Museums and AI: growing use, few internal policies

On 17 September 2026, UNESCO and the International Council of Museums published the final report of their first global survey on the use of artificial intelligence in museums. They received 466 responses from 90 countries and retained 403 for analysis. Among the participating institutions, 57% stated they use AI and 55% stated they had no internal policy, strategy, or guidelines regarding its use.

The two figures describe a disparity, yet do not authorise its extrapolation to the museum sector as a whole. Participation was voluntary, the call was circulated through UNESCO and ICOM networks and public channels, and the regional distribution of responses was uneven. The report provides a baseline regarding the participating museums, not a representative estimate of the global sector.

Precision does not diminish the finding. Within an international group connected to professional networks, adoption is more widespread than formal policies, training, and evaluation. AI is already involved in institutional tasks while many organisations have yet to decide which uses they accept, what information may be entered into external services, who verifies the results, or how decisions are documented.

Adoption has preceded governance

Only 7% of participating museums declared they had a formal plan. Another 15% used informal guidelines, pilot projects, or internal practices, and 22% were preparing a strategy. 55% had none of these forms of institutional governance.

Fieldwork was conducted between 21 May and 21 July 2026. The questionnaire, available in six languages, combined 22 closed questions with open-ended responses. Of the 403 validated responses, 271 came from public museums, 73 from private, 23 from community, 18 from university, and 18 from other forms of governance.

Among museums that used AI:

78% used it to understand or analyse texts.
53% used it to create content or support the development of exhibitions.
48% used it to search for information.
41% analysed images or videos.
84% accessed systems through external tools or platforms.
81% stated that a person always reviewed the results before using or publishing them; another 12% said they usually did so.

Stated supervision is high, but reviewing a result is not equivalent to governing the process. A final reading does not determine whether it was legitimate to upload the material, whether the provider may retain or reuse it, whether sources are traceable, which biases must be examined, or whether the tool was necessary. Nor does it, by itself, answer for a published error.

A museum may use AI to translate labels, draft documents, summarise records, research collections, or handle enquiries without having established who verifies each piece of data, which sources must be retained, what content requires authorisation, and when the public must be informed. If a translation alters the meaning of a gallery text, a description adds false data, or an automated classification reproduces a bias, the institution must know who reviews, who authorises, how it is corrected, and who is accountable.

The survey identifies accuracy, copyright, and data protection as primary concerns. Participants also called for technical and ethical training, guidance on data governance and intellectual property, and guidelines adapted for small museums. According to the summary published by ICOM, only 17% offered AI training to their staff.

Capacity is not distributed equally. Among museums with an annual operating budget of less than US$100,000, 39% reported using AI; among those with US$1 million or more, the proportion reached 77%. 66% of the first group lacked a policy, strategy, or guidelines, compared to 33% of the second. Only 4% of museums with lower budgets offered staff training, compared to 30% of the higher-budget group.

These differences do not demonstrate that budget is the sole cause. They are, however, consistent with the shortages of time, personnel, infrastructure, digitisation, funding, and advice noted in the qualitative responses. Demanding a policy without providing the means to implement it may produce a formal document that fails to govern practice. For small museums, a common template, shared support for vetting providers, and sector-specific training may be more useful than an extensive protocol drafted without the capacity for execution.

From the code of ethics to legal obligations

The survey was launched while the 2004 ICOM Code of Ethics was still in force. During the fieldwork, the ICOM General Assembly approved a revised version on 25 June 2026. For this reason, the report uses the 2004 text as a historical reference, while the current ethical framework is the one approved in 2026.

Principle P.7 of the new code asks governing bodies and museum directors to oversee the use of digital technologies, evaluate their benefits, and ensure they do not cause harm. It also requires aligning them with the institutional mission and applicable standards, minimising risks, and considering the dissemination of inaccurate or false information, environmental consequences, intellectual property, the rights of Indigenous peoples, and data sovereignty.

Principle E.7 extends this responsibility to educational activities, exhibitions, and publications. It calls for using technology deliberately, maintaining the accuracy of the historical, scientific, and artistic narrative, and protecting the physical, mental, and emotional well-being of the public. The code establishes principles and announces complementary guidelines; it does not replace an internal policy or applicable legal obligations.

In the European Union, not all AI uses receive the same legal treatment. Since 2 February 2025, the Artificial Intelligence Act has imposed a general obligation to adopt measures to ensure a sufficient level of AI literacy among staff and other persons operating systems on behalf of the organisation.

Furthermore, from 2 August 2026, specific transparency obligations under Article 50 apply. Among others, direct interactions with certain AI systems must be identified, and for those deploying systems, there are specific duties regarding emotion recognition, biometric categorisation, deepfakes, and certain texts intended to inform the public on matters of public interest when published without human review or editorial control.

This does not mean that every translation, internal draft, or AI-assisted text must carry a public label. The obligation depends on the system, the use, the content, and the degree of editorial intervention. An institutional policy must distinguish between legally required transparency and the transparency the museum chooses to adopt for reasons of professional responsibility or public trust.

Data protection, intellectual property, confidentiality, contracts, and security continue to apply regardless of whether the system is subject to a specific obligation under the Artificial Intelligence Act. Entering files, images, visitor data, provenance documentation, or information about communities into an external platform is not a neutral operation. It requires verifying the legal basis, the necessity of the processing, the provider's terms, transfers, retention, security, and rights over the materials.

