Practical Data Quality Standards for AI Projects in Public Administration

Why data quality is critical in public-sector AI

An AI model is only as good as its data. In public administration, poor data produces outcomes that affect rights, budgets, and public trust. Data quality is also tied to legal obligations: keeping records of processing and performing a Data Protection Impact Assessment (DPIA) under the GDPR, complying with security requirements in the Spanish National Security Scheme (ENS, RD 311/2022), and meeting the guarantees, transparency, and continuous evaluation demanded by the EU AI Act for high-risk systems.

This document proposes an operational framework and a practical checklist for municipal teams to validate, correct, and maintain the quality of their data in AI projects.

Operational principles (what to prioritize)

• Use-case driven: not every project requires the same level of rigor; prioritize the data that directly influences automated or assisted decisions.
• Traceability and metadata: each dataset should have an owner, extraction date, source, transformations, and version.
• Security and minimization: classify sensitivity according to ENS and the GDPR, apply data minimization and protection techniques (pseudonymization/anonymization) before use.
• Continuous validation: quality doesn’t end at deployment; monitor drift, completeness, and bias in production.

Minimum roles and responsibilities

• Data Steward: responsible for dataset quality and documentation.
• Data Controller / DPO: validates legal bases and the DPIA.
• Model Owner: defines quality requirements for training and production.
• Security Team (ENS): defines access controls and encryption according to classification.

Assigning these roles is essential before large-scale ingestion.

Quick data quality checklist (practical)

Use this checklist as part of the acceptance process for any dataset before using it in AI:

1. Identity and provenance
   • Documented source (system A, form B, agreement C).
   • Record of permissions/consents and legal basis (GDPR).
2. Completeness
   • % of null values per field; acceptable thresholds defined by use case.
3. Accuracy and consistency
   • Cross-checks with master sources (Municipal Register, Cadastre).
   • Business rules (coherent dates, valid codes).
4. Timeliness / freshness
   • Date of last update; defined refresh cadence.
5. Uniqueness and referential integrity
   • Duplicate identifiers or collisions between records.
6. Sensitivity and classification
   • ENS labeling + GDPR classification (personal data, special categories).
7. Label quality (if annotations exist)
   • Consistency among annotators; agreement rate (Cohen’s kappa or other).
8. Distribution and representativeness
   • Compare demographic distribution with target population; detect under-representation.
9. Drift and stability
   • Define drift metrics (e.g., KL divergence) and alarm thresholds.
10. Versioning and snapshot

• Each dataset in use must be versioned and stored with an immutable snapshot.

Recommended technical controls

• Ingest-time validation: automatic rules that reject or quarantine records that violate the schema.
• Schema registry and data contracts: define types, ranges, and required fields.
• Cataloging with minimum metadata: owner, description, sensitivity, update frequency, SLA.
• Reversible pseudonymization/anonimization only in controlled environments; prefer irreversible techniques when possible.
• Separable test datasets: keep training, validation, and test sets distinct under the same governance.
• Production monitoring: pipelines that compute quality metrics daily/weekly and send alerts.

Practical example: an inspection prioritization project

• Data used: incident reports, licenses, land registry data, sanctions history.
• Initial actions:
  • Inventory and prioritization: identify which tables most impact prioritization.
  • Master key validation: cross-check NIF/CIF (tax ID) against the fiscal registry to avoid duplicates.
  • ENS classification and application of access controls according to sensitivity.
  • Metric definition: % nulls in critical fields < 2%, maximum update latency 24h.
• In production:
  • Monitor drift in key variables (e.g., number of sanctions per month).
  • Quarterly re-evaluation and triggers for retraining if drift exceeds thresholds.

How to integrate controls into procurement and governance

• Include data quality clauses in tender documents: source accessibility, delivery frequency, interoperable formats, responsibilities for error correction.
• Require evidence: snapshots, transformation logs, quality reports as part of milestones.
• Link data SLAs to penalties or contractual reviews.

Suggested operational KPIs

• Mean time to detect and correct data anomalies.
• % of datasets with complete metadata and versioning.
• Number of drift alerts per month and average mitigation time.
• Ingest rejection rate due to validation rules.

Conclusion and immediate actions (90 days)

Recommended 90-day action plan:

1. Quick inventory (20/50): list the 20 datasets that feed automated decisions.
2. Assign a Data Steward and Model Owner for each.
3. Implement minimal ingest validations (schema, nulls, duplicates).
4. Create basic cataloging with ENS/GDPR classification.
5. Establish 3 quality KPIs and a simple dashboard to monitor them.

These steps reduce legal and operational risk, increase confidence in results, and simplify audits (GDPR, ENS, EU AI Act). If you need support, platforms like OptimGov Ready provide governance templates and roadmaps to implement this plan in a municipal environment.

Takeaway: start with the data that most affects real decisions: inventory, clear responsibility, automated validation, and continuous monitoring are the core of data quality in public-sector AI.