Section 25-1 of the Local Government Act – Internal Control

Section 25-1 of the Local Government Act requires municipalities and county municipalities to have internal control over the administration's activities to ensure that laws and regulations are followed. The municipal director is responsible for the internal control.

The internal control shall be systematic and adapted to the company's size, nature, activities, and risk profile. Among other things, it shall include a description of the company's organization and tasks, necessary routines and procedures, follow-up of non-conformities and risks, necessary documentation, and ongoing evaluation and improvement.

The provision is technology-neutral. It does not mention artificial intelligence specifically, but provides a central governance framework when municipalities use AI, machine translation, speech recognition, text tools, chatbots, or automated solutions in their administration.

As part of its internal control, the municipality should have an overview of where such tools are used, what information is processed, which rules apply, who is responsible, and how results are verified before they affect residents, employees, or case processing.

Section 25-1 of the Local Government Act is not in itself a legal basis for processing personal data, an authorization to use AI, or a classification of an AI system's risk. The specific use must be assessed against, among other things, the privacy regulations, the Public Administration Act, the archiving regulations, the Language Act, the Interpretation Act, the procurement regulations, and relevant sector-specific rules.

According to section 25-2 of the Local Government Act, the municipal director shall report to the municipal council or county council at least once a year on internal control and the results from state supervision.

The ministry's guidance specifies that the internal control rules of the Local Government Act apply to municipal duties in most sectors, but do not generally replace the specific internal control rules in the health sector.

When tasks are performed through host municipality cooperation or other forms of cooperation, responsibilities, reporting, and access to control information must be clarified. The follow-up must be adapted to risk, materiality, the form of cooperation, and the municipality's actual ability to exercise control.

Section 25-1 of the Local Government Act regulates municipalities' and county municipalities' internal control of the administration's activities. The purpose is to ensure compliance with laws and regulations through clear organization, routines, risk management, follow-up on non-conformities, documentation, and improvement.

The provision applies regardless of the technology the business uses. The use of AI is therefore covered when the technology is part of administrative work processes for which the municipality is responsible.

AI and language tools may be adopted in many parts of a municipality before their use has been collectively assessed. The tools can process personal data, affect communication with residents, support case processing, or produce content used as a basis for decision-making.

The internal control provides an existing framework to manage this use. The municipality can integrate AI into ordinary routines for responsibility, risk assessment, approval, documentation, non-conformities, and management reporting, rather than establishing a completely separate control system.