AI Chatbots in Your Dutch Business: What the EU AI Act and the AVG Require

Last updated: 22 October 2026. The EU is still adjusting parts of the AI Act timetable, so check the European Commission pages in the sources before you rely on a date. This is general information, not legal advice.

If your business in the Netherlands uses an AI chatbot, automates customer replies or lets staff use tools such as ChatGPT, two sets of rules apply: the EU AI Act and the AVG, the Dutch name for the GDPR. The AI Act’s new transparency rules for chatbots started to apply on 2 August 2026, and the AVG applies whenever personal data is involved. This guide explains what each requires in plain language, which dates matter, and what a small business can do now.

1. The rules at a glance

The Commission states that the majority of AI systems can be developed and used under existing legislation without additional legal obligations. The strict high-risk rules cover areas such as biometrics, education, employment and migration, and they apply from 2 December 2027.

2. What the EU AI Act asks of businesses that use chatbots

Chatbot disclosure. The Commission describes the new rule as requiring certain AI systems to tell users when they are interacting with AI. In its AI Act FAQ, the Commission places this duty on providers: the AI systems that interact with people must be designed so that users are informed they are talking to an AI. If you buy a ready-made chatbot, the vendor carries most of that design duty, but you decide how it appears on your website, so make the notice visible. If you build or rebrand a system yourself, you may count as a provider. Whether you are a provider or a deployer depends on your case; the AI Act Service Desk offers a Compliance Checker for this.

Deepfakes and AI-generated content. AI-generated images, video or audio that look real must be labelled as such, and AI-generated or altered content must carry machine-readable marks so it can be detected. Providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking requirement (Article 50(2)). The Commission also published a first list of more than 180 organisations that signed its Code of Practice on the transparency of AI-generated content, which it describes as a practical way to show compliance.

AI literacy. Organisations that use AI must make sure their staff have enough understanding of it. The Commission’s FAQ says the provisions on AI literacy have applied since 2 February 2025 and points to a repository of practices. The Dutch Autoriteit Persoonsgegevens (AP) says the law does not prescribe exact measures, advises a multi-year action plan and recommends keeping documentation of your approach and progress.

Prohibited practices. A short list of AI uses is banned outright, and a new ban on AI systems that generate non-consensual sexual deepfakes and child sexual abuse material applies from 2 December 2026. The Commission has published guidelines on prohibited AI practices; read them if you plan to use AI for anything beyond customer questions and internal drafting.

3. Key dates

Dates according to the AI Act Service Desk of the European Commission:

The Commission’s FAQ says the Digital Omnibus entered into force on 27 July 2026 and moved the high-risk dates to 2 December 2027 and 2 August 2028. Dates can still change, so check the Commission pages before planning around them.

4. What the AVG (GDPR) adds

The AI Act does not replace the AVG. Whenever a chatbot or an AI tool processes personal data, such as names, email addresses or customer messages, the AVG applies in addition. Three provisions of the GDPR matter most for businesses using AI tools:

• Processor agreement (Article 28). If an AI vendor processes personal data on your behalf, you may only use processors that give sufficient guarantees, and the processing must be governed by a binding written contract. The contract must cover processing only on your documented instructions, confidentiality, deletion or return of the data and audits, and sub-processors need your prior written authorisation.
• Automated decisions (Article 22). People have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects. There are exceptions, for example when it is necessary for a contract or based on explicit consent, but you must then provide safeguards such as human intervention and the chance to contest the decision. A chatbot that answers opening-hour questions is a different matter from an AI that approves or rejects applications.
• Impact assessment (Article 35). A data protection impact assessment is required before processing that is likely to result in a high risk to people’s rights, particularly with new technologies, and it is mandatory for systematic, extensive profiling with significant effects.

The AP has also warned that employees who enter personal data, such as patient data, into AI chatbots can cause data breaches, and advises organisations to agree clear rules on which data may and may not be entered and to check with the provider whether data is stored.

5. Who supervises and what is at stake

According to the Commission, the AI Office enforces the rules for general-purpose AI models, while national competent authorities enforce them for other AI systems; enforcement powers apply from 2 August 2026. For prohibited practices the Commission states fines of up to €35 million or 7 percent of worldwide annual turnover, whichever is higher. Its enforcement page does not list a separate fine for the chatbot transparency rule, so check the national penalty rules that Member States adopt. In the Netherlands the AP supervises the processing of personal data and also publishes guidance on algorithms and AI. The AP and the consumer authority ACM have called on companies to be transparent that a customer is talking to a chatbot and to always give people the option to speak to a staff member.

