Suppose the social affairs team of a mid-sized municipality gets a demo of an agent that reads incoming applications, sorts them by urgency and prepares a draft decision. The customer contact centre wants the same technology for an assistant that answers residents. And an employee in legal affairs has linked an agent to her own mailbox that summarises requests under the Open Government Act (Woo). Three agents, three departments, and nobody is sure who owns them or which rules apply.
AI agents in a municipality in brief
There is no separate regime for AI agents in a municipality: the GDPR, the Awb and the AI Act apply, and according to the Dutch government the government-wide position on generative AI covers agents too, with an impact assessment such as a DPIA or IAMA beforehand. If an agent processes personal data for municipal tasks, it needs a legal basis in Union or national law (usually Article 6(1)(e) GDPR) and, where the risk is likely to be high, a prior DPIA (Article 35 GDPR). A decision remains the administrative authority's own: the Awb demands careful preparation and sound reasons, and according to the government there must always be meaningful human intervention when public bodies use autonomous AI in decision-making. Under the AI Act, the prohibitions of Article 5, Article 4 and Article 50 already apply. An agent that assesses whether someone is eligible for an essential public assistance benefit or service is in principle high-risk (Annex III point 5(a), with an exception in Article 6(3)): the high-risk requirements and a fundamental rights impact assessment (FRIA) for the municipality then apply from 2 December 2027, for systems already in use only after a significant change and at the latest by 2 August 2030. The plan: take inventory, assess, limit, record and test, keep oversight, with an owner in the line for every agent.
Which rules apply to AI agents in a municipality?
According to the European Commission, an AI agent is typically an AI system, not a separate category, although it calls that view preliminary (see our guide to AI agents and the law). For a municipality, four layers apply at once.
GDPR: legal basis, DPIA and automated decisions
A municipality processes personal data to carry out statutory tasks, so the legal basis is usually Article 6(1)(e) GDPR, and that basis must be laid down in Union or national law (Article 6(3) GDPR). A public authority cannot rely on legitimate interests when performing its tasks (last subparagraph of Article 6(1) GDPR). The purpose is therefore the statutory task, not the tool: in its Haarlemmermeer advice the Dutch Data Protection Authority (AP) wrote that deploying a generative AI system must not be an aim in itself. A data protection impact assessment (DPIA) is required before the processing if the risk is likely to be high (Article 35 GDPR), with the advice of the data protection officer (DPO). If a high risk remains after your measures, you consult the AP (Article 36 GDPR). See the Copilot DPIA after the AP's advice.
If the agent takes decisions, Article 22 GDPR applies: decisions based solely on automated processing that have legal or similarly significant effects are prohibited in principle. According to the AP, a decision is solely automated if a generative AI system plays a decisive role. Article 40 of the GDPR Implementation Act (UAVG) lifts the prohibition for automated decisions without profiling that are necessary to comply with a legal obligation or to perform a task in the public interest, provided you take suitable measures. Under Article 40(3) UAVG, three safeguards (human intervention, expressing a view, contesting the decision) are in any event sufficient for a controller that is not an administrative authority; in our reading, a municipality therefore has to justify the suitable measures of paragraph 2 itself. See AI agents and Article 22 GDPR.
Awb and government: careful preparation, reasoning and a human who really decides
What an agent prepares can end in a decision: a written ruling of an administrative authority that involves a public-law legal act (Article 1:3 of the General Administrative Law Act, Awb). That decision remains the authority's (in a municipality the college of mayor and aldermen, the mayor or the council), even when an employee takes it under mandate (Article 10:2 Awb). When preparing it, the authority gathers the necessary knowledge about the relevant facts and the interests to be weighed (Article 3:2 Awb), and the decision must rest on a sound statement of reasons (Articles 3:46 and 3:47 Awb). In our reading, a fact the agent invented therefore cannot end up unchecked in that statement of reasons.
In its answers to parliamentary questions (29 April 2026), the Dutch government writes that where public bodies use autonomous AI assistants for (algorithmic) decision-making, there must always be meaningful human intervention, and that the technology-neutral Awb also governs the use of AI. That is a government position, not a statutory provision.
AI Act: Articles 4 and 50 apply now, high-risk from 2 December 2027
The prohibitions of Article 5 already apply as well. Article 4 requires measures that support the AI literacy of staff. Article 50 has applied since 2 August 2026. The duty to tell people they are communicating with AI rests on the provider, and that can be the municipality itself: according to the Commission's guidelines (C(2026) 5054, point 11), a public authority that develops a chatbot in-house and puts it into service under its own name for its own use is also a provider. An agent that handles correspondence falls under paragraph 1; according to point 31 (not binding), it must be designed so that it also discloses on whose behalf it acts.
