Research by the Association of Netherlands Municipalities (VNG) shows that municipalities are currently insufficiently prepared for the requirements imposed by the European AI Regulation (AI Act).
The first obligations for municipalities entered into force on 2 February 2025. These include the general provisions, prohibition rules and requirements relating to AI literacy. For new high-risk AI systems, these obligations will apply only from 2 August 2026. Municipalities are therefore granted additional time to comply with the rules for high-risk AI systems.
The time has now come for municipalities to become truly operational in implementing the AI Regulation. In the short term, municipalities must take three key steps. First, they must carry out a comprehensive inventory of their AI systems. Second, they must ensure an adequate level of AI literacy within the organisation. Finally, it is essential that they structure their organisation for AI compliance, so that all statutory obligations can be met.
Inventorying AI systems
Municipalities must first create an overview of all AI systems in use. It is then crucial to classify these systems according to their risk level, distinguishing between prohibited systems, high-risk systems and systems subject to transparency requirements. Organisations typically do this by establishing an algorithm register, in which AI systems and their risk levels are identified. For AI systems that fall within the prohibited category, use must be discontinued before 2 February 2025. Finally, for each system the municipality must determine whether it acts as a provider or as a deployer, as this has direct consequences for the compliance measures that must be taken.
Organising AI literacy
The AI Regulation requires organisations to ensure an adequate level of AI literacy among their staff. This means that employees must have insight into the technical as well as the social, ethical and practical aspects of the AI systems they use. The required level of knowledge differs by role, ranging from basic understanding for general staff to in-depth expertise for specialist functions. Municipalities must assess the current and required levels of AI knowledge, identify gaps and provide appropriate training. This may range from online introductory courses to specialised, role-specific programmes.
Creating an AI compliance officer
Implementing AI compliance requires sustained attention from municipalities. Like other compliance topics, this is not a one-off exercise but an ongoing process. Within several municipalities in the Netherlands, the role of AI Compliance Officer is currently emerging. The framework for this role will differ per municipality, but it requires a multidisciplinary approach and encourages a holistic view of compliance across the organisation. Depending on the size and ambitions of the municipality, this role may be assigned to an existing function, or a new position may be created.
Does every municipality need an AICO?
Every municipality needs some form of AI compliance. Given the complexity and scope of the AI Regulation, the tight implementation timelines and the current lack of preparedness among municipalities, structural oversight of AI compliance is essential. That said, the form this takes can be flexible and should match the scale and needs of the municipality.
For smaller municipalities, this responsibility may be placed with an existing officer who already oversees compliance or information security. Larger municipalities, with more complex AI applications, may choose to appoint a dedicated AICO. The key point is that someone must have final responsibility for the ongoing process of AI compliance.
ICTRecht support for AI compliance
ICTRecht offers comprehensive support with AI compliance matters. We assist organisations through knowledge sharing and tailored training programmes, ranging from in-depth CAICO courses and sector-specific study days to basic training on the required level of AI literacy. We also carry out full AI inventories to identify and classify systems. For organisations that are not yet able to fulfil the role of AI compliance officer internally, we offer flexible solutions. This specialist role can be performed by ICTRecht, either on a secondment basis or remotely, relieving organisations of the burden of complying with the new AI legislation. Want to know more? Visit our website and discover what we can do for your organisation.
