AI Regulation in Netherlands: 2026 Update

AI regulation in the Netherlands is shaped primarily by the EU AI Act, the first comprehensive binding legal framework for artificial intelligence in the world, combined with existing Dutch and European data protection, product liability and sector-specific rules. For businesses operating in or from the Netherlands, compliance is no longer optional: obligations are phased in progressively, and Dutch supervisory authorities are actively building enforcement capacity. This guide covers the current regulatory landscape, the key obligations by risk tier, the role of Dutch national authorities, recent developments and what companies should do to stay compliant.

The EU AI Act is a directly applicable EU regulation, meaning it applies in the Netherlands without requiring separate national transposition. It classifies AI systems into four risk categories - unacceptable risk, high risk, limited risk and minimal risk - and attaches different obligations to each. The regulation covers providers, deployers, importers and distributors of AI systems, so Dutch companies at any point in the AI supply chain must assess their position.

Unacceptable-risk AI systems are prohibited outright. These include social scoring by public authorities, real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions), AI that exploits psychological vulnerabilities and systems that manipulate behaviour subliminally. Any Dutch company or public body using such systems must cease operations in this category.

High-risk AI systems face the most demanding obligations. The Act defines high-risk systems by reference to Annex III, which covers areas such as critical infrastructure, education, employment, essential private and public services, law enforcement, migration management and administration of justice. Dutch companies deploying AI in recruitment, credit scoring, medical devices or public benefit allocation are likely operating high-risk systems and must comply with requirements covering data governance, technical documentation, transparency, human oversight, accuracy and robustness.

Limited-risk systems - such as chatbots and deepfake generators - face transparency obligations. Users must be informed they are interacting with an AI. Minimal-risk systems, such as spam filters or AI-powered video games, carry no specific obligations under the Act, though general law still applies.

The Netherlands has designated the Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, as one of the national competent authorities for AI Act enforcement, particularly where AI systems process personal data. The AP already has significant enforcement experience under the General Data Protection Regulation (GDPR) and has publicly committed to integrating AI oversight into its supervisory programme.

In addition, the Netherlands has established a broader national AI supervisory structure. The Dutch government has indicated that sector-specific regulators will retain authority over AI in their domains. The Autoriteit Financiële Markten (AFM) and De Nederlandsche Bank (DNB) supervise AI use in financial services. The Inspectie Gezondheidszorg en Jeugd (IGJ) covers AI in healthcare. The Autoriteit Consument en Markt (ACM) has a role where AI intersects with competition and consumer protection.

The AI Office, established at EU level within the European Commission, holds authority over general-purpose AI (GPAI) models. Dutch providers or deployers of GPAI models - including large language models - must engage with both the AI Office and, where data processing is involved, the AP.

A non-obvious requirement for many Dutch businesses is that the national market surveillance authority for product safety also plays a role. Where an AI system is embedded in a product covered by existing EU harmonisation legislation - such as machinery, medical devices or radio equipment - the relevant product safety authority becomes the competent body for AI Act compliance in that product context.

The EU AI Act entered into force in the summer of a recent year, and its obligations apply in phases. The prohibition on unacceptable-risk AI systems became applicable first, followed by obligations for GPAI model providers. High-risk AI system requirements under Annex III are applying progressively, with the full framework for most high-risk systems now in effect or entering effect in the near term.

For Dutch businesses, the practical consequence is that the window for preparation has largely closed for the earlier phases. Companies that have not yet conducted an AI inventory and risk classification exercise are already behind. Those deploying high-risk systems must have conformity assessments, technical documentation and quality management systems in place or be actively implementing them.

The AI Act also introduces obligations for notified bodies - independent third-party conformity assessment organisations. The Netherlands has a well-developed notified body infrastructure from its experience with medical devices and machinery regulation, and Dutch notified bodies are being designated for AI Act purposes. This matters for high-risk AI providers who require third-party conformity assessment rather than self-assessment.

In practice, founders and compliance officers should consider the phased timeline not as a series of distant deadlines but as a rolling obligation. Each phase that passes without compliance increases legal exposure, particularly as Dutch supervisory authorities have signalled active enforcement intent.

