume.
Coming back is a new first impression
Marion puts her phone down and returns forty minutes later. The disclosure re-surfaces rather than assuming the banner she saw earlier is still doing its work. The same applies on idle timeout and on any switch of channel.
Info: re-surfacing
A silent resume.
The reminder is triggered, not printed
The answer starts to sound like a verdict, and the scope line appears in the same breath. A disclaimer parked at the top of the page would do this work nowhere near the moment Marion might read “may qualify” as “approved.”
Info: inline, event-triggered
A standing disclaimer wall.
The reminder is triggered, not printed
The answer starts to sound like a verdict, and the scope line appears in the same breath. A disclaimer parked at the top of the page would do this work nowhere near the moment Marion might read “may qualify” as “approved.”
Info: inline, event-triggered
A standing disclaimer wall.
A sentence instead of a number
Marion asks for a percentage and gets a hedge in plain words . A number here would read as either a promise or a refusal, and both would be false, because this system is not the one assessing her application.
Judge
Confidence & Uncertainty
Considered and rejected
A confidence score, a probability bar, or any graphical equivalent.
This pattern is right in plenty of contexts: a caseworker weighing a risk score, anyone trained to read a calibrated estimate. It’s wrong here, because this assistant has no estimate to be confident about, in any form. Showing one, a number or a bar, would be showing a certainty it doesn’t have. The pattern exists for systems that produce probabilistic outputs with material consequences. This one never assesses anything at all.
A sentence instead of a number
Marion asks for a percentage and gets a hedge in plain words . A number here would read as either a promise or a refusal, and both would be false, because this system is not the one assessing her application.
Judge
Confidence & Uncertainty
Considered and rejected
A confidence score, a probability bar, or any graphical equivalent.
This pattern is right in plenty of contexts: a caseworker weighing a risk score, anyone trained to read a calibrated estimate. It’s wrong here, because this assistant has no estimate to be confident about, in any form. Showing one, a number or a bar, would be showing a certainty it doesn’t have. The pattern exists for systems that produce probabilistic outputs with material consequences. This one never assesses anything at all.
One sentence, then a door
The first reply is one sentence and two buttons , not a briefing. Nothing else competes for Marion’s attention until she asks for it.
Only once she taps does the four-item checklist appear. The pressure here isn’t the clock, it’s stress and stamina, a complete answer up front spends her attention before she’s done anything with it.
Front-loading the full requirements.
One sentence, then a door
The first reply is one sentence and two buttons , not a briefing. Nothing else competes for Marion’s attention until she asks for it.
Only once she taps does the four-item checklist appear. The pressure here isn’t the clock, it’s stress and stamina, a complete answer up front spends her attention before she’s done anything with it.
Front-loading the full requirements.
The smallest change worth naming
The assistant names the one thing Marion can change, not which factors weighed how much. She can act on a fixable gap. She cannot act on model internals, because she cannot change the eligibility criteria, so reasoning she cannot use is either noise or an invitation to argue with a system that decides nothing.
Understand
Counterfactual Explanation
Considered and rejected
Act
Actionable Recourse
Considered and rejected
An attribution or feature-importance display.
Both patterns fit the mechanism at first glance, a fixable gap sounds exactly like the kind of thing recourse and counterfactual explanations are for. Checking them against their own definitions caught the mistake: both require an adverse decision to already exist, and nothing has been decided at this point in Marion’s conversation.
The smallest change worth naming
The assistant names the one thing Marion can change, not which factors weighed how much. She can act on a fixable gap. She cannot act on model internals, because she cannot change the eligibility criteria, so reasoning she cannot use is either noise or an invitation to argue with a system that decides nothing.
Understand
Counterfactual Explanation
Considered and rejected
Act
Actionable Recourse
Considered and rejected
An attribution or feature-importance display.
Both patterns fit the mechanism at first glance, a fixable gap sounds exactly like the kind of thing recourse and counterfactual explanations are for. Checking them against their own definitions caught the mistake: both require an adverse decision to already exist, and nothing has been decided at this point in Marion’s conversation.
The scope line rides along
This is the moment the assistant most sounds like it is judging her case, so the reminder comes with it. A recourse statement offered without a visible line back to the accountable human is precisely where the boundary between the two systems starts to blur.
Info: at the point of maximum authority
Letting the counterfactual stand alone.
