Rekenkamer Eindhoven's 'Van risico naar regie' — A Municipal Audit Finds a City Not Yet Able to Deploy Algorithms and AI Safely

The Rekenkamer Eindhoven, the city's independent audit office, commissioned the consultancy PBLQ to examine how the municipality governs algorithms and AI. The report, 'Van risico naar regie: slimmer sturen op algoritmen en AI' (report file dated 2025), examined three cases: Passport for Work, the processing of (change-of-address) notifications, and the AI tool Echo Dembrane. Councillors also took part in a session.
Main conclusion: Eindhoven is not yet sufficiently able to use algorithms and AI intelligently and safely. PBLQ's summary states that formal frameworks such as a code of conduct and an AI assessment framework had not been adopted, which stalls decisions and limits experimentation; employees use generative AI without rules; risk management attention exists (for example data protection impact assessments) but structural evaluation and monitoring are missing; and the city council receives little structured information, limiting its ability to steer and scrutinise. The audit concludes Eindhoven is at the start of mature AI use.
The report also credits steps already taken: an AI expertise group, an internal ethics team, an external ethics committee and an internal algorithm register. The municipality lists its algorithms in the national Algoritmeregister, and warns that algorithms may still be missing and that the register will be supplemented over the coming years.
The council handled the report in March 2026. The responsible alderman accepted four recommendations (AI governance, an assessment framework for algorithms, a public algorithm register, and cost-effectiveness), promised a plan of action to the council in the second quarter of 2026, and undertook to put any amended code of conduct on personal data in AI to the council first. A December 2025 council letter reported a data leak linked to the use of public AI services.
Why it matters: the case is useful as a cautionary, independent baseline. Registers and ethics bodies alone did not equal control; the audit found the gap lay in binding rules, monitoring and council information. No outcome metrics are yet available on whether the plan of action has closed these gaps, and the full recommendations text was not reviewed here.

Read the full analysis: https://pblq.nl/van-risico-naar-regie-slimmer-sturen-op-algoritmen-en-ai/