General-purpose AI models - AI systems trained on broad data that can perform a wide range of tasks - face a distinct set of obligations under the AI Act. Dutch companies that develop, fine-tune or deploy GPAI models must comply with transparency requirements, including publishing technical documentation and summaries of training data used.

GPAI models with systemic risk, defined by reference to training compute thresholds set by the European Commission, face additional obligations. These include adversarial testing, incident reporting to the AI Office and cybersecurity measures. Dutch AI developers working with frontier models must assess whether their systems cross these thresholds and engage with the AI Office';s model evaluation processes.

A common mistake among Dutch AI startups is assuming that because they are deployers rather than developers of a GPAI model, they bear no obligations. In reality, deployers who modify a GPAI model or integrate it into a product in a way that changes its intended purpose may be reclassified as providers under the Act, triggering the full provider obligation set.

The AI Office has published codes of practice for GPAI model providers, and participation in these codes is encouraged as a means of demonstrating compliance. Dutch companies should monitor the AI Office';s guidance closely, as it is the primary source of interpretive authority for GPAI obligations.

If your business develops or deploys AI models and you are uncertain about your classification under the Act, contact info@vlolawfirm.com. We can help structure the compliance assessment correctly the first time.

The GDPR remains fully applicable alongside the AI Act and is not displaced by it. In the Netherlands, the AP enforces the GDPR and has made clear that AI systems processing personal data must comply with both frameworks simultaneously. This creates a layered compliance obligation that many businesses underestimate.

Key GDPR obligations relevant to AI in the Netherlands include the requirement to conduct a Data Protection Impact Assessment (DPIA) for high-risk processing, which frequently overlaps with high-risk AI systems under the Act. Automated decision-making under Article 22 GDPR - decisions based solely on automated processing that produce legal or similarly significant effects - requires specific safeguards including the right to human review, explanation and challenge.

The AP has published guidance on AI and GDPR, and has investigated several Dutch organisations for GDPR violations arising from algorithmic decision-making. The AP';s enforcement record demonstrates that fines in this area are real and material, not theoretical.

A practical scenario: a Dutch insurer uses an AI system to assess claims and automatically reject those below a confidence threshold. This system likely qualifies as both a high-risk AI system under the Act and as automated decision-making under GDPR Article 22. The insurer must comply with both frameworks - maintaining technical documentation and human oversight under the Act, and providing explanation and review rights under GDPR.

A second scenario: a Dutch HR technology company provides an AI-powered recruitment screening tool to employers across the EU. As the provider of a high-risk AI system under Annex III (employment category), the company must conduct a conformity assessment, maintain a quality management system, register the system in the EU database for high-risk AI systems and provide deployers with adequate instructions for use. Failure to do so exposes the company to enforcement by the AP and potentially by supervisory authorities in other member states where the tool is deployed.

Beyond the horizontal AI Act framework, Dutch businesses must navigate sector-specific AI rules that apply in parallel. These rules often impose stricter or more detailed requirements than the AI Act baseline.

In financial services, the AFM and DNB have issued guidance on the use of AI in credit decisions, fraud detection and algorithmic trading. Dutch financial institutions using AI in these contexts must comply with existing conduct-of-business rules, model risk management expectations and explainability requirements, in addition to AI Act obligations. The DNB has specifically addressed the use of AI in prudential risk models and expects institutions to document model assumptions, validate outputs and maintain human oversight.

In healthcare, the IGJ supervises AI-based medical devices, which are also regulated as medical devices under the EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR). Dutch medtech companies face a dual compliance burden: AI Act requirements for high-risk AI systems and MDR/IVDR requirements for the device itself. Conformity assessment under both frameworks must be coordinated, and notified body engagement is typically required.

In the public sector, Dutch government bodies using AI in administrative decisions - such as benefit allocation, tax assessment or permit processing - face obligations under both the AI Act and the Dutch General Administrative Law Act (Algemene wet bestuursrecht, Awb). The Awb requires that administrative decisions be motivated, proportionate and subject to appeal. AI-assisted decisions must meet these standards, and Dutch courts have already scrutinised algorithmic decision-making by public bodies.

