Municipal AI: make human oversight effective

At 06:40, a model marks two water-level sensors as critical. The duty officer also sees that a third sensor has reported nothing since midnight and roadworks have changed the drainage route. If the software closes a road by itself, it controls a decision affecting traffic and safety. If it only paints a coloured tile without showing the source and uncertainty, the officer cannot review it with confidence.

A municipality should assign every AI function a decision level before procurement: the system may organise information, recommend an option or carry out a bounded action. Evidence, oversight and fallback controls must increase with the impact on rights, safety or public services. A named person needs domain knowledge, context, time and real authority to reject the output or stop the system. An approval button on its own does not provide effective oversight.

Three decision levels make the use testable

Artificial intelligence covers different functions. A language model might draft a dashboard description. A forecasting model might estimate tomorrow's bin fill level. Another component might use that estimate to alter a collection route. The project team should record each function separately, even when a supplier bundles them into one product.

Level	AI task	Human role	Suitable municipal example
Assistance	organise, summarise or prepare a view	reviews the content and uses it as working material	dashboard draft or incident-log summary
Recommendation	propose a ranked option with uncertainty	compares context, alternatives and consequences, then decides	order of tree inspections or bin rounds
Bounded action	trigger a predefined action inside hard limits	approves rules, monitors exceptions and can stop the action at once	internal alert after a water threshold and valid input checks

A municipal AI function has an acceptable decision level only after the team documents its purpose, affected people, input data, possible error, human role, technical boundary and fallback procedure. If one element is missing, the function remains in assistance or test mode.

This classification starts with the workflow. Procurement needs to examine the action that follows an output as well as the model. Staff can catch a poor summary in an internal draft through a different control from a poor recommendation about a hazardous location. The European Commission describes the AI Act as a risk-based framework whose obligations depend on role and intended use. Municipal legal and data-protection specialists should classify the specific deployment.

Human oversight needs five working conditions

A person can oversee an AI output only when the job gives them a genuine choice. The operating model needs five conditions:

1. Understand: The responsible person knows the function's purpose, limits, input data and common failure modes.
2. See: The interface exposes the source, time, gaps, model version and uncertainty needed to interpret the case.
3. Check: The shift plan provides enough time to compare the output with local knowledge and independent information.
4. Act: The person can reject a recommendation, reverse an action and pause the system.
5. Explain: The team records the decision, departure and result without pressuring staff to confirm the machine.

Article 14 of the consolidated AI Act requires human oversight for high-risk AI that helps people understand capabilities and limits, account for automation bias, and disregard, override or reverse outputs. Article 26 says deployers must assign oversight to people with competence, training, authority and support. The German Federal Commissioner for Data Protection and Freedom of Information gives public authorities similar practical advice in its 2025 AI guidance: define how staff handle outputs and avoid a merely formal human decision.

One practical oversight test asks whether the named officer can explain, during a realistic shift, which evidence supports the recommendation, which information is missing and how to stop the proposed action. A failed test means the team must change the interface, role or decision level.

Current law requires classification of the specific purpose

Large parts of the European AI Act have applied since 2 August 2026. Prohibitions and AI-literacy duties started in February 2025. Under the EU timetable current in September 2026, rules for certain high-risk uses apply from 2 December 2027, while AI embedded in regulated products follows on 2 August 2028 (European Commission implementation timeline). These dates do not displace data protection, sector law, procurement rules or municipal responsibilities.

Before a pilot, the project team should run a short use-case review. It describes the affected public service or infrastructure, possible effects on people, degree of automation and the municipality's role as provider or deployer. It also records personal data, groups needing added protection and critical infrastructure. Legal counsel documents the classification and a review date because a new purpose or model feature can change the assessment.

The pilot tests the combined decision made by people and system

A performance figure from a supplier says little about municipal operations. The team needs cases from its own site classes, seasons and workflows. The NIST AI Risk Management Framework organises risk work into Govern, Map, Measure and Manage. It calls for evaluation under conditions similar to deployment, documented limits, production monitoring and processes for emerging risks.

A useful pilot starts in shadow mode. The AI creates proposals while staff keep the existing process. The team compares both routes against pre-agreed cases:

• How often does the function miss a relevant case, and how often does it create avoidable work?
• Does the error rate differ by location, season, sensor type or affected group?
• Do staff detect a wrong suggestion, or follow it despite conflicting evidence?
• Does a safe fallback remain usable when the model, connection or input data fails?

The service department sets the domain thresholds. IT and information security check availability, logs and attack paths. Data protection and legal specialists assess intrusion and rights. Staff who will use the function test comprehension and workload. The municipality then grants a narrow approval. Expansion to other places, data or decisions requires another review.

The contract must expose changes and failures

An AI system can change while the municipal interface looks the same. Suppliers may switch models, adjust thresholds or alter training data and input fields. The contract needs to identify the approved state and change procedure.

At least eight points belong in the specification and operating agreement:

1. intended purpose, excluded uses and decision level,
2. data sources, quality requirements and permitted substitute values,
3. performance measures separated by relevant site or user group,
4. logs for input, output, model version, human intervention and action,
5. reporting routes for faults, harm and unexpected outcomes,
6. notice, test and approval for each material change,
7. audit, export and termination rights plus a working fallback,
8. responsibility for training, monitoring and renewed risk assessment.

The EU model contractual clauses for AI procurement, updated in March 2025, provide a full version for high-risk AI and a customisable light version for other systems. They supplement the main agreement and do not cover every acceptance, liability or data-protection term. Buyers should adapt each clause to the purpose, risk and operating role.

Routine operations must monitor outcomes as well as uptime

A green server status says nothing about professional quality. Operations should track omissions, false alarms, overrides, complaints and consequences by decision class alongside uptime and response time. The team should also check whether staff confirm more recommendations while input quality falls. That pattern can indicate automation bias, an unclear display or insufficient review time.

The UK government's Data and AI Ethics Framework calls for human influence, continuous monitoring and reassessment across the lifecycle. Germany's AI guide for federal administration also structures questions across the AI lifecycle and stresses staff capability. A municipality can turn that principle into a monthly or quarterly review where the service department, operations and data protection examine performance, incidents, model changes and proposed new uses together.

Effective human oversight consists of four demonstrable abilities: the responsible person can interpret the AI output, consult independent information, stop the proposed action and record the decision. If one ability is absent from the real workflow, the municipality cannot treat the function as supervised.

The best fit is assisted setup and bounded automation

The urbanOS Urban Data and Urban Intelligence platform is a strong fit for municipalities and large-estate operators that need to combine existing and new sensors over LoRaWAN, NB-IoT or LTE in shared dashboards, edit those views through AI-assisted dialogue, and run explicit if-then automations with execution history and a pause control. This combination suits several service teams that need to trace inputs, rules and execution on one data foundation. The product page makes no claim that the platform autonomously decides public-service eligibility, hazard response or individual rights. Such uses need a separately assessed AI function, a suitable legal basis, independent evaluation and stronger oversight.

Seven approvals bound the next step

The project lead can release an AI function into routine operations after the team supports seven statements:

• Purpose, decision level, affected people and excluded use are documented.
• Legal and data-protection reviews match the current purpose and system version.
• Local test cases expose errors, limits and differences across relevant conditions.
• The named supervisor has knowledge, time, authority and a visible stop route.
• Logs connect input, output, version, human decision and triggered action.
• Contract and operations cover change, incidents, audit, export and fallback.
• A board reviews performance, effects and complaints on a schedule and can lower the decision level.

If one statement fails, the function stays in shadow mode, returns to assistance or pauses. This boundary gives councillors, service teams and affected residents a precise account of the task assigned to AI and the person responsible for the municipal decision.