Practical guide: deploying AI in your local government

1. The legal framework: what applies

Three texts structure an AI deployment in a French local government:

• GDPR and the French Data Protection Act: any assistant that processes personal data requires a DPIA (Data Protection Impact Assessment) when risks are high.
• RGS (General Security Framework): hosting must comply, especially if you process sensitive data.
• European AI Act (gradually in force since 2025): AI systems in public services may be classified as “high-risk” depending on usage — routing to a human agent must almost always remain possible.

For internal use cases (HR, urban planning, procurement), requirements are lighter. For citizen-facing use cases, the full chain must be documented — see also GDPR and AI assistants: the keys to compliance.

2. Choosing the right pilot scope

Three criteria for the ideal pilot:

1. Useful to internal staff (not the general public).
2. Manageable volume: 500 to 3,000 documents.
3. No individual personal data at launch (statutes, procedures, doctrine — yes; named records — later).

The three pilots that nearly always work:

• HR (procedures, statutes, agreements) — see field report.
• Internal urban planning (zoning plan, regulations, local case law).
• Public procurement (CCTP/CCAP tender specs, case law, templates).

3. The team to mobilize: three roles, not ten

• A political sponsor or city manager who unblocks arbitrations and sources.
• A business owner from the pilot department, who validates answers.
• An IT/DPO lead who handles access, ACLs, and compliance.

Include the DPO in a consulting role (not as a validator at every step, or the project never ships).

4. Sovereignty and hosting: non-negotiable in 2026

For a French local government, three minimum requirements:

1. Hosting in France, under French jurisdiction only.
2. No training of models on your data — contractual commitment.
3. Reversibility contractually guaranteed: data export and deletion on request, within 30 days.

See also Why choose sovereign AI and our security & GDPR page.

5. Typical local government deployment timeline

Three months between decision and a production assistant. Faster than that, you skipped the legal framing. Slower, it’s likely a sign of overly heavy governance.

6. Five pitfalls to avoid

1. Loading all documentation at once. You mix active sources with archives, and the assistant returns outdated information.
2. Skipping the DPIA to move faster. If audited, you’re exposed. A basic DPIA takes two weeks with a DPO; without one, the project is fragile.
3. Promising residents a full service from day one. Start internal. External-facing comes in a second wave, calibrated by data from the pilot.
4. Underestimating staff training. Without onboarding, users fall back on old habits (intranet, sticky notes, asking a colleague). Plan two one-hour sessions per user.
5. Not measuring. Without KPIs from the start, you won’t know if the project is profitable. See Measuring AI assistant performance.

See also Five use cases in public services and our local government page.