Current position
Overview
AI legislation has been enacted.
Key legislation & sources
EU AI Act (Regulation 2024/1689)
Rijksinspectie Digitale Infrastructuur (RDI)
EU AI Act National Implementation Tracker
Dutch AI Coalition (NL AIC)
Council of Europe Framework Convention on AI (CETS 225)
EU AI ACT
The EU AI Act (Regulation 2024/1689) applies directly across all member states. Prohibitions on unacceptable-risk AI systems have been in force since 2 February 2025; GPAI model rules since 2 August 2025. High-risk AI obligations are due from 2 August 2026, subject to the Digital Omnibus proposal which may defer enforcement. For the full implementation timeline, governance structure, and current status, see the European Union overview.
The Rijksdienst voor Digitale Infrastructuur (RDI) has been designated as market surveillance authority. The Dutch Data Protection Authority (AP) is active on AI and data governance. The Netherlands is among the more advanced member states on implementation readiness.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
closure
Data Protection Authority concluded inquiry into use of algorithms and AI by debt collection agencies finding insufficient safeguards and recommending meaningful human intervention and greater transparency towards debtors
Source: Digital Policy Alert · View update ↗
consultation closed
Data Protection Authority closes consultation on guidance addressing the right to explanation in automated decision-making under General Data Protection Regulation
Source: Digital Policy Alert · View update ↗
ruling
Amsterdam Court of Appeal ordered X to disclose user data and clarified access rights in automated moderation decisions
Source: Digital Policy Alert · View update ↗
On 14 April 2026, the Amsterdam Court of Appeal ordered X to provide a user with extensive access to their personal data under the General Data Protection Regulation, following an appeal concerning a temporary, automated account restriction that reduced the user’s visibility. The judgment clarifies the obligations of social media platforms and other platform intermediaries that process personal data and deploy automated decision-making systems. The Court held that internal system records, including moderation labels, advertising suitability classifications, spam and authenticity indicators, and account security logs, constitute personal data and must be disclosed, as they affect user visibility and treatment on the platform. It rejected X’s argument that these records are protected trade secrets, finding that such claims require a proportional balancing test and cannot justify a broad refusal of access, particularly where the data subject seeks to verify lawfulness and challenge automated decisions. The Court permitted only narrow redactions for employee identities and precise timestamps, while requiring disclosure of all other relevant data, including links between actions and specific posts. The judgment confirms that automated content moderation decisions fall within transparency and access obligations under the General Data Protection Regulation and upheld uncapped penalty payments to ensure compliance.
interim ruling
Authority for Consumers and Markets' reported findings on digital accessibility
Source: Digital Policy Alert · View update ↗
On 24 March 2026, the Authority for Consumers and Markets reported findings from inspections under the European Accessibility Act, highlighting that 61% of the largest Dutch online stores are not digitally accessible. The Act applies to e-commerce and digital service providers, particularly companies with at least 10 employees or an annual turnover exceeding EUR 2 million. The findings indicate that many websites prevent users with disabilities, including those using assistive technologies, from completing purchases, with issues including inaccessible buttons and Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) systems. It was also stated that the ACM has identified areas for improvement and cautioned that companies failing to address shortcomings risk enforcement action. The Act seeks to enforce obligations to ensure accessibility of digital services and encourages companies to implement technical and design changes.
closure
Data Protection Authority adopted report on systemic risks and discriminatory use of artificial intelligence and algorithmic systems
Source: Digital Policy Alert · View update ↗
On 5 March 2026, the Data Protection Authority published a report on AI algorithms addressing algorithmic governance, systemic risks, and the use of AI in recruitment and selection in the Netherlands. The report applies to providers and deployers of AI systems, employers, online job platforms, and public sector organisations, with reference to high-risk AI systems under the EU AI Act. It describes the use of AI across recruitment stages, including job posting, candidate matching, CV screening, and candidate assessment, and notes that risks related to bias may arise across these stages. It also reports differences in the level of information provided to employers and candidates in assessment tools, with reference to requirements under the General Data Protection Regulation and transparency-related provisions under the AI Act. The report refers to expectations for providers regarding AI Act requirements on accuracy, non-discrimination, and explainability, and notes that employers should assess the use of such tools and ensure AI literacy among personnel. It further identifies observations related to algorithm registration by public bodies, public sector use of AI systems, protections for children in AI applications, and risks associated with agentic AI. It also outlines planned work on Digital Services Act transparency compliance for job platforms and ongoing guidance on AI Act implementation.
Showing 5 of 18 available API entries. Dates and summaries are supplied by Digital Policy Alert.