AI and local authorities: where to begin?

AI in local authorities: where do things stand?

According to the Observatoire Data Publica Barometer (November 2024, reported by La Banque Postale), around 36% of local authorities have already implemented or trialled an artificial intelligence system, and ~15% are considering taking the step within the next 12 months. The movement is real, but uneven: between a front-desk chatbot rolled out in a few weeks and a project to transform an entire business process, the realities are very different.

What is often missing is not the will, but a clear reference point: where do you begin in practical terms, without over-promising, without compromising compliance, and without creating dependence on a tool the authority does not control?

Concrete AI use cases for a local authority

Artificial intelligence in the public sector covers a broad spectrum: automating responses to residents, analysing public procurement documents, assisting in drafting council resolutions, predictive road maintenance, transcribing meetings, and detecting anomalies on networks or equipment.

Local authorities such as Issy-les-Moulineaux, Suresnes and Cannes have documented their experiments and drawn measurable results from them in terms of reduced processing times, quality of service to residents, and the administrative workload of staff.

These accounts share a common lesson: the use cases that last over time are those built on a tool designed for the authority's exact business process, not on a generic assistant bolted on top of a heterogeneous existing set-up.

For a detailed overview by function, see our article AI use cases in local authorities.

Start from the business process, not from a generic tool

The most common promise on the market is that of the "turnkey" AI assistant: a sovereign server, a chat interface, and staff can use it tomorrow. This model can have its place — but it does not transform processes.

Real transformation begins with a different question: which process costs us the most time, generates the most errors, or does the most harm to the quality of the service we provide? What tool exists today — often a spreadsheet, a paper form, a generic off-the-shelf package — and why does it not meet the need exactly?

It is from this mapping that Groupe Milestone works. We do not start from a technology; we start from the real business need, we model it, and we design the bespoke tool that answers it — then we augment it with AI wherever that produces measurable value.

To understand what a business application is: What is a business application?

How AI augments your business tools

AI is not an end in itself in a public-sector project. It is an augmentation layer: it makes an existing or newly designed tool faster, more accurate or more useful, without replacing human judgement on the decisions that commit the authority.

In practice, this can take several forms within a bespoke tool:

• Automatic document processing: analysing and extracting information from application files, tender bids and inspection reports.
• Drafting assistance: suggested wording based on templates approved by the authority, saving time on routine documents.
• Alerts and anomaly detection: automatically identifying discrepancies in data flows (financial, technical, environmental).
• Decision support: aggregating data from several sources to present a summary to the officer or elected representative, without replacing their judgement.
• Conversational interface: automated answers to residents' frequently asked questions, with escalation to a human officer for complex cases.

Data sovereignty and hosting

The question of digital sovereignty is particularly sensitive for local authorities, which handle citizens' personal data and sensitive data linked to the running of public services.

Several issues overlap here, and it is useful to distinguish between them:

• Physical hosting of the data: hosting in France or the European Union reduces exposure to extraterritorial regulations (in particular the US Cloud Act).
• SecNumCloud qualification (ANSSI): the only marker recognised by the CNIL to demonstrate sovereign cloud hosting. Few providers are qualified at this level.
• Independence from the hyperscalers: some solutions presented as "sovereign" in fact rely on the infrastructure of large US players.
• Legislative change: the SREN law requires central government cloud projects to use services immune to extraterritorial laws; an amendment proposes extending this obligation to authorities of more than 30,000 inhabitants for sensitive data.

What we can state with confidence: we build these issues in from the scoping phase, we document them within the project, and we steer the architecture choices according to the authority's real constraints — rather than offering a standard solution relabelled as "sovereign".

GDPR and the AI Act

Deploying AI in a local authority involves two regulatory frameworks that complement each other.

GDPR applies in full as soon as the tool processes personal data. In 2025 the CNIL published its recommendations for applying GDPR to AI systems: legal basis, data minimisation, informing individuals, and data protection impact assessments (DPIA) where required. These obligations must be built into the design of the tool, not added afterwards.

The AI Act (the European regulation on artificial intelligence, which entered into force in August 2024) introduces a classification of AI systems by level of risk and specific obligations for deployers — the category most local authorities fall into. The first obligations (bans on unacceptable-risk practices and the AI literacy obligation) came into application in February 2025. The obligations for high-risk systems will apply from August 2026.

For a detailed reading of the obligations, the timeline and the deployer role, see our dedicated article: The AI Act: what local authorities need to know.

Funding and contracting: public procurement and long-term support

Having a bespoke tool developed through public procurement means mastering a few essential levers: scoping the functional need before the invitation to tender, choosing the type of contract suited to iterative development, and ensuring that the contract protects the authority on the ownership of code and data as well as on reversibility.

For the detail of this approach: Having a bespoke AI business application developed for your authority: public procurement and support.

Local authorities in the Basque Country and the Pyrénées-Atlantiques can meet us directly: Groupe Milestone, a digitalisation agency in the Basque Country.

Our support method, from audit to follow-up

Discover our services: Business applications · Automation & AI · Bespoke software · Consulting & audit · Support / maintenance.