Because the Netherlands is an EU member state, the EU AI Act applies in full. The Act sets a risk-tiered framework: a set of prohibited practices, a category of high-risk systems that carry substantial obligations, transparency duties for certain limited-risk uses, and a distinct set of rules for general-purpose AI (GPAI) and foundation models. Its obligations phase in across 2025 – 2027, so where a system sits in that timeline matters as much as where it sits in the risk tiers.
Alongside the AI Act, the GDPR — known locally as the AVG (Algemene Verordening Gegevensbescherming) — governs personal data throughout. It is enforced by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP), which has been notably active on AI and algorithmic accountability. The Dutch government also maintains an algorithm register (algoritmeregister) that records algorithms used by public-sector bodies — part of a wider expectation of transparency around automated decision-making.
The Dutch context carries a cautionary precedent worth taking seriously. In 2020, a Dutch court struck down SyRI, a welfare-fraud risk-scoring system, on human-rights grounds — a landmark ruling in algorithmic accountability and a clear signal that opaque, high-stakes automated decision-making does not survive legal scrutiny here. We design AI systems with EU AI Act risk classification and AVG obligations as first-class inputs: the classification and the data-protection duties shape the architecture, the documentation, and the human-oversight design from the outset, rather than being reconstructed under pressure after a system is already running.