Detailed overview
The Netherlands is regulated by the EU AI Act. Dutch businesses that provide, import, distribute or professionally use AI systems must apply the EU AI Act classification model and comply with the relevant obligations for prohibited AI, high-risk AI, transparency-risk AI and general-purpose AI.
National framework
The Netherlands does not currently have a separate horizontal AI Act equivalent to the EU AI Act. Its national AI framework is important mainly for public-sector algorithm transparency, GDPR-based AI supervision and preparation for EU AI Act enforcement.
Government Algorithm Register
The Dutch Government maintains an Algorithm Register. The register is intended to make government algorithms discoverable, explainable and understandable. It provides insight into where and how public authorities use algorithms and AI. The Dutch Government states that the register is not yet complete and that providing information about algorithms is not yet mandatory for all government organisations, although a legal transparency obligation is being prepared.
AI supervision
The Dutch Data Protection Authority, Autoriteit Persoonsgegevens, has a coordinating role in supervision of algorithms and AI that involve risks to fundamental values. It is particularly relevant where AI systems process personal data, are used for profiling, affect access to public services, or create risks of discrimination, lack of transparency or unfair automated decision-making.
Data protection
Where AI processes personal data, the GDPR applies. This means that organisations must have a lawful basis for processing, provide transparency, respect data minimisation and storage limitation, maintain security, respect rights of individuals and apply safeguards for automated decisions where required. AI systems involving profiling, sensitive data, large-scale monitoring or significant effects on individuals may require a data-protection impact assessment.
Penalties
Penalties depend on the breached framework. EU AI Act fines apply to AI Act breaches. GDPR sanctions apply to unlawful personal-data processing. The Dutch Algorithm Register is currently a transparency mechanism rather than a complete mandatory registration regime for every government algorithm, but future Dutch rules may make algorithm registration more formal.