A Dutch municipality is renewing its contract for a case management system. The tender now refers to BIO2, and the supplier's account manager forwards one question to the security team: "List the subcontractors in your service chain and their risks." The product uses a large language model to summarise case notes. Nobody had thought of the model provider as a subcontractor until that line arrived.
BIO2, the information security baseline for Dutch government, has no chapter on AI. The word does not appear in it. Eight of its government controls still decide how an AI service should be handled, whether you work inside a Dutch public body or sell to one, and knowing them by number tells you which piece of evidence is missing.
#What is BIO2, and why does it not mention AI?
The Baseline Informatiebeveiliging Overheid 2 is the common information security baseline for Dutch central government, municipalities, provinces and water authorities. Version 1.3 is dated 9 January 2026 and was published in the Staatscourant on 5 March 2026 (Checked 3 November 2026). According to the CIP, the centre that maintains the baseline, it replaced BIO 1.04 for digital exchanges with central government, as well as version 1.2, which the cross-government digital policy council adopted on 23 September 2025.
The text of BIO2 (Dutch, checked 3 November 2026) has two mandatory parts. Part 1, the framework, follows ISO 27001:2023 and covers the management system, risk management and governance. Part 2 holds the government controls, each tied to a control in ISO 27002:2022. The leading digits give the link: 5.23.01 belongs to 5.23, information security for the use of cloud services.
AI, artificial intelligence and algorithm do not appear. That is by design: the baseline describes how to protect information, not which system holds it. One change from the previous version matters here. The baseline security levels (basisbeveiligingsniveaus) no longer appear in the text, and classification now happens through an explicit risk assessment using an agreed method. For a chatbot there is no level to point to, only a decision per type of information that you record.
Eight government controls bear directly on AI use. The table gives each one by number, what it requires, and the question it raises.
For some ISO controls, part 2 says "no government control". That applies to 8.12, data leakage prevention, and to 5.34, privacy and protection of personal data. According to the introduction to part 2, you then follow the ISO 27002 guidance itself, and justify with a risk analysis if you do not apply it.
#Where does a free ChatGPT account fall through?
The supplier controls follow a fixed order. A tender with requirements (5.19.01), a contract containing them (5.20.01), a yearly assessment by the process owner (5.22.01) and a register of suppliers and contracts (5.22.02). An employee who rewrites a press release in a personal ChatGPT account skips all of it. There is no tender, no contract and no assessment, yet the service handles government information.
Procurement cannot fix this, because there is nothing to buy. Two routes do work. The organisation decides the tool is not allowed and names an alternative that has been through procurement. Or it buys a business version and takes it through 5.19 to 5.23 like any other supplier. What actually changes for your data between a free and a business account is covered in ChatGPT Business vs free and personal AI accounts.
Either way, you first need to know the tool is in use, which is why it starts with 5.09.01. BIO2 explicitly puts remote assets and cloud environments in the inventory, and requires its completeness to be checked periodically. An AI service staff use only in the browser is a cloud environment too, and government information ends up in it.
#What does BIO2 ask when Copilot arrives in Microsoft 365?
With Copilot the position is reversed. An organisation on Microsoft 365 already has the contract, so Microsoft should already be in the register under 5.22.02 and in the cloud policy under 5.23.01. The relevant line is also in 5.23.01: when significant changes occur at the supplier, assess the risks and take suitable measures. An AI assistant appearing in existing apps and working with documents and mail is such a change, even without a new contract.
It is also the moment for 5.12.01. Microsoft states (Checked 3 November 2026) that Copilot only surfaces organisational data the user has at least view permission for. A SharePoint folder shared too widely becomes a folder an assistant can summarise. Classification and access rights decide what Copilot can draw on. Which Copilot features staff already have without a separate licence is covered in Copilot Chat without a licence.
#What changes if you supply software to Dutch government?
For a supplier, BIO2 arrives through the contract. Control 5.21.02 asks you, before signing, to give insight into your chain of subcontractors and the risks in it, and the government body assesses whether those risks are acceptable. Under 5.21.03 it makes sure the security requirements apply to that chain unless they are irrelevant to what a subcontractor does. During the contract, 5.21.04 asks you to report changes in the chain, including at least vulnerabilities and security incidents that could affect the service.
A model provider that processes case notes on your behalf is part of that chain. So is a new AI feature built on a provider you did not use when you signed. Adding one is a change you report, not a product update you announce. Control 5.20.03 adds that the contract states you show each year, on the basis of assessments by independent third parties, that you meet the requirements, with explicit attention to how you manage your own suppliers.
#How do awareness and logging work without monitoring people?
BIO2 asks for two things to be demonstrable: staff have been pointed to the rules of conduct (5.10.03), and they complete awareness training within three months of starting (6.03.02). Rules for AI tools fit in both. A training that shows which tools are allowed and which information stays out of them covers both controls with one set of material.
The training happens in someone's first weeks; the AI use comes later, under deadline. What helps then is seeing the organisation's decision about a tool when the tool opens, which needs a decision per tool first.
Logging is control 8.15, and it covers the log files of your own systems: what a log line contains at minimum, how long it is kept, and how tampering is detected. For which external AI services are in use, the inventory and the supplier register are the anchor, and counts per tool answer the question. Recording AI use per person is employee monitoring, which needs its own legal basis under the GDPR. The difference is set out in AI monitoring vs employee monitoring.
#What goes into the Statement of Applicability?
Under part 1 of BIO2, the Statement of Applicability records which controls were selected and implemented. Deviations and controls that do not apply go into the annex "Exceptions to the Statement of Applicability", with a reference to the risk analysis. Government bodies also use the statement to show each other which measures they have in place.
For AI use, the evidence per control can be made concrete:
- 5.09.01: a list of AI services in use, fed by what is actually opened, not only by what procurement knows about.
- 5.12.01 and 5.10.03: for each kind of information, the AI service it may go into, written into the rules of conduct.
- 5.19.01 to 5.22.02: for every AI service you buy, the requirements, the contract and the yearly assessment; for every service without a contract, a decision.
- 5.23.01: a cloud policy that names AI services, with an assessment when an existing service adds AI features.
- 6.03.02: training that includes the decisions about AI tools.
The list for 5.09.01 is the hardest part, because a service nobody bought appears nowhere. BeeSensible matches a catalogue of more than 1,000 AI tools against the use it observes in the organisation: only the tool's domain, at most once a day per device, with no user id and no content. The Inbox shows every tool used in the last 30 days that has no decision yet. An admin records the decision, allowed tools go into the AI register, and anyone who opens the tool afterwards sees that decision in the browser, with the chosen alternative for a tool that is not allowed. BeeSensible does not block on its own; whether someone can continue to a tool that is not allowed after the notice is a setting the organisation chooses. How the broader BIO themes fit together is covered in AI governance and the BIO baseline, and what belongs in a register in An AI register: what it is and what you record in it.
Start with the question the account manager forwarded, turned inwards: is every AI service you use or deliver on the list? If one is missing, you know which of the eight controls lacks its first piece of evidence.
