A CISO at a mid-sized Dutch municipality is preparing the annual information security accountability report. The evidence folder holds last year's AI policy, a data processing agreement (DPA) for Microsoft 365 and the attendance list from an awareness session. For the question of which AI services were actually used this year, she has nothing on file.
That is the question the BIO, the baseline information security standard for Dutch government, asks without ever using the word AI. Everyday AI use falls under four themes that have been in the baseline for years: classification, supplier management, awareness and logging. Apply those four to the use that actually exists and you have AI governance. Apply them to the use described in the policy and you have a document.
Why doesn't the BIO mention AI?
The Baseline Informatiebeveiliging Overheid is the shared information security framework for Dutch central government, municipalities, provinces and water authorities, built on ISO 27001 and ISO 27002. For municipalities, the VNG (the Association of Netherlands Municipalities) and its information security service (IBD) provide guidance and support. The BIO is written around information, not technology: it asks how government information is protected, whatever system holds it.
A council paper, an objection letter or a benefits file keeps its classification whether it sits in a case system or gets pasted into a chat window. The wider picture for government and healthcare is covered in the BIO, NEN 7510 and AI; this piece looks at where everyday use fits in the baseline.
Where does a chatbot fit in the classification?
The BIO works with baseline security levels, and the classification of information determines which level applies. In a municipality most of that work has been done: social services, youth care, taxation and enforcement handle data classified as high, often including citizen service numbers.
What is usually missing is the link to AI use. A free chatbot on a personal account is an environment with no contract, no agreement on storage and no DPA. Data from the highest class does not belong there, whatever the tool promises. For an employee who wants to rewrite a benefits letter, the question is not whether AI is allowed but which environment is designated for this class, and what has to come out of the text before it goes there.
Is an AI tool nobody procured a supplier?
Yes. Supplier management in the BIO is about parties that process government information, and that role begins the moment an employee pastes text into a service, not the moment procurement signs a contract.
The difference lies in what you know. For a procured service you know where the data is processed, the training policy and the incident procedures. For a service someone found on their own you usually know none of that, often not even that it is in use. Supplier management for AI therefore starts with the list of services actually in use, and only then moves on to assessment. What belongs in the DPA at that stage does not change because the supplier happens to be an AI tool.
What does awareness mean once the tool is already open?
The BIO asks for awareness and training. The usual answer is an annual session and an e-learning module. The AI use happens weeks later, under time pressure, in a browser tab the session never mentioned.
Awareness that works happens at that moment: someone opens a tool and sees where the municipality stands on it. Allowed, limited use with a condition, no decision yet or not allowed with the alternative alongside. That requires a decision on each tool first, because a notice without a decision is just noise.
Which logging fits here, and which does not?
In the BIO, logging is a control: you must be able to establish afterwards what happened to information and systems. For AI use the temptation is to do that per employee: who opened which tool and what they typed. That is no longer logging but monitoring of individuals, which needs its own legal basis under the GDPR and involves the works council.
You can answer the baseline's question without taking that step. Which AI services are in use, how often, what was decided about them and whether the share going through allowed services is moving in the right direction: those are counts per tool, with no names and no content. The difference between the two is set out in AI monitoring versus employee monitoring. For accountability that form is enough, and the figures are more honest, because nobody moves to a private phone to escape a count.
| BIO theme | What it asks | Where everyday AI use touches it | What you record |
|---|---|---|---|
| Classification | Information gets a class that determines where it may be processed | Which class may go into which AI environment, and what comes out before pasting | One rule per class, with the designated environment |
| Supplier management | Parties processing government information have been assessed | Every AI service in use is such a party, contract or not | A register of services in use, with status and assessment |
| Awareness | Staff know the rules and act on them | The decision on each tool is visible when someone opens it | Which notices are on, per status |
| Logging | What happened can be established afterwards | Counts per tool and per decision, no individuals | Figures per period, with their scope stated |
What does this look like in a municipality?
The municipality's AI register has two rows: Microsoft 365 Copilot, allowed, and a transcription tool for council committees, limited use, with no personal data about speakers. When the municipality first looks at which AI services are opened from the browser, four more turn up: ChatGPT, Perplexity, a translation tool the neighbourhood teams use for letters to residents and a service that summarises policy memos.
None of the four has been assessed as a supplier, no decision has been taken on any of them and the translation tool handles letters with names and addresses every week. This is not an incident. Nobody broke a rule, because there was no rule. What it shows is that the four BIO themes had been applied to two tools while six were in use. The work that follows: four assessments, four decisions and, for the translation tool, a designated alternative that the neighbourhood teams see as soon as they open the old one.
BeeSensible links a catalogue of over 1,000 AI tools to the use observed in the organisation: only the tool's domain, at most once per day per device, with no user ID and no content. An administrator sees in the Inbox which tools have no decision yet and records one; that decision then appears in the browser for anyone who opens the tool. BeeSensible does not block anything of its own accord; whether staff can carry on to a not-allowed tool after the notice is a setting the municipality chooses. This is what the register looks like:
