For those serious about closing the gap between AI policy and AI practice at the local level, the conversation continues at Human x AI Europe on May 19 in Vienna, where practitioners, policymakers, and technologists will work through exactly these implementation challenges.
The Problem: Principles Without Process
Cities are deploying AI systems for mobility, land use, public services, and environmental management. The systems are live. The governance is not.
Research published this week in Smart Cities by Yigitcanlar and colleagues frames the core tension: Urban AI is predominantly governed through fragmented frameworks designed at national or corporate scales, offering limited guidance for municipal decision-making and overlooking place-specific social and ecological consequences.
The OECD AI Principles exist. The UNESCO Recommendation on AI Ethics exists. The EU AI Act exists. What does not exist is a practical playbook for a city of 200,000 people with three IT staff and a procurement process designed for office furniture.
This is the implementation gap. And it is where most municipal AI projects fail.
What the Stage-Gate Framework Actually Does
The framework proposed by the QUT Urban AI Hub team structures municipal AI governance into discrete phases with explicit decision points. Before an AI system advances from one stage to the next, specific criteria must be met. The approach borrows from product development methodology but adapts it for public sector constraints.
The core insight: governance cannot be a one-time compliance check. It must be embedded across the AI lifecycle, from initial task identification through deployment, operation, and eventual decommissioning.
Complementary research from Springer on municipal AI integration identifies eight implementation phases: task identification, AI suitability assessment, data evaluation, solution development or procurement, MVP (minimum viable product) creation, testing, operational transition, and continuous monitoring. Each phase incorporates AI-specific risk factors tailored to municipal contexts.
The practical implication: cities need to answer three questions at every gate:
- Who owns this system when it fails?
- How will drift or degradation be detected?
- What is the rollback plan?
If all three cannot be answered, the project does not advance.
Why National Frameworks Are Not Enough
A multi-level analysis of AI deployment across U.S. federal, state, and municipal authorities reveals a clear pattern: the character, function, and risks of AI in the public sector are fundamentally shaped by the level of governance at which systems are deployed.
Federal agencies tend toward control-oriented AI: surveillance, enforcement, regulatory oversight. Municipal governments deploy AI in more pragmatic, service-oriented ways: streamlining operations, improving direct interactions with residents.
The governance requirements differ accordingly. A federal fraud detection system and a municipal pothole reporting chatbot both use AI. They do not require the same oversight architecture.
Research from the University of Toronto's School of Cities on Canadian municipalities identifies three findings that apply broadly: local AI governance relies heavily on outsourcing of AI systems; federal and provincial policies have limited impact on municipalities; and local AI governance lacks civic participation.
The outsourcing point matters. When a city procures an AI system from a vendor, the governance challenge shifts from how do we build this responsibly to how do we hold the vendor accountable for responsible operation. Most municipal procurement processes are not designed for this.
The Algorithm Registry Model
Several European cities have operationalized transparency through algorithm registries. The Algorithmic Transparency Standard developed by Eurocities' Digital Forum Lab provides a common data schema for algorithm registries that is validated, open-source, and publicly available.
Amsterdam's algorithm register, launched in 2020 alongside Helsinki, was among the world's first municipal AI registries. As of January 2025, Amsterdam's register merged into the Netherlands' national Algorithm Register, which now includes over 1,300 algorithms published by more than 500 participating government organizations.
The registry model addresses transparency but not governance. Knowing that an algorithm exists is different from ensuring it operates responsibly. CIDOB's research on ethical urban AI emphasizes that registries must be supplemented with impact assessments, human oversight mechanisms, and clear accountability chains.
Barcelona's approach is instructive. The city developed internal protocols for ethical implementation of algorithmic systems that include step-by-step mechanisms for each stage of the AI lifecycle, from public tendering through implementation to eventual dismantling. The procedure adapts to different risk levels and embeds ethical review into procurement.
The EU AI Act and Municipal Implementation
The EU AI Act's recent simplification agreement adjusts timelines for high-risk AI system requirements. Stand-alone high-risk AI systems now face a compliance deadline of December 2, 2027; high-risk AI systems embedded in products face August 2, 2028.
For municipalities, the Act's high-risk classification covers AI used in critical infrastructure, education, employment, access to public services, and administration of justice. The implementation timeline requires member states to establish at least one AI regulatory sandbox at the national level by August 2, 2026.
The practical challenge: most municipalities lack the legal, financial, technological, and human resources necessary to effectively integrate AI solutions while meeting these requirements. The U.S. Conference of Mayors' AI Playbook recommends that cities assemble a core AI governance team including a high-level leader, representatives from key departments, and legal and compliance representatives before deploying any AI system.