The high-risk requirements apply to Annex III systems from 2 December 2027 (Regulation (EU) 2026/1744). Point 5(a) covers systems used by or on behalf of public authorities to assess whether people are eligible for essential public assistance benefits and services, or to grant, reduce, revoke or reclaim them. A narrow procedural or preparatory task may fall under Article 6(3), but never if the system profiles people. If the system is high-risk, the municipality, as deployer and body governed by public law, carries out a fundamental rights impact assessment (FRIA) before first use, in which it may refer to the DPIA where that already covers parts of it, notifies the market surveillance authority of the results (Article 27(3)) and registers its use in the EU database (Article 49(3)). If the municipality builds the agent itself (Article 3(3)), or uses a general-purpose agent for such an assessment and thereby changes its intended purpose (Article 25(1)(c)), it is also the provider of a high-risk system, with the duties of Article 16, such as the conformity assessment, the CE marking and the registration of the system (Article 49(1)). If the system is already in use before 2 December 2027, the requirements and, in our reading, the FRIA apply only after a significant change in design after that date, and systems intended for public authorities must comply by 2 August 2030 at the latest (Article 111(2)). For an agent that is updated constantly, that moment comes quickly. See the FRIA for municipalities.
The government-wide position also covers agents
According to the government, the government-wide position on the use of generative AI (document of 30 January 2025, presented to the House of Representatives on 22 April 2025) also applies to more autonomous forms of AI such as AI agents. Public bodies must always carry out an impact assessment beforehand, for example a DPIA or a Human Rights and Algorithms Impact Assessment (IAMA), and it must be clear which societal purpose the deployment serves. The IAMA was aligned with Article 27 of the AI Act in February 2026. The position itself also asks for agreements with suppliers on data sharing, data retention and retraining, and lists an exit strategy among the questions for the risk analysis; generative AI under consumer terms is not allowed for public employees. The position is policy, not law, but it was drawn up for all public organisations, municipalities included. A revision with attention to agentic AI has been announced.
What does this mean for three example agents?
The three hypothetical agents from the opening, set against the rules:
| Agent | What it does | What that means |
|---|---|---|
| Applications agent | Checks applications, sorts them by urgency, drafts a decision | Preparation of an Awb decision and, if it plays a decisive role, a question under Article 22 GDPR. In the Commission's draft guidelines (19 May 2026, not binding), prioritising and making a proposal on applications for essential benefits or services are examples of high-risk under point 5(a). That calls for a DPIA (mandatory where the risk is likely to be high, Article 35 GDPR), under the government-wide position also an IAMA, a FRIA once the high-risk requirements apply, and a case handler who really decides. Merely referring an application to the right case handler falls outside point 5(a). |
| Woo agent | Summarises a request and the documents found, proposes what can be disclosed | The decision stays with the administrative authority: as soon as possible and at the latest within four weeks, extendable once by at most two weeks (Article 4.4 Woo). That deadline makes accepting the proposal tempting: watch for automation bias, the tendency to follow a computer's advice uncritically. Limit what the agent can read. |
| Resident agent | Answers residents' questions | Article 50(1): the municipality may itself be the provider. No decision as long as it does not assess entitlements; define when it hands over to a person. |
Who in a municipality owns an AI agent?
The law does not designate an owner of an agent. This is the allocation we recommend, based on the BIO2 (Baseline Information Security Government 2) and the GDPR:
| Role | Task for an AI agent | What it rests on |
|---|---|---|
| College of mayor and aldermen | Approves the security measures and is usually the controller; we recommend that it also decides whether an agent with a high residual risk may start | Article 24 of the Dutch Cybersecurity Act (paragraphs 1 and 12(d)); Articles 24 and 36 GDPR; privacy policies of Hoogeveen and Heumen |
| Line manager | Owns the agent and its risks, sets the approval points and accepts residual risks at the supplier | BIO2, section 12.2 and government measure 5.22.01 |
| CIO and CISO | The CIO manages platform, suppliers and register; the CISO coordinates security but is not responsible for security in the line | BIO2, section 12.1 (the CIO advises the board) and 12.3; the CIO's tasks are our recommendation |
| DPO | Advises independently on the DPIA and monitors compliance | Articles 35, 38 and 39 GDPR |
A DPO who personally owns an agent would be reviewing their own work, which can create a conflict of interests (Article 38(6) GDPR). Municipalities are also essential entities (Article 8(1)(h) of the Dutch Cybersecurity Act): the college approves the security measures, and within two years each college member shows, with a certificate of training attendance, enough knowledge to assess cyber risks (Article 24 of the Dutch Cybersecurity Act). According to the BIO2 itself, that standard is mandatory through the act for the government sector. See AI agents and the Dutch Cybersecurity Act.
