तपाईंको व्यवसायमा एआई उपकरणहरू: डच र ईयू कानूनको पालना कसरी गर्ने

If your business uses AI tools in the Netherlands, you must comply with the EU AI Act (Regulation (EU) 2024/1689) and, whenever personal data is involved, with the GDPR. Most obligations depend on your role and the risk of the system: a chatbot mainly triggers transparency duties, while AI used for recruitment or credit decisions is high-risk, with stricter rules that apply from 2 December 2027.

Some obligations already apply today, such as the bans on certain AI practices and the duty to train your staff. This article explains the timeline, the risk categories, the GDPR and intellectual property rules, and the practical steps for AI Act compliance.

Which rules apply to AI in the Netherlands?

The AI Act is an EU regulation and applies directly in the Netherlands, without Dutch implementing legislation. It entered into force on 1 August 2024 and applies in stages.

Your obligations depend on your role. A provider develops an AI system or places it on the market under its own name; a deployer uses an AI system in its business. Most Dutch companies that buy and use tools such as chatbots or HR software are deployers.

The AI Act works alongside the GDPR, the Data Act, the Cyber Resilience Act and Dutch law such as the Dutch Civil Code (BW) and the Works Councils Act (WOR). Using AI does not change the obligations you already have under those rules.

नेदरल्याण्ड्समा एआईको सुपरिवेक्षण कसले गर्छ?

The Netherlands uses a distributed model in which existing regulators supervise AI in their own sector. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) have coordinating roles.

In financial services, the Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) supervise conduct and soundness, and the Authority for Consumers and Markets (ACM) covers consumer protection. The Dutch act that designates the AI Act supervisors and penalties was not yet in force on 11 October 2026; the AI Act itself already binds you.

When do the AI Act obligations apply?

The AI Act applies in phases, and several deadlines have already passed. The high-risk regime was postponed by the AI omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026.

Which risk category does your AI system fall into?

The AI Act sorts AI into prohibited, high-risk, limited-risk and minimal-risk systems. Your classification decides your duties, so make it for every tool you use and record it.

कुन एआई अभ्यासहरू निषेधित छन्?

Since 2 February 2025 certain practices are banned without a transitional period. These include manipulation through subliminal techniques, exploiting vulnerabilities due to age or disability, social scoring, and emotion recognition in the workplace and in education, with narrow exceptions.

Dutch courts already set limits before the AI Act. In the SyRI case the District Court of The Hague held on 5 February 2020 that the legislation for a government risk-profiling system breached the right to privacy in Article 8 ECHR (ECLI:NL:RBDHA:2020:865).

एआई प्रणाली कहिले उच्च जोखिममा हुन्छ?

AI used for recruitment, promotion, dismissal, worker management, creditworthiness, education or access to essential services is high-risk. From 2 December 2027 such systems need risk management, technical documentation, logging, human oversight and, for providers, a conformity assessment and registration in the EU database.

As a deployer you must use the system according to the instructions, assign trained staff to oversee it, keep the logs and inform the people affected. Certain deployers, such as public bodies, must also carry out a fundamental rights impact assessment.

What do limited-risk systems require?

Since 2 August 2026 people must be told when they interact with an AI system such as a chatbot, unless this is obvious. AI-generated or manipulated images, audio and video (deepfakes) must be labelled, and providers must mark synthetic content so that it can be detected.

The AI literacy duty applies to all categories: since 2 February 2025 you must ensure that staff who work with AI have sufficient knowledge of it. Record what training you gave and to whom.

What does the GDPR require when you use AI?

If an AI tool processes personal data, you need a legal basis for each purpose, such as a contract, a legal obligation or a legitimate interest. The AP has warned that data scraped from the internet is not lawful training material just because it was publicly available.

Carry out a Data Protection Impact Assessment (DPIA) before using AI that is likely to pose a high risk to individuals, for example in HR or customer profiling. Limit the data to what you need, and check whether the AI supplier processes data on your behalf, in which case you need a data processing agreement. See our page on डेटा र गोपनीयता.

Can AI make decisions about people on its own?

Only within narrow limits. The GDPR gives individuals the right not to be subject to a decision based solely on automated processing that has legal effects or similarly significant effects, such as rejecting a job application or a loan.

Where such a decision is allowed, people must receive meaningful information about the logic involved and can ask for human intervention, give their view and contest the decision. Make sure the human reviewer actually assesses the case and does not simply confirm the output.