What Actually Works: Lessons from Implementation
The stage-gate framework's value lies in its specificity. Rather than abstract principles, it provides decision criteria.
At the planning stage: Does the proposed AI system address a genuine municipal need, or is it a solution in search of a problem? Has a fundamental rights impact assessment been conducted? Are the data sources appropriate and legally accessible?
At the deployment stage: Is there a documented rollback procedure? Who receives alerts when the system behaves unexpectedly? What is the threshold for human review of automated decisions?
At the oversight stage: How frequently are outputs sampled for quality? What metrics indicate drift? When does the system require retraining or retirement?
The OECD's recent report on governing with AI notes that AI adoption in government trails behind the private sector. Governments face unique challenges including skills shortages, legacy systems, data availability constraints, and higher requirements for privacy, transparency, and representation.
The stage-gate approach addresses these constraints by making governance incremental rather than monolithic. A city does not need a complete AI governance framework before deploying its first system. It needs a framework that grows with deployment.
The Participation Gap
The research identifies a persistent deficit: civic participation in municipal AI governance remains minimal. Citizens are affected by algorithmic decisions but rarely involved in shaping how those systems are designed or overseen.
The stage-gate framework proposes participatory oversight mechanisms, but implementation details remain underdeveloped. How does a city of 50,000 people meaningfully engage residents in decisions about predictive policing algorithms or welfare eligibility systems?
A recent report on algorithm registers recommends that governments collaborate with civil society to build, assess, and use registries. The report notes that most existing registers lack evaluation and results, and few can be used as resources for monitoring and research due to missing technical features.
The gap between transparency and accountability remains the central challenge. Publishing information about an algorithm is necessary but not sufficient. The harder work is building institutional capacity for ongoing oversight.
Implementation Checklist
For municipal leaders considering AI deployment, the stage-gate framework suggests the following minimum requirements:
Before Procurement
- Document the specific problem the AI system will address
- Identify the data sources and assess their quality and legal basis
- Conduct a preliminary risk assessment using the EU AI Act's risk categories
- Designate an internal owner responsible for the system's outcomes
Before Deployment
- Complete a fundamental rights impact assessment for high-risk systems
- Establish baseline performance metrics
- Document the rollback procedure
- Register the system in any applicable algorithm registry
During Operation
- Sample outputs weekly for quality and bias
- Monitor for distribution shift in input data
- Maintain logs sufficient for incident investigation
- Review vendor compliance with contractual obligations
For Oversight
- Publish transparency reports on system performance
- Establish channels for citizen feedback and complaints
- Conduct periodic audits, either internal or external
- Define criteria for system retirement
The framework is not a guarantee of responsible AI. It is a structure for making governance decisions explicit and accountable. The alternative, which remains common, is governance by accident: systems deployed without clear ownership, monitored without clear metrics, and retired only when they fail publicly.
Frequently Asked Questions
Q: What is a stage-gate framework for municipal AI governance?
A: A stage-gate framework structures AI governance into discrete phases (planning, deployment, oversight) with explicit decision points. Before an AI system advances from one stage to the next, specific criteria must be met, including risk assessments, accountability assignments, and rollback procedures.
Q: Which cities have implemented algorithm registries?
A: Amsterdam and Helsinki launched the first municipal algorithm registries in 2020. The Netherlands now operates a national Algorithm Register with over 1,300 algorithms from 500+ government organizations. Barcelona, Brussels, Eindhoven, Mannheim, Rotterdam, and Sofia also participate in the Eurocities Algorithmic Transparency Standard.
Q: When do EU AI Act requirements apply to municipal AI systems?
A: Stand-alone high-risk AI systems face a compliance deadline of December 2, 2027. High-risk AI systems embedded in products face August 2, 2028. Member states must establish at least one AI regulatory sandbox by August 2, 2026.
Q: What qualifies as a high-risk AI system under the EU AI Act?
A: High-risk AI systems include those used in critical infrastructure, education, employment, access to public services, law enforcement, migration, and administration of justice. The classification depends on both the use case and the potential for harm to health, safety, and fundamental rights.
Q: How should municipalities handle AI systems procured from vendors?
A: Municipalities should include AI-specific clauses in procurement contracts covering transparency requirements, data governance, human oversight mechanisms, incident reporting, and audit rights. Barcelona's internal protocols provide a model for embedding ethical review into procurement processes.
Q: What is the minimum governance requirement before deploying a municipal AI system?
A: At minimum, municipalities should be able to answer three questions: Who owns this system when it fails? How will drift or degradation be detected? What is the rollback plan? If all three cannot be answered, the system is not ready for deployment.