AI for the public sector

Frequently asked questions

• Which regulations apply to AI in the public sector?

  The main frameworks are:

  • EU AI Act: Public bodies deploying high-risk AI must assess the impact on fundamental rights from 2 December 2027.
  • GDPR: Citizen data needs a clear legal basis and purpose limitation.
  • NIS2: Public administration entities are in scope.
  • National cloud policy: The Tweede Kamer wants at least 30% of government cloud use in EU clouds by 2029. The cabinet treats this as a parliamentary wish, not a set target (July 2026).

• What are the main challenges of adopting AI in the public sector?

  Organisations in this sector most often face three issues:

  • Rights assessments before deployment: From 2 December 2027, public bodies deploying high-risk AI must first assess its impact on fundamental rights and report the results to the market surveillance authority. AI that decides eligibility for public benefits and services is explicitly high-risk. Systems bought today may still run then.
  • Jurisdiction over citizen data: Under the US CLOUD Act, a US-owned provider must disclose data in its possession, custody or control, wherever it is stored. An EU data centre alone does not protect benefit, permit or residence files.
  • Lessons from the benefits scandal: In December 2021 the Dutch Data Protection Authority fined the Tax Administration €2.75 million for unlawful, discriminatory use of dual nationality in childcare benefit applications and risk assessment. Every public algorithm is now judged against that case. From 2 December 2027, people affected by high-risk AI decisions can demand an explanation.
  • Sovereignty ambitions without a baseline: In June 2025 the Tweede Kamer adopted a motion for at least 30% of government cloud use to be Dutch or European by 2029. Acting on it needs a baseline: which AI workloads could move, where, and at what cost.
  • Tenders that outlast models: Service contracts above €140,000 for central government and €216,000 for other authorities fall under EU procurement rules. A tender built around one named model can be outdated before the contract starts. Good specifications describe capabilities, hosting and exit terms.

• Where does AI create value in the public sector?

  The use cases with the clearest value are:

  • Case file summaries: Summaries of applications, objections and case files help civil servants prepare decisions faster. The decision stays human. The files hold citizen data, so the model belongs on infrastructure the organisation controls.
  • Plain-language letters: Clearer letters and decisions drafted from existing templates and case details, checked before sending. The Dutch Ministry of the Interior is among the first to test the Dutch model GPT-NL, including for a clearer-letters tool for civil servants.
  • Multilingual citizen information: Resident information in the EU's 24 official languages and other local languages, drafted from verified sources. A self-hosted model keeps citizen questions out of third-party systems.
  • Consultation and policy analysis: Consultation responses, legislation and reports sorted by theme and argument. Much of this material is public, so a European cloud is often enough when no personal data is involved.

• Can organisations in the public sector run AI on their own infrastructure?

  Yes. Open-weight models can run on-premise or in a European private cloud, which keeps data and model access under the organisation's control. Whether that is cheaper than an external API depends on sustained volume, and whether it is required depends on data sensitivity and regulation. Lindstead's break-even analysis shows the volume at which own infrastructure pays off.

• Does a public body need a fundamental rights impact assessment before using AI?

  Yes, for high-risk AI. Article 27 of the AI Act requires bodies governed by public law and private entities providing public services to assess the impact on fundamental rights before deploying a high-risk system listed in Annex III. Systems for critical infrastructure are exempt. Under the AI Omnibus (Regulation (EU) 2026/1744), this applies from 2 December 2027. The results go to the market surveillance authority. AI that evaluates eligibility for public assistance benefits and services is explicitly high-risk.

• Does storing citizen data in an EU data centre of a US provider protect it from US access?

  Not fully. The US CLOUD Act of 2018 requires US providers to disclose data in their possession, custody or control, inside or outside the United States. Who runs the service matters as much as where the data sits. Open-weight models on own servers or with a European-owned provider close that route, though not other security risks.

• May Dutch civil servants use generative AI tools such as chatbots?

  Yes, under conditions. A government-wide position agreed in April 2025 with municipalities, provinces, water boards and implementing organisations gives civil servants more room to use generative AI. A risk analysis comes first, such as a DPIA when personal data is processed. Applications developed and managed in Europe are recommended. In February 2025 central government banned civil servants from using the DeepSeek chatbot for work.