During a committee meeting, a councillor asks the portfolio holder: is all of our AI in the Algorithm Register? The privacy officer looks it up the next morning. Two entries, both models used in social services. That same morning she passes a colleague from communications rewriting a press release in ChatGPT, and she knows the youth team uses a transcription tool nobody has ever asked her about.
So the answer to the councillor is: yes for the algorithms that affect residents, and no for the AI that staff use every day, because that does not belong there. There is a second register for that, and it is the one most municipalities do not have yet.
What does the Algorithm Register describe?
The Algorithm Register at algoritmes.overheid.nl is public. The Dutch national government asks public bodies to describe impactful algorithms there: models and AI that play a part in decisions about residents, or that noticeably affect how government deals with them. The purpose is that residents, councillors, regulators and journalists can see which algorithms government uses and which safeguards go with them.
Whether publication becomes a statutory duty, and for exactly which algorithms, is an open question; the site itself is the source for that. What is settled is the nature of the register: it covers applications with consequences for residents, and it faces outward. A chatbot an adviser uses to rewrite a memo falls outside it. Not because that chatbot is unimportant, but because it decides nothing.
What belongs in the internal AI register?
Everything the municipality uses AI for to get work done, including what decides nothing: Microsoft 365 Copilot, ChatGPT, Perplexity, the youth team's transcription tool, the translation tool at the front desk, the service that rewrites council papers into plain language. Per row: who the vendor is, what it is used for, who owns it in the line organisation, which data may go in and which may not, what the municipality has decided and when that decision is reviewed.
The fields are the same as for any organisation, and they are set out in AI register: what it is and what to record, with a completed example. For a municipality two of them weigh more. The field listing data that may not go in is long and concrete: BSN, benefits data, everything from youth care, confidential annexes. And the cross-reference field: to the GDPR record of processing where personal data is involved, and to the Algorithm Register where the same application also appears there.
That the AI Act does not prescribe one universal AI register for every organisation, and what does apply to public authorities that deploy high-risk systems, is in is an AI register mandatory.
What belongs in which register?
| Algorithm Register | Internal AI register | |
|---|---|---|
| For whom | Residents, council, regulators, journalists | The municipality itself: DPO, CISO, IT, team leads |
| What is in it | Impactful algorithms and high-risk AI that affect decisions about residents | All AI services staff use, including those with no decision role |
| Unit | An application within a work process | An application of a tool, with the tool as a property |
| What it answers | Which algorithms does government deploy, with which safeguards | What do we use, what may go in, what have we decided |
| How it is filled | Per project, when a process is set up or changed | By self-reporting, and by looking at what is actually opened |
| When it moves | When an algorithm is new or changed | Every week, because tools arrive without anyone reporting them |
A few examples make the split concrete. A model that determines which applications for a service get extra checks: Algorithm Register, plus a row in the internal register with vendor and owner, plus the record of processing. ChatGPT in the communications team: the internal register only. The chatbot on the website that points residents in the right direction: the internal register in any case, with the AI Act's transparency duty attached, and the Algorithm Register if the municipality judges that it noticeably affects residents. The youth team's transcription tool: the internal register, with a reference to the DPIA and the record of processing, because special categories of data go into it.
Why does the internal register fall behind?
Because it is filled by people who know about a tool. Someone who does not realise their summariser is AI does not report it. Someone paying for it privately does not report it. Someone who started using it last week was not there for the survey.
A municipality has allowed Copilot, with a restriction on documents from social services, and the internal register has six rows. At a first look at which AI services are opened from the browser, Perplexity and ChatGPT turn out to be in use next to Copilot, plus three specialised tools: a transcription tool for meetings, a plain-language rewriter and an image generator for communications. Two of them are nowhere. That is not an incident, because nothing had been decided about those two. It shows that a survey is a photo of one moment. Why surveying more often does not fix that is in why an AI tool catalog ages the moment you print it.
How does observed use feed the register?
By placing a second source next to the register: which AI tools are actually opened in the organisation. Not who, not what is typed, only which tool and how often, at organisation level. The difference between that list and the register is the backlog, and every tool in it enters the register on the most honest status there is: no decision yet.
From that moment the register has a rhythm. A new tool is noticed and gets a row with a date. The owner in the line organisation answers the questions and the municipality takes a decision. At review, the same owner checks whether the vendor's terms and the data use still hold. What those steps look like in practice is in from shadow AI to a current AI register.
BeeSensible supplies that second source: the extension reports only the domain of an opened AI tool, at most once per day per device, with no user id and no page content, and sets it against a catalog of 865 assessed tools. An administrator sees in the inbox which tools were newly noticed and still need a decision, and records it; every tool starts on "no decision yet". More on how that works is on the AI tools page.