What about data breaches and security?

Under the GDPR you must report a personal data breach to the AP within 72 hours of becoming aware of it, and inform the people affected if the risk to them is high. This includes breaches through AI systems, such as data leaking into a public chatbot.

The Cyber Resilience Act adds security requirements for products with digital elements: reporting duties for actively exploited vulnerabilities apply from 11 September 2026 and the other obligations from 11 December 2027. The Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, applies to essential and important entities.

AI-उत्पन्न सामग्रीको स्वामित्व कसको छ?

Under the Dutch Copyright Act (Auteurswet), only a work that reflects the author’s own intellectual creation is protected, which requires human creative choices. Output generated by AI without meaningful human input is in principle not protected by copyright.

If you shape the result through your own creative choices, for example by selecting, editing and combining output, protection is possible. Keep records of prompts, edits and choices, and agree in employment and freelance contracts who owns AI-assisted work. See our बौद्धिक सम्पत्ति कानूनको लागि मार्गदर्शन.

May AI be trained on protected works?

Under Article 15o Auteurswet, text and data mining on works you lawfully access is allowed, unless the rightholder has expressly reserved this right in an appropriate way, such as machine-readable means for works online. Article 15n Auteurswet allows broader mining for scientific research by research organisations and cultural heritage institutions.

A database is protected separately under the Databases Act (Databankenwet) if its creation required a substantial investment; under Article 6 of that Act the right expires fifteen years after 1 January of the year following completion. Ask your AI supplier how it handles opt-outs and licences.

What applies when you use AI in HR?

AI for recruitment, evaluation or worker management is high-risk under the AI Act from 2 December 2027 and is subject to the GDPR now. It may not discriminate on grounds such as origin, gender, age or disability under Dutch equal treatment law.

A system that can monitor the attendance, behaviour or performance of staff requires the prior consent of the works council (ondernemingsraad) under Article 27(1)(l) of the Works Councils Act (WOR). Inform employees and applicants about the use of AI in decisions about them. See our page on डच रोजगार कानून.

Who is liable when AI causes damage?

You remain liable for the AI systems you use. Dutch tort law (Article 6:162 BW) and contract law apply as usual, and the product liability rules of Book 6 BW apply to defective products.

The revised Product Liability Directive (EU) 2024/2853 brings software, including AI, within the definition of a product; Member States must transpose it by 9 December 2026. Allocate liability for errors, outages and infringements expressly in your contract with the AI supplier, and check whether your insurance covers AI-related damage. See our article on liability for AI errors.

What should you check as a deployer of AI tools?

• Make an inventory of all AI tools in use and classify each by AI Act risk category.
• Check that no prohibited practice is involved, such as emotion recognition at work.
• Record the AI literacy training given to staff since 2 February 2025.
• Tell users when they talk to a chatbot and label deepfakes.
• Carry out a DPIA and conclude a data processing agreement where needed.
• Obtain works council consent before introducing AI that monitors staff.

What should you check as a provider of AI systems?

• Determine whether your system is high-risk and prepare for the 2 December 2027 or 2 August 2028 deadline.
• Build technical documentation, logging and human oversight into the design.
• Mark AI-generated content so that it can be detected.
• Respect text and data mining opt-outs under Article 15o Auteurswet.
• Give deployers clear instructions for use and limit your liability in the contract.

What can we do for you with AI compliance?

हाम्रो आईटी वकिलहरू advise businesses on using and developing AI under Dutch and EU law.

• We classify your AI tools under the AI Act and set out your obligations per tool.
• We draft an internal AI policy and the record of AI literacy training.
• We carry out or review the DPIA and data processing agreements.
• We review and negotiate contracts with AI suppliers, including liability and IP clauses.
• We advise on works council consent for AI in HR.

सारांश

• The AI Act applies directly; prohibitions and AI literacy have applied since 2 February 2025.
• Transparency duties for chatbots and deepfakes apply since 2 August 2026.
• High-risk rules apply from 2 December 2027 (e.g. HR, credit) and 2 August 2028 (regulated products).
• The GDPR applies in full: legal basis, DPIA, limits on automated decisions, breach notification within 72 hours.
• Purely AI-generated output is in principle not protected by copyright; agree IP and liability in your contracts.

बारम्बार सोधिने प्रश्नहरू