Skip to main content

    AI by country · Western Europe

    AI in the Netherlands: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Netherlands know before starting with AI?

    In the Netherlands, AI that uses personal data falls under the GDPR and the Dutch implementing act, the UAVG, supervised by the Autoriteit Persoonsgegevens (AP). The EU AI Act applies in stages, but the Dutch law that sets up its supervision was still a draft on 29 October 2026. Under that draft, sector supervisors would oversee AI in their own fields, with the AP and the RDI coordinating.

    At a glance

    Netherlands at a glance

    Key facts about Netherlands
    Data protection lawGDPR and the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG), law of 16 May 2018
    RegulatorAutoriteit Persoonsgegevens (AP); Rijksinspectie Digitale Infrastructuur (RDI) is the AI Act contact point, designation pending
    AI policyEU AI Act applies; Dutch implementing law (Uitvoeringswet AI-verordening) still a draft as of 29 October 2026; government-wide vision on generative AI (January 2024)
    Time zoneCET, UTC+1 in winter; CEST, UTC+2 in summer (India is 4.5 or 3.5 hours ahead)
    CurrencyEUR (euro)
    Business languageDutch; English is widely used in business

    Why now

    Why Netherlands is worth watching

    Each point links to the document it comes from.

    • CBS reports that 33% of Dutch companies with 10 or more staff used at least one AI technology in 2025, up from 23% in 2024.[7]

    • By sector, CBS found AI use at 70% in information and communication and 59% in financial services in 2025, against 16% to 21% in hospitality, transport and construction.[7]

    • The government opened consultation on a Dutch AI Act implementing law on 20 April 2026, running to 1 June 2026.[4]

    • The public Algorithm Register, where Dutch government bodies describe the algorithms they use, listed 1,610 algorithms when we checked.[8]

    • The cabinet's January 2024 vision on generative AI set out 6 action lines and supported GPT-NL, an open Dutch language model, with €13.5 million.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    GDPR and the Uitvoeringswet AVG (UAVG)

    In force2018The UAVG is the Dutch law that implements the GDPR. Its article 40 sets out exceptions to the ban on fully automated individual decisions and requires safeguards for the person affected. Its article 46 covers processing of the national identification number, which matters if an AI system handles citizen service numbers.[1]

    EU AI Act, Regulation (EU) 2024/1689, as amended by the AI Omnibus

    Phased2024Banned practices and AI literacy have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and most other rules, such as chatbot transparency, from 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved high-risk rules to 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products.[2]

    Uitvoeringswet AI-verordening (Dutch AI Act implementing law)

    Draft2026The draft keeps existing supervisors in charge of AI in their own domains. The AP would supervise where no clear supervisor exists, with a dedicated AI board member, and the AP and RDI would coordinate. No date for entry into force was given.[4]

    Where AI fits first

    Where AI fits first

    Financial services

    Customer service, document checks and fraud detection, with staff reviewing decisions about customers.

    CBS puts AI use in financial services at 59% of firms in 2025. Under the draft law, existing sector supervisors would oversee AI in their own field.[7]

    Public sector

    Sorting incoming mail, translation and summaries for caseworkers.

    Government bodies publish information on impactful algorithms, including high-risk AI, in the Algorithm Register.[8]

    Recruitment and HR

    Screening applications and drafting job texts, with a recruiter deciding.

    Hiring AI is high-risk under Annex III from 2 December 2027. Fully automated decisions are only allowed under the exceptions in article 40 UAVG and the GDPR.[1]

    IT and business services

    Code assistants, internal search and drafting proposals.

    CBS reports 70% AI use in information and communication and 55% in specialist business services in 2025.[7]

    Your first steps

    Your first steps

    1. List each AI use and sort it into an AI Act risk category: banned, high-risk, transparency or minimal.
    2. Check every automated decision about people against article 40 UAVG and the GDPR, and add human review where needed.
    3. Run a data protection impact assessment before deploying AI that profiles people or uses sensitive data.
    4. Train staff in AI literacy, which the AI Act has required since 2 February 2025.
    5. Tell people when they are talking to a chatbot, as the AI Act requires from August 2026.
    6. If personal data will be accessed from India or another non-EU country, put a GDPR transfer mechanism in place first.
    7. Follow the Uitvoeringswet AI-verordening to learn which supervisor will cover your sector.

    AI services for Netherlands

    AI consulting and development for teams in Netherlands

    We work remotely with companies in Netherlands, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) works 9:30 to 18:30, which is 04:00 to 13:00 UTC. In Dutch winter (UTC+1) that gives about 5 hours of overlap, 09:00 to 14:00 Amsterdam time; in summer (UTC+2) about 6 hours, 09:00 to 15:00. India has no EU adequacy decision, so any personal data we access from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Netherlands

    Who supervises AI in the Netherlands?

    The AP supervises personal data use today. For the AI Act, the Dutch implementing law was still a draft on 29 October 2026; it would keep sector supervisors in their own domains, with the AP and RDI coordinating. The Commission lists the RDI as contact point, with designation pending.

    Does the AI Act apply before the Dutch law is passed?

    Yes. The AI Act is an EU regulation and applies directly. The Dutch law only sets up who supervises and enforces it.

    Can AI make decisions about customers on its own?

    Only within narrow exceptions. The GDPR bans fully automated decisions with significant effects in principle, and article 40 UAVG sets out Dutch exceptions with safeguards.

    When do the high-risk AI rules start?

    On 2 December 2027 for Annex III uses such as hiring and credit scoring, and 2 August 2028 for AI in regulated products, after the EU AI Omnibus changed the dates.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Government of the Netherlands (wetten.overheid.nl), 2026-09-01. Uitvoeringswet Algemene verordening gegevensbescherming(wetten.overheid.nl)
      Full title and what we used it for

      Uitvoeringswet Algemene verordening gegevensbescherming. Primary. Version in force from 1 September 2026, read on 29 October 2026. Used for the law date of 16 May 2018 and the headings of articles 40 and 46.

    2. [2] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the AI Act timeline and the AI Omnibus, which the page says entered into force on 27 July 2026. We could not open EUR-Lex directly.

    3. [3] European Commission, 2026-09-07. Market Surveillance Authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market Surveillance Authorities under the AI Act. Primary. Used for the RDI being listed as the Dutch single point of contact with national designation still pending.

    4. [4] Rijksoverheid, 2026-04-20. Kabinet zet stap met toezicht op Europese AI-regels(rijksoverheid.nl)
      Full title and what we used it for

      Kabinet zet stap met toezicht op Europese AI-regels. Primary. Used for the draft law's supervision model and the consultation to 1 June 2026. Secondary reports (AIComplianceHub) say submission to parliament is planned for 2027; we did not confirm that on a primary source.

    5. [5] Digitale Overheid, 2026-04-21. Consultatie Uitvoeringswet AI-verordening van start(digitaleoverheid.nl)
      Full title and what we used it for

      Consultatie Uitvoeringswet AI-verordening van start. Primary. Used to confirm the consultation dates and the coordinating role of the AP and RDI.

    6. [6] Rijksoverheid, 2024-01-18. Kabinet presenteert visie op generatieve AI(rijksoverheid.nl)
      Full title and what we used it for

      Kabinet presenteert visie op generatieve AI. Primary. Used for the 6 action lines and the €13.5 million for GPT-NL.

    7. [7] Centraal Bureau voor de Statistiek (CBS), 2026-02-10. Digitalisering en kenniseconomie 2025: ICT-gebruik bij bedrijven(cbs.nl)
      Full title and what we used it for

      Digitalisering en kenniseconomie 2025: ICT-gebruik bij bedrijven. Primary. Used for AI use by 33% of companies with 10 or more staff in 2025 (23% in 2024) and the sector shares.

    8. [8] Government of the Netherlands, 2026-10-29. Algoritmeregister(algoritmes.overheid.nl)
      Full title and what we used it for

      Algoritmeregister. Primary, accessed on this date. Used for the register's purpose and the count of 1,610 algorithms.

    9. [9] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary, accessed on this date. Used to confirm India has no EU adequacy decision.

    This is general information, not legal advice. The Dutch AI Act implementing law was still a draft when we checked, and the AP website could not be read by our tools, so AP guidance is not covered here. Check with a qualified Dutch lawyer (advocaat) before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Netherlands?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score