A policy adviser has to write a memo for the municipal executive on a new subsidy scheme and wants to know how five other municipalities handled it. Copilot gives a tidy answer with no sources. In a second tab she opens Perplexity, gets five links and carries on from there. Meanwhile IT has Copilot down as "the municipality's AI tool".
That is how it goes in almost every municipality that has rolled out Copilot. The rollout settled the question for one tool. The others did not go away; they run alongside it, mostly on free accounts, and nobody has decided anything about any of them. That is shadow AI, and it is not a list of violations. It is a list of decisions still to be made.
What runs alongside Copilot?
The list varies from one municipality to the next, but a handful of tools turn up nearly everywhere. They are there for a reason: for that particular job, Copilot is not the obvious choice. Why that happens is covered in our article on why employees turn to other AI tools despite Copilot.
| What gets opened | Why people choose it | What the municipality needs to know |
|---|---|---|
| Perplexity or another AI search engine | Research with sources, for a council question or a policy memo | Free or business account, and what was in the query |
| ChatGPT on a free account | Rewriting in plain language, summarising, an email | Whether input is used for training, and whether a citizen service number was in the text |
| Meeting transcription | Minutes of a team meeting or a council committee without typing | Where the recording is processed, and who was named in the conversation |
| Translation services | Front desk and neighbourhood teams, a letter in Arabic or Polish | Whether the letter contained personal data |
| AI features in existing software | The word processor or the case system gained an assistant in an update | No new domain, no new purchasing decision, but a new processing operation |
The last row is the awkward one. Nothing new was installed, so nobody requested anything, and yet text now goes to a model it did not go to last year.
Why does this matter more in a municipality?
Because the text being pasted is rarely neutral. A letter about a benefit contains a citizen service number (BSN). A note from a neighbourhood team meeting describes a family's circumstances. An objection letter contains a name, an address and the story behind it. In a municipality, an ordinary working day is full of personal data, and some of it falls into the special categories or is highly sensitive.
Putting that data into a free account is not the same as putting it into an environment the municipality has set up. With a personal account, input may be used to improve the model unless the user turns that off, and there is no data processing agreement. How the account types differ is explained in free versus business AI accounts. The Dutch Data Protection Authority reported several breach notifications in which employees had put personal data into an AI chatbot, and advises organisations to set clear rules on whether this is allowed and, if so, with which data.
The BIO, the baseline information security standard for Dutch government, expects a municipality to have data classification, vendor management and staff awareness in place. An AI service nobody has decided on falls outside all three. How the BIO relates to AI use is covered in our piece on AI under the BIO and NEN 7510.
Why does a quarterly inventory fall behind?
Take a municipality that has allowed Copilot. In March the CISO runs a survey across all departments. Besides Copilot, it turns out that Perplexity, ChatGPT and three specialised tools are in use: a translation service at the front desk, a transcription tool in social services and an AI feature in the word processor. Two of them appear nowhere in the register. That is not an incident. It shows that the register is not keeping pace with the working day.
By June, the March list is already out of date. The case system gained a summarising feature in an update. One team swapped its transcription tool for another that works better with Teams. And a communications officer has started making images for the newsletter with a generator that did not exist in March. Nobody did anything wrong. The survey described March.
Surveying more often does not solve this. Every survey is a snapshot, and our article on why AI tool catalogues age describes the mechanisms behind it: tools appear daily, AI turns up in software you already have and tools change owners. The methods for finding out what is in use, and what each one misses, are set out in our article on finding out which AI tools employees actually use. A municipality has one more thing to contend with: proxy logs see the town hall, not the laptop of a neighbourhood team member working from home.
How do you keep track without monitoring employees?
By recording only what the decision needs. The question is which AI services are opened in the municipality, how often and whether there is a decision on them. To answer it, the domain of the service is enough. Who opened it, which page and what was on it do not change the decision, but they do change the measurement: it stops being a count of services and becomes a record of people. That distinction, and what it means under the GDPR and for the works council, is explained in AI monitoring versus employee monitoring.
So the BeeSensible extension records only the registrable domain, at most once a day per device, with no user ID, no path and no page content. The domains it sees are matched against a catalogue of over 1,000 AI tools, each with its vendor, country, training policy and a risk score. An admin sees which tools have no decision yet and records one; BeeSensible never decides on its own.
