AI and information security in public bodies: baselines, audits and a node in your own network
Short answer
For a security baseline, an AI environment is simply an information system: you classify it, take measures and account for them in your annual audit. Three things are new: the models and their provenance, the connections to source systems, and prompts and outputs as a new data flow. If the node sits in your own network, it falls under your existing segmentation, logging and monitoring.
The framework you place it in
Public bodies work with a security baseline and account for it periodically. Dutch municipalities, for example, report annually through ENSIA on the basis of the Baseline Informatiebeveiliging Overheid. In September 2025 its successor BIO2 was adopted, built around the controls of ISO 27002:2022 with public-sector additions; municipalities still work with BIO 1.04 and use BIO2 as guidance.
For AI this means: no separate framework, but the same questions as for any other system, with three new topics added.
What is new about an AI environment
| Topic | What you record |
|---|---|
| Models and provenance | Which models run, which version, under which licence, and who approves a change |
| Connections | Which source systems the AI may query, with which permissions and which logging |
| Prompts and outputs | Where they are stored, for how long, who can see them and when records rules apply |
| Permissions | Roles from your identity provider, so rights follow joiners and leavers. See Access control for AI |
| Misuse | Protection against manipulation through incoming text. See Prompt injection |
Measures you take in any case
- Segmentation. The AI node in its own network zone, with only the connections needed for management and updates.
- Logging to your SIEM. Usage, administrative actions and connections, with a retention period that fits your policy.
- Patching and model updates. A fixed rhythm, with a rollback scenario, because a new model changes outcomes.
- Administrative access. A small, named team, with two-person approval for sensitive changes.
- Backup and recovery. Configuration, automations and source indexes, not just the data.
- Physical security. Rack, access and climate, or a locked rack in a datacentre. See Hardware for your own AI server.
Why running it yourself shortens the story
With an external AI service, your account has to explain where processing happens, which subprocessors take part, which law applies to them and how you verify it. With a node in your own network that part falls away: the processing sits inside your own zone, under your own measures.
With werqly the node sits in your server room or in a locked rack in a datacentre, with logging you export to your own monitoring. See AI for local government.
Frequently asked questions
Questions on this topic
Do we have to account for AI separately?
There is no separate AI security framework. An AI environment is an information system you classify and protect like any other. What is new are mainly the models, the connections to source systems and the handling of prompts and outputs.
What is BIO2 and does it apply to municipalities?
BIO2 was adopted in September 2025 and follows the structure of ISO 27002:2022, with public-sector additions. Dutch central government, provinces and water authorities apply BIO2; municipalities still work with BIO 1.04 and use BIO2 as guidance.
Which measures are specific to AI?
Recording which model version runs and who approves a change, limiting which source systems the AI may query, logging use and connections, and protecting against manipulation through incoming text.
Is your own node safer than an AI cloud service?
Not automatically: a node of your own also has to be patched, segmented and monitored. The difference is the scope of your accountability: the processing stays inside your own zone and your own measures.
Sources
- VNG — ENSIA, information security accountability for Dutch municipalities (Dutch)
- Digitale Overheid — BIO and ENSIA (Dutch)
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.