ChatGPT, Gemini, Claude and other public platforms barred from municipal work, with employees warned that breaches could result in disciplinary or even criminal liability
Orihuela City Council has imposed strict restrictions on the use of public artificial intelligence platforms by municipal employees amid concerns over data protection, confidentiality and the integrity of official procedures.
A mandatory circular signed by mayor Pepe Vegara and the council secretary applies to all municipal departments, dependent bodies and publicly owned companies.
Despite reports describing the measure as a complete ban, the circular does not prohibit every use of AI. It restricts access to public services such as ChatGPT, Gemini, Claude, DeepSeek and the public version of Microsoft Copilot Chat when employees are performing municipal duties.
Staff may use Microsoft 365 Copilot Chat through their authorised corporate accounts, but only as an auxiliary tool and under tightly controlled conditions.
Approved uses include checking spelling and grammar, summarising publicly available legislation or documents, preparing basic outlines and conceptual drafts, and supporting training activities.
AI must not replace the professional judgement or legal responsibility of a council employee. It cannot make decisions, issue reports, exercise public powers, sign documents or independently review and validate administrative actions.
Any employee who incorporates authorised AI-generated material into council work must first check its accuracy, verify it against reliable sources and accept full professional responsibility for the final content.
Sensitive information prohibited
Municipal employees are expressly forbidden from uploading personal information, tax records, census data, police material, staff information, administrative case files or legal and technical reports to public AI systems.
They must not submit contracts, tenders, complaints, personnel documents, screenshots, photographs, recordings or audio containing confidential or protected information.
The circular warns that even an official, signed or partially published document may still contain personal data, signatures, secure verification codes, hidden metadata, confidential annexes or information that has not been authorised for reuse.
AI cannot be used to prepare technical or legal reports, proposed resolutions, council agreements, decrees, minutes, tender specifications, administrative decisions or assessments of bids submitted through public procurement procedures.
Those documents must be produced by the appropriately qualified employees and based on their own technical knowledge, professional judgement and official responsibility.
Messaging services also restricted
The circular also limits the use of messaging applications. Employees must use the internal chat within the Gestiona case-management platform or their corporate email accounts when sending documents or protected information.
Free messaging services including WhatsApp, Telegram, Signal, Messenger, Discord and WeChat must not be used to transmit municipal documents or personal data.
They may still be used for basic organisational messages, logistical coordination, informal meeting notices, urgent incident management and operational emergencies, provided no protected information is shared.
Compliance will be monitored by the General Secretariat and the council’s Modernisation and New Technologies Service, which may conduct audits.
Staff who breach the rules could face disciplinary, administrative or financial liability. In the most serious cases, particularly where confidential documents or personal information are improperly disclosed, criminal consequences may also arise.
Why has the council introduced the restrictions?
The council has not confirmed that the circular followed a specific case of misuse. It may therefore be a preventative measure rather than a response to a known breach.
However, several risks could explain the decision:
- Information entered into a public AI platform is processed on systems controlled by an external provider, potentially taking sensitive material beyond the council’s approved security environment.
- Generative AI can produce incorrect, incomplete or fabricated information. Using an unchecked response in a legal report, public contract or administrative decision could affect citizens’ rights and expose the council to legal challenges.
- Uploading personal data may breach GDPR principles, including confidentiality, data minimisation and purpose limitation.
- Public AI accounts may not offer the contractual security, access controls, audit records and data-retention guarantees required for official municipal information.
- Excessive reliance on automated content could weaken the clear chain of human responsibility required in public administration.
- Unauthorised messaging platforms could result in documents being stored on private telephones, forwarded outside official channels or lost from the formal administrative record.
Spain’s Data Protection Agency advises workers not to submit an organisation’s confidential information or personal details concerning staff and customers to AI systems. It also stresses the importance of following workplace security policies. AEPD guidance.
Orihuela’s new rules reflect that cautious approach: AI may assist municipal employees, but responsibility for every official action and document must remain with the qualified human officer.
