AI in UK local government: what officers can put into ChatGPT

Almost every council that answered the LGA’s 2025 survey uses or is exploring AI, and most officers have a chat window a click away. What the rules say about a resident’s case inside that window is less settled than it should be. This page answers it, service by service, for councils using AI.

There is no AI statute to look up. A council officer is bound by UK GDPR, the Data Protection Act 2018, the Freedom of Information Act 2000 and whatever their own council has written down. The rest is guidance, and much of it was written for Whitehall.

How AI in local government is being used today

The Local Government Association surveyed English councils between December 2024 and February 2025. A third replied, and 95 per cent of those were using or exploring AI. Generative AI, the chat-style kind, was the most common at 83 per cent.

Where it is used matters more than how much. Corporate work came first, then adult social care, then children’s. That order puts generative AI right next to the most sensitive files a council keeps, which is why whether pasting client data is a breach is a live question for council staff.

The bars below are the LGA’s own figures. I find the 31 per cent for children’s services the most striking line in the whole survey.

Can council staff use ChatGPT? What the written rules say

The answer depends on your council, and the published rules range from cautious to flat refusal. Derbyshire County Council told its staff on 13 March 2026 not to use third-party or public AI tools, naming ChatGPT, “for any council business”. Its approved tool is Microsoft Copilot.

Derbyshire gives reasons, which is rarer than it should be: it cannot control where data sent to public tools goes or how long it stays. Its Copilot sits inside the council’s Microsoft environment, though which Copilot you open changes that promise.

The central government line is close to Derbyshire’s. It is guidance, not law, but it is the text an information governance team will point to. The table puts the three rules side by side.

Social care and children’s services: the files with the most at stake

A council holds the parts of people’s lives that nobody chooses to share. Children’s social care assessments, adult care plans, homelessness applications and SEND files all mix identity with health, family and safety. Health detail is special category data, which needs a second legal condition before any processing.

Social workers ask in public forums whether ChatGPT can help draft a report. On a public account with the case in it, it can’t, and no amount of careful wording changes that. Where the note touches health services, the NHS rules come in too, as set out for NHS staff using ChatGPT.

Removing names is not enough in a council. A postcode, a household size and a service often point to one family, so a document with names removed may still be personal data. Pick a service below to see what travels with a typical file.

Data protection and AI in local government: public task, DPIA and section 170

A council usually relies on public task, Article 6(1)(e) of UK GDPR. It covers what the council must do, not a case pasted into a tool nobody approved. Nor does it skip the DPIA: that exception needs a statute that specifically regulates the processing, among four conditions.

The AI Playbook says to do a DPIA before an AI system goes live. The ICO’s DPIA guidance lists AI as innovative technology: add one more criterion, such as vulnerable people, and a DPIA is required. A social care pilot meets both on day one.

Section 170 of the Data Protection Act 2018 is the part officers rarely hear about. Knowingly or recklessly disclosing personal data without the controller’s consent is an offence. Believing, reasonably, that the council would have agreed is a defence, and a written ban on the tool leaves little room for that belief.

Chatbots for local government: what residents are told

Council chatbots are the AI residents meet first. The AI Playbook says public bodies should clearly identify any automated response to the public, and gives the example of a chatbot reply that says so. That costs one sentence, and it belongs in the first message, not the small print.

Buckinghamshire Council publishes a privacy notice for its AI virtual assistant and live chat, updated in May 2026. It keeps transcripts and an AI rating of each live chat as positive, neutral or negative. Live chat conversations are deleted after two years, and the council says no automated decisions are made.

One detail puzzles me. The notice lists consent, contract, legal obligation and public task as lawful bases all at once. Consent is shaky ground for a public authority, as residents rarely have a free choice. The Playbook also warns of prompt injection on public chatbots; screening for it is in our Lakera Guard comparison.

The Algorithmic Transparency Recording Standard: does it apply to councils?

The ATRS is the government’s public register of algorithmic tools. It is mandatory for central government departments and certain arm’s length bodies in scope. For other public bodies, councils included, the AI Playbook says it is not a requirement yet, and encourages its use anyway.

On 8 November 2026 the register held 155 records, 13 of them filed under local authorities. The few councils that publish are worth reading, because their records show what other teams have bought. A short list follows.

