The Court of Audit approves its first artificial intelligence policy

The Plenary of the Consello de Contas de Galicia (Galician Court of Audit) approved on July 29, 2026, the draft artificial intelligence use policy for this entity, the first of its kind adopted by a Galician external control body. The text was published in the Diario Oficial de Galicia (DOG no. 157, of August 20, 2026, p. 45511) by means of the Resolution of August 13, 2026, of the chief councillor, Juan Carlos Aladro Fernández, which orders its full publication.

The policy regulates the use, implementation, evaluation, supervision, and control of technologies based on artificial intelligence within the Consello, the statutory body responsible for the external auditing of the public sector of the Autonomous Community, the prevention of corruption, and the advisory function. The regulation is part of axis 3 of the Strategic Plan of the Consello de Contas (2023-2028), which promotes data governance and a digital and collaborative auditing model.

Regulatory framework and references

The policy is situated within the context of European and national regulation on artificial intelligence. Within the scope of the European Union, it adheres to Regulation (EU) 2024/1689 and Regulation (EU) 2016/679 on the protection of personal data; at the national level, it considers Royal Decree-Law 6/2023, of December 19. In the regional sphere, although Law 2/2025, of April 2, for the development and promotion of artificial intelligence in Galicia does not include the Consello in its subjective scope, the latter adopts the principles of the regulation in the exercise of its organizational autonomy.

As close references, the strategies of the European Court of Auditors, the practical auditing guide with artificial intelligence developed within the framework of Asocex, the policy of the CTEAXE, and Instruction 2/2026 of the Plenary of the General Council of the Judiciary were taken into account.

Guiding principles

Artificial intelligence shall exclusively have a character of support and technical assistance, and may in no case replace the professional judgment of the staff. The regulation establishes the following guiding principles:

• Primacy of human judgment and institutional independence regarding the audited entities.
• Legality, ethics, and proportionality in the use of the systems.
• Transparency, explainability, and interpretability, with auditable and documentable use.
• Non-discrimination and bias control, with a prohibition of systems that produce discriminatory biases.
• Continuous training and capacity building of the staff, including the risks of generative artificial intelligence, algorithmic biases, and hallucinations.

Governance and permitted uses

The Artificial Intelligence Governance Committee shall be created, a collegiate body chaired by the chief counselor and composed of auditors from the sectoral departments, the person responsible for the IT Service, and the head of the Data Protection Delegation. Among its functions, the following stand out: authorizing new uses and acquisitions, assessing risks, maintaining a registry of authorized and prohibited systems, and preparing an annual report to be made public on the transparency portal.

Systems may be used in auditing, under human supervision, for the massive analysis of public data, semantic search, preliminary detection of risks or anomalies, support for internal drafts, and documentary classification. The massive processing of personal and auditing data, as well as the creation of profiles of natural persons, prediction of behaviors, or assessment of individual risks, is prohibited. The generated results shall be of an auxiliary nature and shall not in themselves constitute sufficient audit evidence, and all use must be documented and identified in the working papers.

The policy shall enter into force on the day following its publication in the DOG, and constitutes a reference for the Galician public administration in the responsible adoption of artificial intelligence, by reconciling efficiency with data protection and the safeguarding of professional judgment.

Source: Official Gazette of Galicia, no. 157, August 20, 2026, section III (Other provisions), p. 45511 (official reference: CVE-DOG by5ais30-dza5-vi47-ibi1-e6yrhqqxsac1).