A policy adviser has to write a memo for the executive board on a new subsidy scheme and wants to know how five other municipalities handled it. Copilot gives a tidy answer with no sources. In a second tab she opens Perplexity, gets five links, and carries on from there. On the IT side, Copilot is on record as "the municipality's AI tool".
That is how it goes in almost every municipality that has rolled out Copilot. The rollout settled one tool. The other tools did not go away; they run next to it, mostly on free accounts, and nothing has been decided about any of them. That is shadow AI, and it is not a list of violations. It is a list of decisions still to be made.
What runs next to Copilot?
The list differs per municipality, but a handful of tools turn up nearly everywhere. They are there for a reason: at that moment Copilot is not the obvious route for the job. Why that happens is covered in we have Copilot, so why do employees use other AI tools.
| What gets opened | Why people choose it | What the municipality needs to know |
|---|---|---|
| Perplexity or another AI search engine | Research with sources, for a council question or a policy memo | Free or business account, and what was in the query |
| ChatGPT on a free account | Rewriting in plain language, summarising, an email | Whether input is used for training, and whether a citizen service number was in the text |
| Meeting transcription | Minutes of a team meeting or a council committee without typing | Where the recording is processed, and who was named in the conversation |
| Translation services | Front desk and neighbourhood teams, a letter in Arabic or Polish | Whether the letter contained personal data |
| AI features in existing software | The word processor or the case system gained an assistant in an update | No new domain, no new purchasing decision, but a new processing operation |
The last row is the awkward one. Nothing new was installed, so nobody requested anything, and yet text is now sent to a model that it did not go to last year.
Why does this weigh more heavily in a municipality?
Because the text being pasted is rarely neutral. A letter about a benefit contains a citizen service number (BSN). A neighbourhood team's meeting note contains a family situation. An objection letter contains a name, an address and the story behind it. In a municipality, the default content of a working day is personal data, and part of it is special-category or highly sensitive.
Putting that data into a free account is different from putting it into an environment the municipality set up. With a personal account, input can be used to improve the model unless the user switches that off, and there is no data processing agreement. The difference per account type is in free versus business AI accounts. The Dutch Data Protection Authority reported several breach notifications in which employees had put personal data into an AI chatbot, and advises organisations to agree on whether it is allowed and with which data.
The BIO, the information security baseline for Dutch government, asks a municipality for data classification, vendor management and staff awareness. An AI service nobody has decided on sits outside all three. How the BIO relates to AI use is in BIO and NEN 7510: AI and privacy in government and healthcare.
Why does a quarterly inventory fall behind?
A municipality has allowed Copilot. In March the CISO runs a survey across all departments. Next to Copilot, Perplexity, ChatGPT and three specialised tools turn out to be in use: a translation service at the front desk, a transcription tool in the social services domain, and an AI feature in the word processor. Two of them are not in the register anywhere. That is not an incident. It shows that the register is not keeping up with the working day.
By June, the March list is already out of date. The case system gained a summarising feature in an update. One team switched from one transcription tool to another because it integrated better with Teams. And a communications officer started using an image generator for the newsletter that did not exist in March. Nobody did anything wrong. The survey described March.
This is not a matter of surveying more often. Every survey is a snapshot, and why AI tool catalogs age describes the mechanisms behind it: tools appear daily, AI shows up in software you already have, and tools change owners. Which methods exist for finding use, and what each one misses, is in how do you find out which AI tools employees actually use. A municipality has one more thing to contend with: the proxy logs see the town hall, not the laptop of the neighbourhood team member working from home.
How do you keep track without following employees?
By recording only what the decision needs. The question is: which AI services are opened in our municipality, how often, and is there a decision about them. For that answer the service's domain is enough. Who opened it, which page and what was on it do not change the decision, and they do change the measurement: from a count of services into a record of people. That distinction, and what it means for the GDPR and the works council, is in AI monitoring versus employee monitoring.
That is why the BeeSensible extension records only the registrable domain, at most once per day per device, with no user id, no path and no page content. The observed domains are matched to a catalog of 865 AI tools, each with its vendor, country, training policy and a risk score. An admin sees which tools still have no decision and records that decision; BeeSensible never chooses on its own.
