It’s half past one on a Thursday. On the desk of an urban planning or procurement officer, thirty pending files are piling up, along with a request for an urgent report from the mayor and a one-hundred-and-twenty-page set of conditions that was supposed to have been reviewed yesterday. In this scenario of chronic overload, the temptation is immediate and understandable: to open a tab in a private browser, access a commercial artificial intelligence model and paste the text to have it summarise or draft a proposal in thirty seconds.
This is already happening in many councils. Not out of malice, but out of sheer operational desperation. It’s what in information security is known as Shadow IT: the informal use of external tools without institutional oversight.
But what happens when that text sent to the cloud contains neighbours’ first names and surnames, current account numbers, data from social services reports or professional-solicitor valuations? The answer sends shivers down the spine of any secretary, accountant or data protection officer: the local authority is suddenly exposed to a flagrant breach of the GDPR, a security failure under the National Security Scheme (ENS) and possible civil and disciplinary liability.
In the face of this reality, banning technology by decree is a delusion that only encourages its clandestine use. The real task of public leadership and legal teams is not to halt modernisation, but to impose clear, non-negotiable rules: technological sovereignty and mandatory human oversight.
The duty of confidentiality does not end when the browser is opened.
The secretary and municipal technicians are legally mandated to safeguard the confidentiality of public and citizen information. When a public official uploads a file to open and free artificial intelligence servers, that data travels outside the European legal space and, in most cases, becomes part of the future training bank for those technology companies.
We are not talking about a theoretical or minor doubt; we are talking about:
- Unlawful disclosure of personal data (PII): Records containing special category data under Article 9 of the GDPR (health, minors, economic vulnerability) are hosted on third-party servers without a data processing agreement or anonymisation guarantees.
- Loss of traceability: The council cannot audit who has accessed the document, where it has been saved, or whether it has actually been deleted.
- Non-compliance with the ENS: Public administrations are obliged to guarantee the continuity, confidentiality and integrity of their digital services, a framework that no free tool for domestic use complies with.
If a council wants its teams to leverage the analytical capabilities of AI to streamline bureaucracy, the only legally admissible route is the so-called Sovereign AI: processing models that run on proprietary, closed infrastructure within the European Union, with no connection to providers that reuse the data, and with pre-existing mechanisms that remove metadata and personal data before any operation.
The machine suggests, the public authority decides: the Human-in-the-Loop principle
There is a boundary that no algorithm can ever cross in administrative law: public authority is non-delegable. A language model cannot sign a mayoral decree, resolve a tax appeal, or rule on a building permit.
The legal responsibility for each administrative act rests exclusively with the person who holds the delegated signature or the status of public official. Therefore, the design of technology in service of local government must be structured around the Human-in-the-Loop principle (necessary human oversight in the decision-making cycle):
- AI as a preliminary analyst: The model can compare clauses in a tender document, locate previous decrees on the same matter, or summarise a cumbersome file to facilitate quick reading.
- Public staff as filter and authority: The machine’s proposal is only a working draft. It is the technician or the secretary who validates the content, corrects the legal criteria, applies technical discretion and, finally, validates and signs the document.
Without this dual-key guarantee, artificial intelligence is not an advance: it is a threat to the legal certainty of the local authority and an open door to the outright nullity of administrative acts for lack of reasons or improper delegation.
ONode’s answer: Security for the manager, agility for the team
At ONode, we work shoulder to shoulder with municipal technical and legal teams. We fully understand the pressure of deadlines and, at the same time, the legitimate fear of committing a documentary or procedural irregularity.
For this reason, our tools are not adaptations of generic office software, but an environment conceived from public law:
- Sovereign and isolated architecture: All servers are located in the European Union, with separate, isolated environments for each council (separate multi-tenancy) and aligned with the security requirements of the ENS and the new European AI Regulation. Your municipality’s data is never used to train external networks.
- Prior intelligent anonymisation: systems that automatically identify and redact national identity cards, bank details, private addresses or signatures before any record can be processed or published, also distinguishing between public officials and ordinary citizens.
- Natively integrated human control: Every generated summary, classification or draft requires a conscious validation action by the handler. Nothing is published or incorporated into a file without a public servant having reviewed and approved it.
The modernisation of local government is not about putting new screens on old problems, nor about letting staff use clandestine tools out of sheer time pressure. It is about providing public sector teams with advanced technology that handles the mechanical workload, while safeguarding confidentiality, the peace of mind of civil servants and the legitimacy of every administrative act.
