The compliance of territorial information systems is no longer solely about GDPR. The gradual implementation of the European regulation on artificial intelligence, combined with the tightening of the CNIL’s requirements regarding the right to erasure and the traceability of processing, reshapes the obligations of local authorities deploying e-services, citizen portals, or AI components in their business software.
ISO/IEC 42001 Standard and Territorial AI Governance
The ISO/IEC 42001 standard, published in December 2023, remains underutilized by territorial information system departments (DSI). However, it provides a directly operational management framework for any organization that develops or uses artificial intelligence systems.
Its architecture is based on a logic of continuous improvement: risk and impact analysis, documentation of models, monitoring in production, transparency towards affected individuals, and quality control of training data. For an intercommunal authority that integrates an automatic sorting engine for user requests or a predictive maintenance tool for buildings, this standard structures what often falls under isolated initiatives within business departments.
The CNIL highlights it as a lever for preparing for future harmonized standards of the European regulation on AI. We recommend that local authorities engaged in AI projects map their algorithmic processing now and confront them with the requirements of ISO/IEC 42001, before regulatory pressure turns this good practice into a de facto obligation.
To keep track of these topics over the months, the news from Collectivité Numérique serves as a regular entry point on regulatory and technical developments concerning territories.
Right to Erasure in the Multi-Software Architectures of Local Authorities
The right to erasure is not a theoretical subject for local authorities that interconnect multiple business software. The traceability of personal data across the entire application chain becomes a full-fledged audit criterion.
The CNIL reminded in 2026, in the context of a sanction related to non-compliance with this right, that organizations must be able to effectively process individuals’ requests and ensure traceability. The problem, in a medium-sized local authority, is the dispersion of data between the citizen relationship management (CRM) software, the dematerialization platform for contracts, the geographic information system (GIS), and any AI tools deployed as overlays.
An agent receiving a request for erasure must identify all the concerned systems, verify the legal bases for retention specific to each processing, and then document the execution or the reasoned refusal. Without an up-to-date mapping of data flows and without a formalized procedure, the local authority exposes itself to an increasing risk of sanction.
- Maintain a record of processing that explicitly identifies the interconnections between software and the service providers involved in each flow of personal data.
- Define a processing circuit for exercising rights requests with internal deadlines shorter than the regulatory deadline, to absorb technical complexity without exceeding the legal month.
- Test the erasure procedure at least once a year on a fictitious case, verifying that each application component has indeed deleted or anonymized the concerned data.
Security of E-Services and Citizen Portals: Integrate Protection from the Design Stage
Security by design is no longer a recommendation; it is an operational requirement. Regulatory pressure on data security is intensifying, and local authorities deploying citizen portals or e-services must integrate traceability and protection from the design phase.
In practical terms, this means that the specifications for a family portal or a reporting platform must include requirements for data encryption in transit and at rest, access logging, and isolation of production and testing environments. Too many local authorities discover these constraints after commissioning when the provider has delivered a solution whose architecture makes isolation costly to implement.
Checks to Require When Choosing a Publisher
We observe that local authorities often underestimate the publisher selection phase in favor of price negotiation. The following points deserve particular attention when drafting the specifications:
- The publisher’s ability to provide a documented incident response plan, with notification commitments within timelines compatible with GDPR obligations.
- The existence of independent security audits on the solution, and the possibility for the local authority to mandate its own audit.
- The portability of data in case of a change of provider, including export formats and contractual return timelines.
- The location of data and the applicable legal regime, especially for solutions relying on extra-European cloud infrastructures.
AI Compliance Beyond GDPR: Documentation and Transparency
The CNIL now recommends documenting the impacts and risks of AI systems, informing affected individuals, and providing appropriate modalities for exercising their rights. The compliance of a territorial AI project hinges on three simultaneous registers: GDPR for personal data, the European regulation on AI for risk classification and transparency obligations, and administrative law for the justification of individual decisions.
For a local authority using a decision support algorithm (allocation of daycare spots, prioritization of social housing requests), the documentation of the model and its potential biases must be accessible not only to agents but also to residents. The absence of this documentation legally weakens any contested decision.
The normative framework is evolving rapidly. Local authorities waiting for the publication of definitive texts to act are accumulating a compliance debt that will be more costly to resolve than to prevent. Anticipating compliance reduces the overall cost of the AI project and secures already deployed uses.