The scope line rides along
This is the moment the assistant most sounds like it is judging her case, so the reminder comes with it. A recourse statement offered without a visible line back to the accountable human is precisely where the boundary between the two systems starts to blur.
Info: at the point of maximum authority
Letting the counterfactual stand alone.
Marked, and checked from outside her
The card is bordered and timestamped, AI-generated, distinct from the messages around it. Everything upstream disclosed an AI Marion was talking to, and none of that travels with a PDF on its own.
A link to the council’s own page sits on the same card, and downloading confirms the label will travel with the file. Marion doesn’t know the real criteria, which is why she asked, so the design can’t lean on her judgement, it leans on the source and the marking instead.
An on-screen-only label, and treating the assistant’s fluency as its own proof.
Marked, and checked from outside her
The card is bordered and timestamped, AI-generated, distinct from the messages around it. Everything upstream disclosed an AI Marion was talking to, and none of that travels with a PDF on its own.
A link to the council’s own page sits on the same card, and downloading confirms the label will travel with the file. Marion doesn’t know the real criteria, which is why she asked, so the design can’t lean on her judgement, it leans on the source and the marking instead.
An on-screen-only label, and treating the assistant’s fluency as its own proof.
The record goes with her
The conversation carries forward, and the caseworker is told the interaction was AI-assisted. A cold handoff makes someone in a difficult situation explain it twice and discards the record that makes the interaction reviewable at all.
A handoff that starts the caseworker from zero.
The record goes with her
The conversation carries forward, and the caseworker is told the interaction was AI-assisted. A cold handoff makes someone in a difficult situation explain it twice and discards the record that makes the interaction reviewable at all.
A handoff that starts the caseworker from zero.
Two blocks, never one voice
The transcript arrives already marked, AI-generated, with the council sources it drew on listed alongside it.
The eligibility assessment sits in its own section, separately, empty here because it hasn’t run. If both lived under one heading, the caseworker would inherit the impression that “the AI” had already formed a view.
Info: mixed authorship indicator
A single AI voice across the case file.
The chatbot’s transparency duties have been in force since 2 August 2026. If Fenbridge runs a scoring tool for eligibility for essential public services, that tool is high-risk under Annex III, and its explanation and human oversight duties fall on a later timeline, December 2027. One resident, one afternoon, two regulatory tracks, one live and one not yet due. Real services will look like this, and the interface is what keeps the boundary legible.
Two blocks, never one voice
The transcript arrives already marked, AI-generated, with the council sources it drew on listed alongside it.
The eligibility assessment sits in its own section, separately, empty here because it hasn’t run. If both lived under one heading, the caseworker would inherit the impression that “the AI” had already formed a view.
Info: mixed authorship indicator
A single AI voice across the case file.
The chatbot’s transparency duties have been in force since 2 August 2026. If Fenbridge runs a scoring tool for eligibility for essential public services, that tool is high-risk under Annex III, and its explanation and human oversight duties fall on a later timeline, December 2027. One resident, one afternoon, two regulatory tracks, one live and one not yet due. Real services will look like this, and the interface is what keeps the boundary legible.
Municipal Benefits Navigator
Introduction
Fenbridge Benefits Assistant
This is an AI service, not a council officer.
That’s the story. What follows isn’t more of it, pick what’s useful: the full decision record, what didn’t go as planned while building this, or the regulatory grounding behind it. Any order.
The pattern record
What to take with you
Every choice in this Exploration answers one question: who’s reading this, and what can they actually do with it? Five of the thirteen decisions, below. All of them are in the full walkthrough.
-
The resident · on her phone
Marion can’t check whether the assistant is right. Walking away is the one move she always has.
A path to a human, docked and always visible
Escalation buried behind a menu
Pattern: AI Presence Disclosure
-
The resident · reading the answer
“May qualify” reads as “approved.” A reminder at that moment gets read; one at the top of the page doesn’t.
A scope reminder triggered the instant language sounds like a verdict
A standing disclaimer nobody reads
Pattern: Model Scope & Limits
-
The resident · asking for odds
Marion asks for a percentage. This assistant isn’t the one assessing her application, so any number would be made up.
Uncertainty hedged in plain words
A confidence score for an estimate the system doesn’t make
Pattern: Confidence & Uncertainty *Considered and rejected
-
The resident · after the chat
The summary leaves her screen. The label has to travel with it.
