Netherlands AI Regulation & Governance

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, is a directly applicable regulation that entered into force on 1 August 2024, taking direct effect in the Netherlands as an EU Member State, with staged application through 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026, following publication in the Official Journal on 24 July 2026, and amends the AI Act's application timetable. Under that amendment, the AI Act's Annex III high-risk-system obligations are deferred to 2 December 2027 and its Annex I obligations to 2 August 2028. Reporting on the restructuring indicates that the AI Act's application is now phased by chapter, keyed to those Annex III and Annex I dates. Implementing the Regulation domestically, the Dutch Uitvoeringswet AI-verordening was opened for public internet consultation on 20 April 2026 and remains at the advisory stage before the Raad van State, not yet introduced to the Tweede Kamer.

Article 5(1) of Regulation (EU) 2024/1689, in force since 2 February 2025, prohibits a defined list of AI practices, including subliminal manipulation, social scoring, and real-time remote biometric identification in public spaces. Breach of this prohibition carries a maximum administrative fine of EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher (CLM-NL-e1f2a311; CLM-NL-f00c208f). The Digital Omnibus on AI, Regulation (EU) 2026/1744, adds new prohibitions covering the generation of non-consensual intimate imagery and CSAM-category material, applying from 2 December 2026. Under the draft Dutch Uitvoeringswet AI-verordening, article 2.2(1)(b) would designate the Autoriteit Persoonsgegevens, the Autoriteit Financiële Markten and De Nederlandsche Bank as market-surveillance authorities for AI Act Chapter II, covering prohibited practices, though this designation is not yet in force.

Providers of high-risk AI systems under Regulation (EU) 2024/1689 must complete conformity assessment, maintain technical documentation and logging, issue a declaration of conformity, affix CE marking, and register the system before placing it on the market. Following the Digital Omnibus's deferral of the AI Act's timetable, AI systems within the Annex III use-case areas become presumptively high-risk from 2 December 2027, subject to the Article 6(3) derogation for systems performing narrow, procedural tasks that do not materially influence the outcome of decision-making. The Autoriteit Persoonsgegevens is proposed, though not yet formally designated, as the lead market-surveillance authority for most Annex III high-risk systems, pending adoption of the draft Uitvoeringswet AI-verordening.

Under Article 53(1)(a)-(d) of Regulation (EU) 2024/1689, providers of general-purpose AI models must maintain technical documentation, supply information to downstream providers, operate a copyright-compliance policy, and publish a summary of training content; this obligation has applied since 2 August 2025. A general-purpose AI model is presumed, under the rebuttable presumption in Article 51, to carry systemic risk where its cumulative training compute exceeds 10^25 floating-point operations.

Since 2 August 2026, Regulation (EU) 2024/1689 has required disclosure of AI interaction to natural persons, machine-readable marking of synthetic content, disclosure of the use of emotion-recognition or biometric-categorisation systems, and disclosure of deepfakes and of AI-generated text published on matters of public interest, subject to exceptions for artistic and editorial works.

Under article 15o of the Auteurswet (Dutch Copyright Act), in force since 7 June 2021, a reproduction made for text-and-data mining -- covering the training of AI models -- is not an infringement of copyright where the person carrying out the mining has lawful access to the work and the rightholder has not expressly reserved that right.

Under the Wet op de ondernemingsraden (Dutch Works Councils Act), an employer that deploys an AI system processing employee personal data, or monitoring attendance, behaviour or performance, requires the works council's consent; a decision taken without that consent is voidable within one month of a nullity invocation by the works council. The Dutch national Algoritmeregister requires government organisations to describe impactful algorithms, but as of October 2026 this remains a non-statutory requirement even for the public sector. The Autoriteit Persoonsgegevens is proposed, though not yet formally designated, as the lead market-surveillance authority for AI Act prohibited practices and most Annex III high-risk systems relevant to public-sector deployment, pending the draft Uitvoeringswet AI-verordening.

Providers of high-risk AI systems under Regulation (EU) 2024/1689 must complete conformity assessment, documentation, logging, declaration of conformity, CE marking and registration before placing the system on the market. A provider of a high-risk AI system must report a serious incident to the relevant national market-surveillance authority not later than 15 days after becoming aware of it. Where the serious incident involves a widespread infringement or a disruption of critical infrastructure, the reporting deadline shortens to not later than two days after the provider becomes aware.

High-risk AI systems under Regulation (EU) 2024/1689 follow the Annex VI internal-control conformity assessment procedure by default, unless they are product-linked systems eligible for sectoral third-party conformity assessment procedures. Compliance with published harmonised standards gives high-risk AI system providers a presumption of conformity with the requirements that those standards cover.

Breach of the AI Act's Article 5 prohibited-practices provision carries a maximum administrative fine of EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher (CLM-NL-e1f2a311; CLM-NL-f00c208f). Article 99(6) of the AI Act, as amended by the Digital Omnibus, gives small and medium-sized enterprises, start-ups and small mid-caps a proportionality adjustment that reduces the applicable penalty ceiling relative to their own turnover (CLM-NL-5bae9927; CLM-NL-817d9b19). In an enforcement action dated 12 November 2024, the Autoriteit Persoonsgegevens found that DUO's decade-long risk-profiling algorithm used for student-grant fraud detection indirectly discriminated against students with a migration background. On 8 October 2026 the Autoriteit Persoonsgegevens established a new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA), succeeding its former Directie Coördinatie Algoritmes. The Autoriteit Persoonsgegevens is the intended AI Act market-surveillance authority alongside the Rijksinspectie Digitale Infrastructuur, but it has not yet been formally designated because the Dutch implementing act remains in preparation (CLM-NL-008c752d; CLM-NL-8cf9d0d2). The Dutch Uitvoeringswet AI-verordening, which would complete that designation, was opened for public internet consultation on 20 April 2026 and remains at the advisory stage before the Raad van State, not yet introduced to the Tweede Kamer. The consultation itself closed on 1 June 2026, and the bill has not yet been submitted to the Tweede Kamer. Draft article 2.2(1)(b) of that bill would designate the Autoriteit Persoonsgegevens, the Autoriteit Financiële Markten and De Nederlandsche Bank as market-surveillance authorities for AI Act Chapter II, covering prohibited practices, and the Autoriteit Persoonsgegevens is further proposed as lead market-surveillance authority for most Annex III high-risk systems, pending that same bill.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and defers the AI Act's Annex III high-risk obligations to 2 December 2027 and its Annex I obligations to 2 August 2028. Separately, the Dutch government has been developing an AI Compute Plan during the first half of 2026 and is considering a national AI regulatory sandbox, neither of which was operational as. The draft Uitvoeringswet AI-verordening would require the Netherlands' market-surveillance authorities, with the Rijksinspectie Digitale Infrastructuur facilitating, to jointly establish an AI regulatory sandbox under Articles 57-63 of the AI Act, though the bill has not yet been enacted.

In September 2025, ASML announced that it would lead Mistral AI's Series C funding round, investing EUR 1.3 billion.