A CISO at a mid-sized Dutch municipality is preparing the annual information security accountability report. The evidence folder holds last year's AI policy, a data processing agreement for Microsoft 365 and the attendance list of an awareness session. For the question of which AI services were actually used this year, she has no document.
That is the question the BIO asks without using the word AI. Everyday AI use lands in four themes that have been in the baseline for years. Classification, supplier management, awareness and logging. Apply those four to the use that exists and you have AI governance. Apply them to the use described in the policy and you have a document.
Why does the BIO not mention AI?
The Baseline Informatiebeveiliging Overheid is the shared information security framework for Dutch central government, municipalities, provinces and water authorities, built on ISO 27001 and ISO 27002. For municipalities, the VNG and its information security service (IBD) explain and support it. The BIO is written around information, not technology: it asks how government information is protected, whatever system holds it.
A council paper, an objection letter or a benefits file keeps its classification whether it sits in a case system or gets pasted into a chat window. The broader picture for government and healthcare is in BIO and NEN 7510 and AI; this piece is about where everyday use fits in the baseline.
Where does a chatbot land in the classification?
The BIO works with baseline security levels, and the classification of information determines which level applies. In a municipality most of that work is done: social services, youth care, taxation and enforcement handle data classified high, often with a citizen service number in it.
What is usually missing is the translation to AI use. A free chatbot on a personal account is an environment without a contract, an agreement on storage or a data processing agreement. Data from the highest class does not belong there, whatever the tool promises. For an employee who wants a benefits letter rewritten, the question is not whether AI is allowed, but which environment is designated for this class, and what has to come out of the text before it goes there.
Is an AI tool nobody procured a supplier?
Yes. Supplier management in the BIO is about parties that process government information, and that role begins the moment an employee pastes text into a service, not the moment procurement signs a contract.
The difference is what you know about it. For the procured service you know the processing location, the training policy and the incident arrangements. For the found service you usually know none of that, and often not even that it is in use. Supplier management for AI therefore starts with the list of services actually in use, and only then with the assessment. What belongs in the data processing agreement at that assessment does not change because the supplier is an AI tool.
What does awareness mean once the tool is already open?
The BIO asks for awareness and training. The usual answer is an annual session and an e-learning module. The AI use happens weeks later, under time pressure, in a browser tab the session never mentioned.
Awareness that works sits at that moment: someone opens a tool and sees what the municipality thinks of it. Allowed, limited use with a condition, no decision yet, or not allowed with the alternative next to it. That requires a decision per tool first, because a notice without a decision is noise.
Which logging fits here, and which does not?
In the BIO, logging is a control: you must be able to establish afterwards what happened to information and systems. For AI use the temptation is to do that per employee: who opened which tool and what they typed. That is no longer logging, it is monitoring of individuals, with its own legal basis under the GDPR and a role for the works council.
The baseline's question can be answered without that step. Which AI services are in use, how often, what was decided about them, and is the share running through allowed services moving the right way: those are counts per tool, with no name and no content. The difference between the two is set out in AI monitoring versus employee monitoring. For accountability that form is enough, and the figures are more honest, because nobody moves to a private phone to escape a count.
| BIO theme | What it asks | Where everyday AI use touches it | What you record |
|---|---|---|---|
| Classification | Information gets a class that determines where it may be processed | Which class may go into which AI environment, and what comes out before pasting | One rule per class, with the designated environment |
| Supplier management | Parties processing government information have been assessed | Every AI service in use is such a party, contract or not | A register of services in use, with status and assessment |
| Awareness | Staff know the rules and act on them | The decision per tool is visible at the moment someone opens the tool | Which notices are on, per status |
| Logging | What happened can be established afterwards | Counts per tool and per decision, no individuals | Figures per period, with their scope stated |
What does this look like in a municipality?
The municipality's AI register has two rows: Microsoft 365 Copilot, allowed, and a transcription tool for council committees, limited use without personal data of speakers. When the municipality first looks at which AI services are opened from the browser, four more appear: ChatGPT, Perplexity, a translation tool the neighbourhood teams use for letters to residents, and a service that summarises policy memos.
None of the four has been assessed as a supplier, nothing has been decided about any of them, and the translation tool sees letters with names and addresses every week. This is not an incident, and nobody broke a rule, because there was no rule. It shows that the four BIO themes had been applied to two tools while six were in use. The work that follows: four assessments, four decisions, and for the translation tool a designated alternative the neighbourhood teams see as soon as they open the old one.
BeeSensible links a catalogue of 865 AI tools to the use observed in the organisation: only the tool's domain, at most once per day per device, with no user id and no content. An administrator sees in the AI Tools module which tools have no decision yet and records that decision; the decision then appears in the browser for whoever opens the tool, never as a block. This is what that register looks like:
