The Dutch AI Act in 2026: Netherlands AI Oversight, Compliance & EU Rules Explained

Who Oversees AI in the Netherlands?

The EU AI Act requires Member States to establish national structures for enforcement and supervision. In the Netherlands, there is not one single independent “Dutch AI Oversight Office” responsible for every AI system.

The Rijksinspectie Digitale Infrastructuur (RDI) and the Autoriteit Persoonsgegevens (AP) have coordinating roles in Dutch AI supervision. Other sector-specific regulators can also remain involved depending on the sector and the AI application.

The RDI’s role includes digital infrastructure and market-surveillance responsibilities, while the AP brings expertise in personal data and fundamental rights. The Dutch approach is therefore based on cooperation between authorities rather than a single AI regulator replacing all existing regulators.

The Dutch government is also developing the national implementation framework needed to give the AI Act effect in Dutch supervision and enforcement.

Key responsibilities can include:

• Supervision and enforcement: Authorities can investigate whether organisations comply with applicable AI Act obligations.
• Risk and fundamental-rights protection: AI systems that can affect safety or fundamental rights can face substantially stricter requirements.
• Coordination: RDI and AP help coordinate expertise and cooperation with other Dutch supervisory authorities.
• Innovation support: Regulatory sandboxes and other controlled testing environments can help organisations understand regulatory requirements while developing new AI systems.

The 2026–2028 AI Act Timeline

The EU AI Act entered into force on 1 August 2024. However, its rules do not all apply at the same time. The implementation schedule is staggered.

2 February 2025 — Prohibited AI & AI Literacy

The prohibitions on certain unacceptable AI practices and the AI-literacy provisions began applying from 2 February 2025.

2 August 2025 — GPAI & Governance

Governance provisions and obligations concerning general-purpose AI (GPAI) became applicable from 2 August 2025.

2 August 2026 — Major AI Act Application Date

From 2 August 2026, the AI Act becomes broadly applicable and the European Commission’s AI Office and national authorities begin enforcing the applicable provisions.

Important transparency rules also start applying. For example, certain interactive AI systems must inform users that they are interacting with AI, while certain AI-generated or manipulated content, including deepfakes, must be appropriately disclosed or labelled.

2 December 2027 — Many High-Risk AI Rules

This is the date businesses need to pay particular attention to.

Following the 2026 AI Omnibus changes, rules for high-risk AI systems used in certain sensitive areas — including employment, education, biometrics, critical infrastructure, migration, asylum and border control — apply from 2 December 2027.

This means it is incorrect to describe August 2026 as the universal deadline for all high-risk AI compliance.

2 August 2028 — High-Risk AI Embedded in Regulated Products

High-risk AI systems embedded in regulated products covered by Annex I have an extended application date of 2 August 2028.

The 4 Risk Categories of the EU AI Act

The AI Act uses a risk-based regulatory structure. The higher the potential impact on safety, health or fundamental rights, the stricter the obligations.

1. Unacceptable Risk — Prohibited

Certain AI practices are prohibited because they create unacceptable risks to people or fundamental rights.

Examples can include:

• Certain social-scoring systems.
• Certain AI systems designed to manipulate people or exploit vulnerabilities.
• Certain prohibited biometric categorisation practices.
• Certain prohibited predictive-policing applications.

The prohibition rules have applied since February 2025, subject to the specific provisions and exceptions in the AI Act.

2. High Risk — Strictly Regulated

High-risk AI systems are not automatically banned. Instead, they must satisfy extensive requirements when the relevant provisions apply.

Examples include certain AI systems used for:

• Employment and HR: certain systems used for recruitment, selection, worker management or evaluation.
• Education: certain systems used for assessment, admission or educational decision-making.
• Essential services: certain systems affecting access to essential services such as credit or public benefits.
• Biometrics: certain biometric identification or categorisation applications.
• Migration and border control: certain AI applications used by relevant authorities.
• Medical devices: certain AI systems incorporated into regulated products.

Important: not every AI system used in these sectors automatically becomes high-risk. The classification depends on the AI Act’s specific categories and conditions.

3. Limited Risk — Transparency Requirements

Some AI systems are subject primarily to transparency obligations.

