How Czech municipalities deploy AI under GDPR and NIS2

Drafting citizen correspondence

Czech municipalities are deploying generative AI to draft replies to routine letters and e-mails. An official supplies a brief prompt and the model produces a concrete response text or formal letter. The system cannot decide legal entitlements but handles informational e-mails, opening hours of the recycling centre, procedures for minor building notifications, completion of standard forms. The official reviews the draft, adds case-specific details and sends it. In practice, small municipalities with a few staff can answer queries in minutes instead of hours. The critical control is that AI never sends replies directly; it only supplies a draft for human approval.

Transcribing council meetings

A second use case is automatic transcription of audio or video recordings from municipal council sessions and council committee meetings. Specialised tools now distinguish individual speakers and produce a structured draft record that the secretary edits. This removes the manual transcription of hours-long sessions and lets staff focus on accurate capture of resolutions and debate. Cybersecurity audits show that deploying these tools demands maximum care in data protection, particularly when sensitive information is discussed. Recordings must be processed in an environment meeting data sovereignty requirements, ideally on servers located within the European Union.

Legal compliance and data sovereignty

Any AI deployment in public administration must strictly observe Act No. 111/2009 Coll., on Basic Registers, and the GDPR provisions on personal data. An authority must not place citizens’ names, birth numbers or other identifiable data into publicly available models without proper safeguards. The amendment to the Czech Cybersecurity Act implementing the NIS2 directive further obliges municipalities to ensure the resilience of their information systems against cyber threats, a duty that extends to the software tools they use. Municipalities should work only with vetted suppliers who guarantee that data is not used for further model training outside the municipality’s closed system.

Human-in-the-loop governance

The Czech experience shows that AI adoption in local government does not replace officials but provides a digital assistant that takes on mechanical work. Successful implementation requires clear rules for human review of outputs and strict adherence to security standards when handling citizens’ data. This model, generative drafting with mandatory human sign-off, on-premise or EU-hosted transcription, vendor contracts that forbid external training, is directly transferable to any EU public body subject to GDPR and NIS2.