AI for drafting and reviewing municipal ordinances: ensuring legal quality

Why consider AI for drafting and reviewing ordinances

AI tools can speed up repetitive stages of regulatory drafting: consolidating texts, detecting inconsistencies, generating drafts and summaries for public consultation. But because they can directly affect citizens’ rights and obligations, their use requires strict controls: traceability, human oversight, legal testing and compliance with the legal framework (GDPR, EU AI Act and security requirements such as ENS RD 311/2022 where applicable).

Below we propose a practical approach to introduce AI into the drafting and review of municipal ordinances without compromising legal certainty or administrative responsibility.

Use cases with highest benefit and low risk

• Draft generation from regulatory templates and policy objectives.
• Automatic consolidation of versions and harmonization of wording (terminology, internal references).
• Detection of conflicts and missing cross-references (dates, articles, annexes).
• Executive summaries and materials for public participation (plain language).
• Preliminary impact analysis: identifying areas where personal data or fundamental rights may be affected.

Avoid using AI to replace final legal judgment: signing and responsibility for the text must remain with qualified staff.

Essential legal and operational controls

1. Mandatory human supervision

   • Establish clear roles: who proposes, who legally reviews, who approves. AI acts as an assistant, not as the decision-maker.
   • Record in the file who validated each part of the text.

2. Source validation and traceability

   • Maintain an inventory of documents, laws and precedents used by the AI (model cards/data sheets).
   • Version every draft and keep metadata: prompt, model, date, requesting user.

3. Legal testing before use in procedures

   • Define acceptance tests (test cases) with realistic scenarios: contradictions, rights suppression, ambiguities.
   • Measure the rate of "critical findings" and require correction by legal staff before publication.

4. Personal data management

   • Do not include personal data in prompts or as context without a GDPR assessment.
   • If the system processes personal data (for example, residents’ complaints), apply minimization, encryption and treatment records in accordance with GDPR.

5. Security and technical compliance

   • If the service is hosted or integrated into municipal infrastructure, review ENS RD 311/2022 for applicable security requirements.
   • Require providers to include clauses on traceability, operational continuity and incident response.

6. Assessment under the EU AI Act

   • Classify the tool under the AI Act; while text drafting alone is unlikely to be "high-risk", features that make automated decisions affecting rights (e.g., sanctions) can raise the risk level and trigger transparency and documentation obligations.

Technical and process best practices

• Controlled regulatory templates: work with official templates approved by the legal department that the AI will use as a base.
• Governed prompt engineering: define preapproved prompts and avoid ad hoc, unlogged prompts.
• Immutable logs: store inputs/outputs relevant to the ordinance process in an audit-ready format (hashes or signatures).
• Responsibility matrix: clearly assign content ownership (technical unit), legal reviewer and publishing responsible.
• Integration with municipal systems: link the workflow to the document manager and the official bulletin to maintain version consistency.

Example minimum checklist before publishing an AI-generated draft

• Is there a legal validation signed by the competent technician? Yes/No
• Has the absence of unjustified personal data been verified? Yes/No
• Have coherence tests been run with at least 5 real cases? Yes/No
• Have the process metadata been saved (model, prompt, user)? Yes/No
• Has a plain-language summary for public consultation been prepared? Yes/No

Integration with citizen participation and transparency

• Publish the AI-prepared summary and an impact statement explaining, in accessible terms, the role AI played in the file (when appropriate).
• Maintain a public registry of AI systems used and responsible contacts (adapted transparency templates).

Practical execution: 60-day pilot

Recommended action (60 days):

1. Select a low-complexity ordinance for the pilot (e.g., regulation of terraces, with limited administrative impact).
2. Define the template and test cases together with the legal department.
3. Implement a controlled environment (can be internal or SaaS with ENS/GDPR clauses).
4. Conduct 3 rounds of generation and review, documenting prompts and adjustments.
5. Evaluate results: time saved, legal issues found, level of human correction required.
6. Decide on scalability and set an escalation plan with adaptive controls.

OptimGov Ready can help with risk diagnosis and deployment of a compliant pilot. Whatever the tool, the rule is clear: AI accelerates and assists, but legal responsibility and the final decision must remain with the administration.

Takeaway / Immediate action

Launch a controlled 60-day pilot using a low-complexity ordinance with preapproved templates, immutable metadata recording and mandatory legal supervision. Evaluate results to decide on scaling with controls compliant with GDPR, the EU AI Act and ENS.