Examples include certain chatbots and AI systems interacting directly with people. From August 2026, applicable transparency rules require users to be informed when they are interacting with AI in relevant circumstances.

The AI Act also introduces transparency requirements for certain AI-generated or manipulated content, including deepfakes and certain content of public interest.

4. Minimal or No Risk

The vast majority of AI systems fall into the minimal- or no-risk category.

Examples can include AI-enabled spam filters and many video-game algorithms. The AI Act does not impose the same mandatory requirements on these systems as it does on prohibited or high-risk AI.

Impact on Businesses: Compliance & Conformity

For Dutch companies, developers and organisations using AI, the first step is to determine what kind of AI system they have and what role they play under the AI Act.

1. Inventory Your AI Systems

Companies should identify the AI tools they develop, import, distribute or use internally. This includes recruitment tools, customer-service chatbots, generative AI tools and AI-powered decision systems.

2. Determine the Risk Category

Do not assume that every AI tool is high-risk. Classification should be based on the AI Act’s definitions, prohibited practices, high-risk categories and transparency requirements.

3. Fundamental Rights Impact Assessment

For certain high-risk AI systems, deployers such as public bodies and organisations providing relevant services may have additional obligations, including a Fundamental Rights Impact Assessment (FRIA) where required by the AI Act.

4. Quality Management & Documentation

Providers of applicable high-risk AI systems must meet extensive requirements concerning risk management, data governance, technical documentation, logging, accuracy, robustness, cybersecurity and quality-management processes.

5. Human Oversight

Applicable high-risk AI systems must include appropriate human-oversight measures. The purpose is to allow people responsible for the system to understand, monitor and appropriately intervene in its operation.

6. Conformity Assessment

Some high-risk AI systems are subject to conformity-assessment requirements before being placed on the market or put into service. The exact assessment procedure depends on the category of AI system and the applicable legal framework.

For high-risk AI embedded in regulated products, CE-marking requirements can form part of the applicable conformity framework. It is therefore misleading to describe every high-risk AI system as simply “software that must carry a CE mark.”

AI in the Workplace: What It Means for Employees and Expats

AI is increasingly being used in recruitment, employee management, performance assessment and workplace decision-making.

Certain AI systems used in employment are classified as high-risk under Annex III of the AI Act. However, following the updated EU implementation timetable, the relevant high-risk rules for these systems apply from 2 December 2027, not August 2026.

Employers using AI should therefore use 2026 to identify relevant systems, understand their classification and prepare for the applicable obligations.

Employees and job applicants should also understand that the AI Act does not create a universal right to receive a detailed explanation of every employment decision made with AI.

Other EU and Dutch laws — including employment, equality, data-protection and fundamental-rights rules — can also apply when AI is used in the workplace.

Enforcement & Fines: The Cost of Non-Compliance

The EU AI Act provides significant administrative penalties. The maximum depends on the type of violation and the organisation involved.

• Prohibited AI practices: fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher.
• Other major AI Act violations: fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.
• Incorrect, incomplete or misleading information: fines of up to €7.5 million or 1% of worldwide annual turnover, whichever is higher.

For SMEs and start-ups, the AI Act provides specific proportionality rules. In the relevant cases, the applicable fine is capped at the lower of the specified amount or percentage.

Authorities must also consider the circumstances of the individual case when determining whether to impose a fine and how large it should be.

The maximum figures are therefore legal ceilings, not automatic penalties for every breach.

The Verdict: What Should Dutch Businesses Do Next?

August 2026 is a major milestone for the EU AI Act, but it is not the universal deadline for every high-risk AI system.

Businesses should understand the distinction between:

• Rules already applicable, including prohibited AI practices and AI-literacy requirements.
• Rules applying from 2 August 2026, including the broader AI Act framework and applicable transparency requirements.
• High-risk rules applying from 2 December 2027 for many sensitive Annex III use cases.
• High-risk AI embedded in regulated products from 2 August 2028.

The safest approach is not to wait for the relevant deadline. Companies should inventory their AI systems now, classify them correctly, document how they are used and identify which obligations apply to them.

✅ 2026 AI Compliance Checklist for Businesses

Use this checklist to assess your company’s AI regulatory position.

🇳🇱 Dutch Learning Corner: Tech & Law Edition