Many underestimate the interaction between sector-specific rules and the AI Act. A Dutch company that achieves AI Act conformity for a high-risk system is not automatically compliant with sector-specific requirements. Both layers must be addressed independently and then reconciled.

Dutch businesses at any stage of AI development or deployment should take a structured approach to compliance. The following steps reflect current regulatory expectations and enforcement priorities.

• Conduct an AI inventory: identify all AI systems in use or under development, classify them by risk tier under the Act and map applicable sector-specific rules.
• Assess provider or deployer status: determine whether your company is a provider, deployer, importer or distributor for each system, as obligations differ significantly.
• Implement technical documentation and quality management: for high-risk systems, prepare the documentation required under the Act and establish a quality management system covering data governance, testing, monitoring and incident response.
• Register high-risk systems: providers and deployers of certain high-risk AI systems must register in the EU database maintained by the AI Office. Dutch companies should verify registration obligations for each system.
• Train staff: human oversight requirements under the Act are not met by policy alone. Staff who interact with or oversee AI systems must be trained to understand system limitations and to intervene when necessary.
• Engage with supervisory authorities: the AP and sector-specific regulators in the Netherlands have published guidance and are open to engagement. Proactive dialogue reduces enforcement risk.

A common mistake is treating AI compliance as a one-time project rather than an ongoing programme. The AI Act requires continuous monitoring of high-risk systems post-deployment, including logging, performance review and incident reporting. Dutch companies should build these obligations into operational processes rather than treating them as a legal exercise.

What penalties apply for non-compliance with AI regulation in the Netherlands?

The EU AI Act sets maximum fines at the EU level, with the highest penalties applying to prohibited AI practices and violations of GPAI obligations. Fines are calculated as a percentage of global annual turnover, making them potentially very large for multinational groups. Dutch supervisory authorities - primarily the AP for data-related AI violations - have the power to impose these fines directly. In addition, GDPR violations arising from AI use carry their own separate penalty regime. Dutch courts may also award damages to individuals harmed by non-compliant AI systems under civil law. The combined exposure from multiple enforcement regimes is a material business risk that boards should assess explicitly.

How long does it take to achieve compliance for a high-risk AI system in the Netherlands?

The timeline depends heavily on the complexity of the system, the maturity of existing documentation and whether third-party conformity assessment is required. For a well-documented system with an established quality management process, compliance preparation typically takes several months. For a system built without compliance in mind, the process can take considerably longer and may require significant technical remediation. Engaging a notified body adds further time, as notified bodies in the Netherlands and across the EU are currently managing high demand. Companies should not underestimate the lead time and should begin preparation well before any applicable deadline.

Does the AI Act apply to Dutch companies using AI tools developed by non-EU providers?

Yes. The AI Act applies to AI systems placed on the EU market or put into service in the EU, regardless of where the provider is established. A Dutch company deploying an AI system developed by a US or Asian provider is acting as a deployer under the Act and must comply with deployer obligations. These include conducting due diligence on the provider';s compliance, ensuring the system is used within its intended purpose, implementing human oversight and reporting serious incidents. If the non-EU provider has no EU representative, the Dutch deployer may face additional obligations. This is a frequently overlooked compliance gap for companies relying on third-party AI tools.

AI regulation in the Netherlands is a live and evolving compliance challenge. The EU AI Act is now in force, Dutch supervisory authorities are active, and the intersection with GDPR and sector-specific rules creates a layered obligation set that requires structured management. Businesses that act now - by classifying their AI systems, implementing required documentation and engaging with regulators - are best positioned to avoid enforcement and build durable AI governance.

VLO Law Firms advises international clients on AI regulation in the Netherlands. We can assist with AI system classification, compliance programme design, GPAI model obligations, GDPR intersection analysis and engagement with Dutch supervisory authorities. To request a consultation, contact: info@vlolawfirm.com