The AI-generated label lives inside the artifact itself
A label that only exists on-screen
Pattern: AI-Generated Content Marking
-
The caseworker · opening the file
She has to know which part was a conversation and which was a determination before acting on either.
Assistant and decision tool kept in separate blocks
One undifferentiated “the AI decided” voice
Pattern: AI-Generated Content Marking
The reflex to watch for
Treating every AI-facing reader like the trained reviewer: a confidence score, a source list, a feature-importance chart, shown to someone with no use for any of them, because that display was correct somewhere else in this library. The pattern that’s right for one reader can be actively harmful for the next. The question is never “is this pattern correct,” it’s “correct for whom.”
Patterns applied
Five of these are shown above, illustrated with real screens. Below is the complete record: eleven decisions this Exploration made, six applied and five turned down, each with the reasoning that led there.
AI Presence Disclosure
Am I interacting with an AI?
The identity header and the always-available path to a person are one design move, not two: disclosing that this is AI isn’t complete until the resident also knows how to reach a person instead. Persistent, not a one-time splash screen, re-surfaces after idle timeout, session resume, or channel switch, because “obvious from context” can’t be assumed to hold indefinitely for this audience.
Model Scope & Limits
What can this system reliably do?
Inline and event-triggered. The assistant appends a scope reminder in the same breath whenever its own language edges toward a verdict, both when an answer starts sounding like “you likely qualify,” and again at the fixable-gap moment, which is the point the assistant most sounds like it is judging the case. Chosen over a standing disclaimer wall that does its work nowhere near the moment the misreading happens.
Explanation Layering
How much detail do I need?
First answers stay simple: one sentence and a next step. Detail, specific documents, deadlines, edge cases, is available on request rather than front-loaded. Justified by stress and stamina, not by seconds mattering.
AI-Generated Content Marking
If this leaves the system, will it still say AI made it?
The generated summary card is bordered, timestamped, and labelled AI-generated, with the marking embedded in the export itself rather than only the on-screen view, and a verification link to the council’s own page on the same card. In the caseworker’s case file, the same pattern’s mixed-authorship indicator keeps the assistant’s transcript and the separate, not-yet-run eligibility assessment in two distinct blocks, never merged into one undifferentiated AI voice.
Audit Trail & Logging
What is the complete record of this decision?
The transcript carries forward at handoff, marked as AI-assisted, so the caseworker inherits the record rather than the resident restarting a difficult conversation from zero. This is exactly the kind of situation the pattern is meant for: more than one party touches the eventual decision, and the interaction needs to hold up if someone looks back at it later.
Retrieved Source Attribution
What sources did the system draw from?
The assistant retrieves from the council’s own scheme documents at runtime, and which sources it drew on is recorded in the case file. Deliberately absent from the resident’s interface: this kind of detail is for someone who might need to cite or audit the answer later. The caseworker might. Marion doesn’t.
Patterns not applied
Three of these are dramatized at specific moments in the story above. The other two, Human-in-the-Loop and Contestability & Appeal, aren’t tied to one scene, they’re boundaries the whole system respects, because this chatbot never decides anything for either pattern to apply to.
Considered and rejected
This pattern is for a human who can override an AI’s recommendation, a supervisor checking a fraud flag, a clinician confirming a diagnosis. This chatbot never produces a recommendation for anyone to override, it doesn’t decide eligibility at all, that sits with a separate tool this Exploration doesn’t design. Marion’s route to a person isn’t this pattern either: she’s the person the decision would affect, not an operator reviewing someone else’s case.
Considered and rejected
This pattern exists for challenging a decision once one’s been made. Nothing has been decided anywhere in Marion’s conversation, so there’s nothing yet to contest.
Considered and rejected
Genuinely correct in other contexts: a system that produces a real probability, read by someone who might otherwise over-trust a clean number, should show its uncertainty. Wrong here, because this assistant never produces a probability in the first place. Showing a confidence score anyway wouldn’t be caution, it would be dishonest, a number this system doesn’t actually have, presented as if it does.
Considered and rejected
Considered for the moment the assistant tells Marion that submitting proof of residence would likely help her application, then rejected on closer reading. This pattern explains what would have changed an outcome that’s already gone against someone. Nothing has gone against Marion, nothing has been decided at all, so there’s no adverse outcome yet for a counterfactual to explain.
Considered and rejected
Same moment, same correction. This pattern gives someone concrete steps to reverse a decision that already went against them. Marion’s application hasn’t been decided at all, so there’s no outcome yet for her to reverse, just something to strengthen before a decision ever gets made.
