Sharing an AI environment: what works between public bodies, and what does not
Short answer
Sharing an AI node with other public bodies works, and is often the only way to make a serious environment affordable for smaller organisations. The conditions: data stays separated per participant, roles come from each participant’s own identity provider, and it is recorded in advance who is controller, who is processor, and what happens when a participant leaves.
Why sharing is attractive
A GPU server does not scale down: an authority with a hundred staff needs much the same base infrastructure as one with a thousand. Sharing spreads that cost, and the management with it: one team that maintains models, monitors and builds automations, instead of five teams working the same thing out.
Many public bodies already know this model from other facilities: a joint arrangement, a shared service centre or regional cooperation.
What has to stay separate
| Component | Shared or separate? |
|---|---|
| Hardware and models | Shared; the models are the same for everyone |
| Sources and documents | Separate per participant, without exception |
| Users and roles | From each participant’s own identity provider |
| Conversations and outputs | Separate, with their own retention periods |
| Logging | Visible per participant, plus management logging for the operator |
| Automations | Shared where policy is identical, separate where it differs |
Test that separation actively, with an account of one participant that must see nothing of another. See Access control for AI.
Roles and agreements
- Each authority stays controller for its own data and its own purposes.
- The operating organisation is processor, with a processing agreement per participant, or joint controllers where participants jointly determine purposes and means. Record that choice explicitly.
- One DPIA with annexes per participant works better than five separate documents. See A DPIA for generative AI.
- Decision-making. Who decides which models run, who approves an update, and what happens when participants disagree?
- Joining and leaving. Which notice period, which costs, and how does a departing participant take its data, indexes and automations along? See Procuring AI as a public body.
Pitfalls in cooperation
- Policy is not identical. An automation that tests against policy rules only works if the rules are the same; otherwise it is configured per participant.
- The largest participant decides everything. Record say by contribution and by interest, not only by population size.
- Accountability stays individual. Each authority accounts for its own use, even when the technology is shared.
- Capacity. Plan for the peak of all participants together, not for the average.
werqly delivers an environment per node in which sources, roles and logging are separated per organisation, so sharing works without data running together. See AI for local government.
Frequently asked questions
Questions on this topic
May public bodies share one AI node?
Yes, provided data stays separated per participant, roles come from each participant’s own identity provider, and it is recorded in advance who is controller and who is processor. Each authority remains responsible for its own use.
Who is controller in a shared facility?
As a rule each participating authority for its own data, with the operating organisation as processor. Where participants jointly determine purposes and means, they may be joint controllers; record the choice explicitly.
Can we share automations with each other?
Where policy is identical, yes: a summariser or a classification works the same everywhere. Where policy rules differ, configure the automation per participant, or one body’s policy quietly ends up applying to another.
What do we arrange for leaving?
Notice period, costs and the handover of data, source indexes and automations in a usable format. Also agree what happens to shared automations that the departing participant helped pay for.
Sources
- GDPR (Regulation (EU) 2016/679), Articles 26 and 28
- Dutch Joint Arrangements Act (Wet gemeenschappelijke regelingen)
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.