Agent passport
Fictional example- Organisation
- Municipality of Exampletown (fictional)
- Agent
- Public space reports agent
- Owner
- Team lead for public space reports
- Version and date
- Version 1, 2 November 2026 (fictional)
- Next review
- On every major change, and within six months at the latest
The agent reads new reports from the web form and the app (a loose paving stone, a broken street light, litter), asks the resident a follow-up question in the form where needed, sets category and location, checks whether a report already exists for that spot and prepares a draft case for the right team in the case system. A staff member picks up the case.
1.Entry in the agent register
In order- Vendor and model
- Vendor of the reporting platform (fictional), with a language model from a model provider through that platform
- Connections and permissions
- Reads the web form and the app; creates draft cases in the case system; no access to the population register or to other cases; fetching web pages is switched off
- Personal data
- Name, email address and optionally the phone number of the resident, the location, the free text and photos, which may show people or number plates
- Role under the GDPR
- The municipality is the controller, the vendor the processor, with a data processing agreement
- DPIA
- Carried out before going live, with date and reason in the register
- Algorithm Register
- The municipality publishes the agent. According to the Algorithm Register itself, a legal duty has been announced but not yet introduced (as of 5 November 2026)
2.The dangerous triangle
Measure takenAt intake
- Reads outside content
- Sees confidential data
- Sends something out by itself
- 3/3
After the measure
- Reads outside content
- Sees confidential data
- Sends something out by itself
- 2/3
- At intake
- All three legs were present: the agent read reports from residents (outside content), saw the names and contact details of other residents when looking for duplicate reports (confidential) and answered the resident in the form (outward). A hidden instruction in a report could therefore make the agent pass on other people's data.
- Measure
- The confidential data leg has been removed: the search returns only the case number, category and status, without data about other residents. Fetching web pages is switched off, because an agent can also put data in a web address.
- Outcome
- The combination of three is broken. If a connection is added, the triangle is tested again.
3.Human approval and Article 22 GDPR
In order- What the agent does itself
- Ask follow-up questions, propose category and location, prepare a draft case
- What only a staff member does
- Close, reject or pass a report on to enforcement, and every message to the resident other than the fixed acknowledgement
- Article 22 GDPR
- The agent takes no decisions with legal or similarly significant effects: a staff member who looks at the report takes them. Meaningful human involvement beforehand takes a decision outside Article 22; rubber-stamping does not. That is why the municipality measures how often staff depart from the proposal.
- Enforced in
- The permissions in the case system, not only in the instructions to the model
4.Logging and kill switch
In order- Logging
- Every call to a connection, every proposal by the agent and what the staff member did with it, in logs the agent cannot change, with a recorded retention period
- Kill switch
- The team lead and the application manager can switch the agent off; reports then continue through the manual queue and the agent's access is revoked
- Last test
- Kill switch tested before going live (fictional date)
5.Disclosing that it is AI (Article 50 AI Act)
In order- Role under the AI Act
- The municipality had the agent developed and puts it into service under its own name. It is then the provider itself and Article 50(1) falls to it.
- What the resident sees
- At the first question in the form, the resident is told they are talking to an AI assistant of the municipality (Article 50(1) and (5)). According to the Commission guidelines (point 31), an agent also discloses on whose behalf it acts; that is not literally in Article 50 and the guidelines are not binding.
- Applies since
- 2 August 2026
- High risk
- No. The agent does not evaluate whether someone is eligible for an essential public benefit or service (Annex III, point 5(a)) and falls under no other point of Annex III. For Annex III the high-risk requirements apply from 2 December 2027; if the task changes, test again.
- AI literacy
- Staff who review the proposals have been trained (Article 4 AI Act)
6.Agreements with the vendor (Article 28 GDPR)
Open point- Data processing agreement
- Signed
- Training on municipal data
- Excluded in the contract. If a vendor may use your data to train its model, it becomes a controller for that purpose itself and you need a legal basis to provide that data.
- Sub-processors
- Open point: the model provider is a sub-processor, but the municipality's prior written authorisation has not yet been recorded (Article 28(2))
- Incidents
- The vendor notifies the municipality of a breach without undue delay (Article 33(2))
7.Incident reporting guide
In order- Why three laws
- A municipality is an essential entity under the Dutch Cybersecurity Act (Article 8(1)(h)). Besides the GDPR, the reporting clocks of that Act therefore apply too. The AI Act reporting duty of Article 73 rests on the provider of a high-risk system, and this agent is not one.
| What happens | Which law | Report to | Deadline |
|---|---|---|---|
| The agent shows or sends personal data of another resident | Articles 33 and 34 GDPR | Dutch Data Protection Authority; in the event of a high risk also the data subjects | Without undue delay and where feasible within 72 hours, unless the breach is unlikely to result in a risk. Recording it internally is always required (Article 33(5)). |
| A significant incident with the reporting platform, for example a disruption caused by misuse of the agent | Articles 25 to 29 Dutch Cybersecurity Act | The CSIRT and the competent authority | Early warning within 24 hours, notification within 72 hours, final report within a month of the notification |
| The vendor discovers a breach on its side | Article 33(2) GDPR | The vendor notifies the municipality, which then assesses whether it must report | Without undue delay |
| A serious incident with a high-risk system | Article 73 AI Act | Not applicable as long as the agent is not a high-risk system; otherwise the provider reports to the market surveillance authority | Immediately and at the latest within 15 days; in the event of a death 10 days; for a widespread infringement or a disruption of critical infrastructure 2 days |
8.Signed opinion
Open point- Opinion
- Fit for use on one condition: measure 2 below is completed before the agent is rolled out more widely
The three measures that remove the most risk
- 1.Let the duplicate search return only the case number, category and status, so the agent sees no data about other residents.Measure taken
- 2.Record the written authorisation for the model provider as a sub-processor, with the exclusion of training on municipal data.Open point
- 3.Test the kill switch periodically and after every change to the platform, and try a hidden instruction in a report text or with a photo while doing so.Open point
Opinion
In this form the public space reports agent is fit for use on one condition: the authorisation for the sub-processor is recorded before the agent is rolled out more widely. The dangerous triangle is broken, decisions stay with staff and residents know they are talking to AI.
Example, not signed. A real agent passport carries the name, the date and the signature of the reviewer.