What didn’t go smoothly
Two mistakes we caught and fixed while building this. Five tensions we haven’t resolved yet.
Mistakes we caught
-
A pattern that only looked right
Two patterns were first attributed to the moment the assistant tells Marion that submitting proof of residence would help her application, Counterfactual Explanation and Actionable Recourse. Both fit the mechanism. Checking them against their own definitions caught the mistake: both require an adverse decision to already exist, and nothing has been decided at that point in Marion’s conversation. That moment currently carries no library pattern. Writing patterns down precisely is what makes them checkable, a loosely-described pattern can’t be caught being misapplied.
-
Correct pattern, wrong reader
Confidence & Uncertainty is a real pattern in this library, and it’s correct wherever a system has an actual calibrated estimate and a reader trained to weigh it. Neither is true here: this chatbot never assesses anything, so it has nothing to be confident about. The same pattern can be the right call in one context and actively harmful in the next, and the difference is the reader in front of it, not the technology.
Linked: Confidence & Uncertainty
Open tensions
Banner fatigue
Banner fatigue
Risk
A persistent disclosure header risks becoming wallpaper, close to the “obvious from context” exemption the law allows, except obviousness can’t be assumed for an audience that may include exactly the literacy-limited and vulnerable users the guidance treats as the hard case.
Mitigation
Re-surface disclosure at natural restart points (idle timeout, channel switch) rather than relying on one persistent line to do all the work.
Marking that doesn’t survive export
Marking that doesn’t survive export
Risk
An on-screen label that vanishes the moment a resident screenshots or prints the summary defeats the purpose of content marking.
Mitigation
Test marking against actual export paths, not just the live screen.
Scope confusion between two AI systems
Scope confusion between two AI systems
Risk
If the chatbot’s plain-language helpfulness blurs into a separate eligibility tool’s actual decision, residents and caseworkers may not know which system said what.
Mitigation
Keep “what the assistant told you” and “what the decision tool determined” visually and verbally separate, including in the caseworker’s source list. Never merge them into one undifferentiated AI voice.
Over- or under-triggering human handoff
Over- or under-triggering human handoff
Risk
Too eager an escalation path defeats the assistant’s purpose and burdens caseworkers. Too reluctant a path undermines the intent of accessible oversight, even where it isn’t strictly required by Article 50 itself.
Mitigation
Needs real usage data to tune, not a one-time design decision. Left open below.
No human name, for a low-literacy audience that may want warmth
No human name, for a low-literacy audience that may want warmth
Risk
Withholding a human name or persona is the correct disclosure-safety call, but it may read as colder or less approachable to exactly the audience this service needs to reach, older residents and people with lower digital literacy who may find a named, personified assistant easier to relate to.
Mitigation
Address warmth through tone and plain language rather than personification. Not tested with real users; flagged as a real tension, not a resolved one.
Background
EU AI Act reading
A designer’s reading of publicly available regulatory text, written to explore what it implies for interface decisions. Not legal advice, not reviewed by counsel.
-
Article 50(1)
Applies directly to the chatbot. Not part of the AI Omnibus deferral, and has been in force since 2 August 2026. The persistent identity header and the always-available path to a person are the direct design response, treated as one move rather than two.
-
Article 50(2)/(4)
Content marking is also not on the deferred track for deployer-facing transparency. The generated summary card’s embedded marking, surviving export, is the direct design response.
-
Annex III, point 5(a) (conditional)
If a separate high-risk eligibility tool exists behind this chatbot (eligibility for essential public benefits), its Article 13/14/86 obligations sit on the deferred December 2027 track that covers high-risk AI systems generally. Two timelines, one resident journey: the assistant’s disclosure duties are live now; the decision tool’s explanation and oversight duties, if such a tool exists, are not yet due.
-
Guidance status
The Commission’s Article 50 Guidelines, including the “obvious from context” test and its weighting toward vulnerable groups, were adopted 20 July 2026 and apply from 2 August 2026. Treat the specifics here as aligned with adopted guidance rather than a draft reading, but re-verify before client-facing use in case of subsequent clarification.
Your public-facing chatbot has been under Article 50 since August 2026, and the disclosure is a one-time splash screen.
Persistent disclosure, a visible way to a person, marking that survives export. That’s where this Exploration starts. Let’s look at your interface together.
Work with me