Newcastle’s record for Magic Notes stands out: a tool that records adult social care case notes. It is the highest-stakes use on a register councils need not use, and worth ten minutes of anyone’s time. The same questions belong in the AI section of a cyber insurance questionnaire.

FOI and subject access: when a council holds an AI prompt

Section 3(2) of the Freedom of Information Act 2000 says information is held by a public authority if it holds it, or if another person holds it on the authority’s behalf. Prompts and answers stored in a council’s own tenant are plainly held. Scottish councils answer under FOISA 2002 instead.

A subject access request reaches further. If an officer typed a resident’s circumstances into a tool, that text is the resident’s personal data, wherever it sits. A council that cannot search its AI tools cannot answer completely. Each vendor keeps different things, as ChatGPT’s data terms show.

The harder case is the officer’s personal account. Whether a council “holds” a chat it never approved is exactly the kind of point I’d want a lawyer to settle before a request arrives. The table shows where each kind of prompt lands.

Local AI and transcription: what MHCLG is building for councils

On 16 March 2026 the Ministry of Housing, Communities and Local Government introduced Local AI, a team to speed up responsible AI use in councils. Its focus list reads like a map of the riskiest files: temporary accommodation, adult and children’s social care, SEND, customer service and casework.

Its most visible tool is Local Transcribe, which records, transcribes and summarises conversations for frontline teams, starting with housing. Meanwhile the AI Playbook warns that transcription tools from outside suppliers silently upload meeting recordings, and tells organisers to say up front they are not allowed.

Read together, the two give a clear rule: a council transcriber is fine, a personal one is not. This is the rule worth saying out loud at the start of every resident meeting.

A resident’s details already went into ChatGPT: the first hour

Assume it has happened somewhere in your council. The reflex is to delete the chat and say nothing. That removes the only record of what was sent, and the first thing the regulator will ask is what left and where it went.

Write it down first, then tell the data protection officer the same day. Article 33 of UK GDPR gives the council 72 hours from becoming aware of a reportable breach. Only after that is recorded should anyone delete the ChatGPT history properly.

An officer who reports quickly is the council’s best evidence that its policy works. Derbyshire counts unauthorised use as a data breach that may go to its disciplinary process. My advice to any manager: say plainly that the hidden slip is the one punished hardest.

Council case notes and AI: strip the resident out first

Most of what an officer wants from AI needs no identity at all: a clearer letter, a shorter summary, a checklist. The resident’s name, date of birth and NHS number add nothing to the wording. Remove them before the text leaves the screen, and keep the sentence that holds the question.

Exports from case systems are where identifiers hide in bulk, one per column, so mask a CSV export before anything else.

Paste your own note into the box to see which UK identifiers it finds. The NHS number is the one I would never let through: it follows a resident across health and care for life.

For a council where officers need help with real case notes, Nonimo for UK public services swaps the resident’s identifiers for labels on the officer’s own computer and puts them back in the answer.

IT can roll it out by policy for whole teams, as on our page for organisations.

How the labels stay on the officer’s machine is explained on our security page.

Sources

• LGA, State of the sector: Artificial intelligence, 2025 update: 95 per cent using or exploring; 83 per cent generative; 84, 44 and 31 per cent by function; 68 per cent using suppliers; a third responding.
• Derbyshire County Council, Using artificial intelligence at work: no public AI tools for council business; Copilot only; unauthorised use treated as a data breach.
• GDS, AI Playbook for the UK Government (GOV.UK): official information in public tools, DPIAs, ATRS scope, identifying automated responses, transcription tools.
• DCMS, “Information Commission succeeds the ICO as UK’s data protection regulator”, GOV.UK news: the Commission took over the ICO’s functions on 30 September 2026.
• Data Protection Act 2018, section 170 (legislation.gov.uk): the offence and the reasonable belief defence in subsection (3)(b).
• ICO, When do we need to do a DPIA?: innovative technology, including AI, plus one more criterion; the narrow public task exception.
• Freedom of Information Act 2000, section 3 (legislation.gov.uk): information held by another person on the authority’s behalf.
• Buckinghamshire Council, Privacy for our AI Virtual Assistant and live chat: lawful bases, sentiment rating, two-year deletion, processors.
• MHCLG, Use AI to improve local services (Local Digital): Local AI’s focus services and Local Transcribe.
• MHCLG Digital blog, Introducing Local AI: the team’s launch on 16 March 2026.

Accessed 8 November 2026.