6. A practical checklist

1. List your AI tools. Write down every chatbot, assistant and automation your business and staff use, and what data goes into them.
2. Say it is AI. Put a clear notice at the start of every chatbot conversation, for example “You are chatting with an AI assistant”.
3. Keep a human reachable. Offer an easy way to reach a staff member, and let people correct wrong answers.
4. Train your staff. Give a short introduction to what the tools can and cannot do, and keep a record of it to show your approach to AI literacy.
5. Protect personal data. Set a rule on what staff may paste into AI tools, sign a processor agreement with the vendor and check where data is stored.
6. Check automated decisions. If AI decides about people (credit, hiring, access), involve a human and consider an impact assessment.
7. Label AI-generated media. Mark realistic AI images, audio and video as AI-generated.
8. Review twice a year. Rules and dates are still moving, so set a reminder to check the Commission and AP pages.

7. Questions to ask an AI vendor

Whether you buy a chatbot from a large platform, a Dutch software company or an agency that builds automations for you, ask the same questions before you sign:

1. Does the chatbot tell users they are talking to AI by default, and can we customise the wording?
2. Where is the data processed and stored, and is it used to train the vendor’s models?
3. Will you sign a processor agreement that meets Article 28 of the GDPR, and who are your sub-processors?
4. Can a customer reach a human at any point, and how do we correct a wrong answer?
5. How do you support AI literacy and documentation, and what do you do when the rules or dates change?

For transparency: the Amsterdam studio NyxWorks, which also runs this website, offers AI automation for small businesses and publishes its prices upfront. It is one option among many, and the five questions above apply to every provider, including NyxWorks. To see how this fits a wider business plan, read our guide to starting a business in the Netherlands, and for the supervisory side of the AI Act see our report on the Dutch AI Act oversight.

8. FAQ

Do small businesses have to comply with the AI Act?

The AI literacy provisions and the transparency rules apply to the organisations they cover, regardless of size, but the Commission says the AI Act foresees simplified compliance pathways for SMEs for certain obligations, such as technical documentation, and that most AI systems can be used under existing legislation without additional obligations. Use the Commission’s Compliance Checker to see where you stand.

Do I have to tell customers that a chatbot is AI?

Yes. Since 2 August 2026 chatbots and other interactive AI systems must tell users they are dealing with AI rather than a human, according to the Commission. A clear notice at the start of the chat is the simplest way to show it.

Does the AVG apply to a chatbot on my website?

It does when the chatbot processes personal data, for example names, contact details or the content of customer messages. Then you need a lawful basis, information for the people involved and, with an external vendor, a processor agreement.

Is my chatbot “high-risk”?

Not by default. High-risk rules cover specific areas such as employment, education, biometrics and migration and apply from 2 December 2027, so an AI used to screen job applicants needs much closer attention than a chatbot that answers opening-hour questions.

Where can I check the latest dates?

On the European Commission’s AI Act Service Desk timeline and the Commission’s AI Act pages, linked below.

🇳🇱 Dutch Corner

Sources

• European Commission, 31 July 2026: Commission starts enforcing AI Act rules and new transparency requirements on 2 August (chatbot disclosure, deepfake labelling, machine-readable marking, Code of Practice)
• AI Act Service Desk: Timeline for the implementation of the EU AI Act (all dates in the table, including 2 December 2026 and 2 December 2027)
• European Commission: Navigating the AI Act (FAQ) (providers and chatbot disclosure, AI literacy since 2 February 2025, SMEs, Digital Omnibus)
• European Commission: The enforcement framework of the AI Act (who enforces, fines for prohibited practices)
• EUR-Lex: Regulation (EU) 2016/679 (GDPR) (Articles 22, 28 and 35)
• Autoriteit Persoonsgegevens: AI literacy (multi-year action plan, documentation)
• Autoriteit Persoonsgegevens: Oproep ACM & AP over AI-chatbots (transparency about chatbots, human contact)
• Autoriteit Persoonsgegevens: Caution: use of AI chatbot may lead to data breaches (personal data entered into chatbots)

Netherlands2027Money ChecklistFREE PDF

Free for our readers

Free: Netherlands 2027 Money Checklist

Every deadline and number you need before and after 1 January 2027, on two printable pages. Confirm your email and the PDF is yours; we will also email you when the 2027 figures are confirmed.

Email address*

First name (optional)

I agree to receive the newsletter of The Dutch Daily. We use Brevo to send it; your email address is only used for this newsletter and you can unsubscribe at any time. See our Privacy Policy.

Part of our guide Taxes, Salary & Money →

Read nextBusiness & FinanceSole Proprietorship or BV in the Netherlands: Which Legal Form Fits You?

Living in NLPHP Vulnerabilities Force Dutch and European Government Websites OfflineLiving in NLSchool Holidays Netherlands 2026-2027: Dates by Region and What Parents Should KnowBusiness & FinanceBank Account Netherlands: Your Right to a Basic Account and What to Do If a Bank Says No

Free tools€Net salary calculator2027Free 2027 money checklistNLLearn Dutch with games