How does a municipality arrange AI agent governance? In five steps
Every step has an owner. Work through them per agent, starting with the agents already running.
Take inventory of every agent, including shadow agents
Owner: the CIO, with the line managers. List all agents: bought, built in-house, built in by suppliers and switched on by employees themselves. The AP expects agents to reach users of their own accord through built-in features in browsers and operating systems (RAN 6) and advises against using OpenClaw and similar agents on systems with privacy-sensitive or confidential data. The government-wide position does not allow generative AI under consumer terms. Make it safe for employees to report an agent, put every agent in an agent register and update the record of processing activities. More on shadow AI.
Assess each agent
Owner: the line manager, with a legal adviser and the privacy officer; the DPO advises. Which statutory task does the agent serve? Does it take or determine a decision (Awb, Article 22 GDPR)? What is your role under the AI Act, and does the purpose fall under Annex III? Are a DPIA, IAMA or FRIA needed? Does the agent have, at once, access to personal data, input that cannot be trusted (a resident's email) and the ability to communicate externally? Then remove one of the three, or have a person approve every outgoing message (the dangerous triangle from our guide). The Agent-check gives a first indication.
Limit
Owner: the line manager; the CIO and CISO set up the limits and test them. Give the agent only the data and connections its task needs; the BIO2 names need-to-know and zero trust as principles. Record what a person must approve: every decision, every message to a resident and anything irreversible. Build that into the software, not only into the instruction to the model. Set up a kill switch and test it: who switches the agent off, and how do you revoke its access?
Record and test
Owner: the line manager; legal adviser and DPO advise. Carry out the DPIA before go-live and, for Annex III point 5(a), plan the FRIA too. Publish impactful algorithms and high-risk AI systems in the Algorithm Register: that is established government policy, unless grounds for exclusion apply (Algorithm Framework). According to the register itself (5 November 2026), a statutory obligation has been announced but not yet introduced, and the AP advised Haarlemmermeer to register Copilot there. Test in a separate test environment, and with real case files only if the DPIA covers that use, how often the person departs from the agent's proposal, and try a hidden instruction in an email. Log for each decision what the agent supplied and what the person did: you need that for the statement of reasons, an objection and an access request. Agree with the supplier on roles, no training on your data and incident reporting (see the contract for an AI agent). Municipalities can use the VNG's GIBIT 2025 purchasing terms, whose article on AI systems includes a supplier duty to help prevent the municipality from being treated as the provider, and the EU model contractual clauses for AI procurement (MCC-AI, updated version of 5 March 2025). Both are contract models, not law. The MCC-AI were written for public organisations, cover only AI Act topics and are not a full contract: the GDPR, intellectual property and the allocation of loss are arranged elsewhere.
Keep oversight
Owner: the line manager day to day; the DPO monitors compliance; the college receives the reporting. Check periodically that the human factor remains decisive, as the AP asks (see meaningful human intervention in practice). Make sure those who supervise are sufficiently AI-literate; the measures for that fall under Article 4 AI Act. Practise the incident process: you report a personal data breach to the AP without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk, and you record every breach internally (Article 33 GDPR). Reassess after every major change: a new model or purpose can change the risk class and require the FRIA to be updated (Article 27(2)).
Back to the municipality from the opening. The applications agent gets an owner, a DPIA and an IAMA, and a case handler who reads the file personally and can depart from its proposal. The Woo agent, which the employee linked to her own mailbox, is registered or switched off; if it stays, it reads only what it needs and sends nothing out. The resident agent says it is AI and hands over to a person. If you want someone to check your work, from the DPIA to the FRIA, you can hire Zahed Ashkara as an AI and privacy legal adviser.
Frequently asked questions about AI agents in a municipality
Sources
Newsletter
Every Tuesday, the AI Act week ahead in 5 minutes
A practical briefing on deadlines, new guidance and enforcement, so you know what matters this week. No spam and you can unsubscribe in one click.
Practical and short · No spam · One-click unsubscribe