New AI guidelines for the public sector: how to turn them into a practical working tool

In November 2025, the new "Practical guidelines for implementing artificial intelligence in public administration" were published. This is a long-awaited and important step toward bringing order to a landscape where, according to the data, 65% of public institutions already use AI solutions – often, unfortunately, without a clear strategy or security framework.

This document is a huge step forward for putting Latvia's AI landscape in order. But publishing it is only the beginning of the work.

The challenge: from paper to process

Institution heads, IT managers, and lawyers now face the next critical task: integrating these general guidelines into their organization's specific processes.

The key question every leader faces is: how do you put the necessary controls and security in place without turning everyday work into something bureaucratic, slow, and complicated? AI's potential lies in efficiency, and overly heavy-handed regulation can kill that potential at the root.

From theory to safe action

To help state and municipal institutions learn about and put the new requirements into practice, AI Master Lab hosted an exclusive webinar. It wasn't a theoretical lecture, but a conversation with the experts who actually wrote the content of these guidelines – Jānis Judrups, Dr. sc. ing., and Vija Kalniņa, Dr. iur.

What we covered

We focused on three practical pillars of safe AI governance:

• Building an "allow list": How to practically audit tools, define "red lines," and create a list of AI tools approved for use at your institution, so employees clearly know the rules of the game.
• Risk assessment: How to use the decision trees included in the guidelines to determine, within five minutes, whether a given tool is safe and what requirements apply to it under the AI Act.
• AI culture and people: How do you turn employees into allies for security? On the role of "AI champions," and how to build an environment where innovation isn't hidden ("shadow IT") but actively managed.