What a minimum policy should decide

A useful policy need not be extensive or identical for all museums. It must convert principles into verifiable decisions and cover the entire cycle, from tool selection to retirement. At a minimum, it should establish:

Scope and purpose. For which tasks AI is permitted, which require prior authorisation, and which are excluded.
Necessity and proportionality. What problem it solves and why a less intrusive, more reliable, or more controllable procedure is insufficient.
Risk classification. What changes when the use affects collections, research, the public, staff, personal data, communities, or published content.
Accountability. Who proposes, approves, operates, reviews, and answers for the result. Responsibility must not be shifted to the tool or diluted between departments.
Substantive supervision. What must be verified, with which sources, by whom, and leaving what record. "Human review" requires time, competence, and real authority to reject the result.
Transparency. When the law requires disclosure and when the institution decides to do so for ethical, editorial, or trust-based reasons.
Data and security. Which documents, personal data, images, internal records, or sensitive information may be entered into each service.
Providers. Which model and version are utilised, where data is processed, how long it is retained, whether it is reused for training, which sub-processors are involved, and how information is exported or deleted.
Rights and provenance. What authority the museum holds over input and output materials, and how intellectual property, image rights, confidentiality, collective rights, and data sovereignty are respected.
Documentation. Which instructions, inputs, outputs, sources, versions, decisions, and corrections must be retained to reconstruct the process.
Incidents and complaints. How an error is recorded and corrected, when the tool is suspended, who is informed, and what channel is available to an affected person.
Evaluation and withdrawal. What benefit is expected, what indicator is used for measurement, what costs regarding review, dependency, security, labour, and resource consumption are considered, and what outcome necessitates abandoning the system.
Training. What each profile needs to know before using the tool and how those competencies are updated.

Not all uses require the same level of control. Correcting an internal draft presents different risks to classifying a collection, producing a historical narrative for an exhibition, processing visitor data, or automating recommendations. This graduation must be documented. If left to the informal discretion of each employee, the institution returns to the starting point.

A simple register of uses can translate policy into practice. For each system, it would suffice to identify its purpose, the responsible party, the provider, data used, affected persons, planned review, the need to inform, known risks, the date of approval, and the next re-evaluation. Such an inventory allows for the detection of uses that began as personal trials and ended up integrated into ordinary work without an institutional decision.

The museum is both a user and a source of data

The discussion often presents the museum as a user of AI. Its photographs, catalogues, metadata, publications, and digitised collections can also feed into datasets and systems developed by third parties.

Opening data or authorising a reproduction does not necessarily equate to consenting to any future extraction, training, or reuse. Conversely, a legal or technical reservation does not by itself ensure that downloading is materially impossible, nor does it eliminate copies already made. The guide on how to reserve rights against data mining and AI explains the available signals, their requirements, and their limits.

When the museum generates content with AI, another issue arises: which human contributions may be protected and which third-party materials or rights condition the result. The guide on authorship and works created with AI under Spanish law develops this distinction. If the tool is involved in gallery texts, images, reconstructions, or mediation, it is also advisable to document which part originates from verified sources, what transformations were performed, and who assumed editorial responsibility.

The museum can manage these two roles differently. It may authorise certain uses of its digitised collections while prohibiting others; employ a tool for internal tasks without allowing the provider to reuse the data; or publish materials generated with AI assistance under stricter rules than those legally required. The important factor is that these decisions are conscious, mutually compatible, and understandable to staff and the public.

Using is not equivalent to improving

Only 21% of museums using AI reported improvements they considered measurable. 14% had not identified measurable improvements and 65% stated it was still too early to evaluate the impact.

Among those who did report improvements, the most cited areas were accessibility and visitor services or experience, both at 51%, followed by education and mediation, management, collection documentation, and research. These are results declared by the participants, not an external evaluation of efficacy. Nor do they allow for knowing which indicator each museum used or whether the benefit was maintained once the costs of correction, supervision, and training were incorporated.

Saving time does not by itself demonstrate an increase in quality, accessibility, or public trust. A faster translation may require specialised review; a description generated in seconds may introduce errors that are difficult to detect; an assistant available at any hour may exclude part of the public if it is not accessible or if it presents responses as facts without indicating its limitations.

The survey allows for the conclusion that, within its sample, adoption exceeded formal policies; the majority of user museums relied on external platforms; training and systematic evaluation were less widespread than usage; and economic capacity was associated with significant differences in adoption, governance, and training. It does not demonstrate that the majority of the world's museums use AI, nor does it allow for a representative comparison of regions or types of museum.

The institutional question is not whether the museum should adopt AI as soon as possible or reject it entirely. It is what problem it intends to solve, what evidence would justify the use, what materials and persons are affected, who retains the capacity for decision-making, and what result would necessitate stopping it. Without those answers, the tool may be operational, but it is not yet governed.

About the open conversation

This text separates the report data, the ethical framework, the legal obligations, and my interpretation. It does not constitute legal advice. If you work in a museum or cultural institution and your centre has or is preparing an AI policy, you may clarify a point or discuss this reading via the contact page.

The author's relationship to the cases

I have submitted an article proposal to a call from Museum International, published by ICOM, regarding artificial intelligence in museums. I have no financial or professional relationship with UNESCO or ICOM.

Museums and artificial intelligence: use is advancing faster than governance