AI policy: what it must cover under the EU AI Act, GDPR and WOR

The EU AI Act (Regulation (EU) 2024/1689) does not literally require a document called an “AI policy”. In practice you need one: without internal rules on which AI systems you use, how they are classified and who is responsible, you cannot show compliance with the AI Act, the GDPR or Dutch employment law.

Generative tools draft correspondence, recruitment software ranks candidates and finance systems flag transactions, often through features added to software you already license. Since 2 August 2026 the transparency duties of Article 50 AI Act apply, and the high-risk regime follows on 2 December 2027. Below we explain what a workable AI policy contains, which deadlines apply and how to build a policy people actually use.

What is an AI policy, and why do you need one?

An AI policy is the set of internal rules that decides how, why and under what conditions your organisation may use artificial intelligence. It turns the duties in the AI Act, the GDPR and the Works Councils Act into instructions an employee can follow.

The policy states which systems it covers, what may be entered into them, who approves a new tool, when a person must review the outcome and what happens after an incident. The risks are concrete: client data pasted into a public chatbot is a potential data breach under Article 4(12) GDPR, and a selection tool that filters out a group of applicants can breach the Dutch Equal Treatment Act. In each case the organisation that deployed the system carries the responsibility, not the supplier.

Which rules apply: the AI Act, the GDPR and Dutch employment law?

Three sets of rules apply at the same time. The AI Act regulates the system, the GDPR regulates the data, and Dutch employment law regulates what you may do to your own staff with it.

How does the AI Act classify AI systems?

The AI Act takes a risk-based approach. Article 5 bans a small number of practices outright, including social scoring and certain manipulative techniques; our article on prohibited AI practices explains them. Since the AI omnibus of July 2026, generating non-consensual intimate images of identifiable people is banned as well.

Uses listed in Annex III count as high-risk AI, for example recruitment and selection, decisions on promotion and dismissal, creditworthiness assessments and access to essential services. For those systems Articles 9 to 15 require:

• a risk management system;
• data governance;
• technical documentation and logging;
• transparency towards the deployer (the organisation using the system);
• human oversight;
• accuracy and robustness appropriate to the purpose.

Everything else is mainly subject to the transparency duties of Article 50, or to no specific AI Act obligation at all.

What does the GDPR add?

The GDPR applies in full wherever personal data is processed, including for training. Purpose limitation, data minimisation and the need for a lawful basis under Article 6 bite hardest in AI projects.

Article 22 GDPR restricts decisions based solely on automated processing that have legal or similarly significant effects. Where a system is likely to result in a high risk, Article 35 GDPR requires a data protection impact assessment (DPIA) before use. Our article on using AI in your Dutch business works through these obligations in more detail.

What does Dutch employment law require?

Under Article 27(1)(k) and (l) of the Works Councils Act (Wet op de ondernemingsraden, WOR), the works council must consent to arrangements on the processing of employee personal data and on systems suitable for monitoring the presence, behaviour or performance of staff. An AI policy that governs monitoring, productivity analytics or automated assessment of employees will often fall within this provision.

A decision taken without the required consent is void if the works council invokes that within one month (Article 27(5) WOR). Consultation is therefore a question of timing, not a formality.

Which AI Act deadlines apply now, and which have moved?

The bans, the rules for general-purpose AI models and the transparency duties already apply. The obligations for high-risk systems have been postponed to 2 December 2027 and 2 August 2028.

The AI Act entered into force on 1 August 2024 and applies in stages:

• 2 February 2025: the bans on unacceptable-risk practices and the AI literacy duty took effect.
• 2 August 2025: the obligations for providers of general-purpose AI models took effect, together with the governance and penalty provisions.
• 2 August 2026: the general date of application, including the Article 50 transparency duties: people must be told when they interact with an AI system, and AI-generated content must be marked.

Regulation (EU) 2026/1744, the AI part of the Commission’s digital omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It changes the timetable as follows:

• The high-risk regime for the stand-alone systems in Annex III, including employment, education, credit and essential services, applies from 2 December 2027.
• For AI that is a safety component of products covered by EU product legislation (Annex I), the date becomes 2 August 2028.
• Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty of Article 50.
• The AI literacy duty is softened: providers and deployers must take measures to support a sufficient level of AI literacy, rather than ensure it.

That is a preparation window, not a reprieve. A recruitment or credit-scoring system you select now will still be running in December 2027, and the supplier contract you sign today decides whether documentation, logging and oversight features exist by then.

What should the policy cover?

Start with the scope: which departments and which types of system the policy binds. Typically that means HR, marketing, customer service, finance and operations, and purchased AI software, AI features in existing platforms, in-house models, generative assistants, chatbots and scoring tools.

Two boundary questions need an explicit answer. May employees use public AI tools on their own account for work, and on what conditions? And what happens to AI features that appear in software you already use, without a purchase decision? Both are routes by which AI enters unnoticed, and under Article 26 AI Act the deployer carries the duties either way.

How do you define AI and divide its use?

Use definitions that match the concept of an AI system in Article 3(1) AI Act, written with examples from each department. Then divide use into three categories:

• Prohibited use: the practices banned by Article 5, plus any application your organisation rules out for its own reasons.
• Conditional use: permitted subject to safeguards, such as a documented risk classification, a DPIA where Article 35 GDPR requires one and approval by a named role.
• Permitted use: low-risk applications that need no more than the general rules on confidentiality and checking output.

Who is responsible?

Assign final responsibility for AI compliance at board level, and name the roles that approve new applications, keep the inventory and handle incidents. Where a system may become high-risk, the supplier contract should oblige the provider to deliver the technical documentation, instructions for use and logging capability required by Articles 11 to 13 AI Act.

How do you handle data, privacy, security and transparency?

The policy must state which information may be entered into which system. Confidential business information, client files, special categories of personal data (Article 9 GDPR) and anything covered by professional secrecy generally do not belong in a public tool.

Set out where anonymisation or pseudonymisation is required, how long inputs and outputs are kept and how training data is separated from production data. Route AI incidents into your existing data breach procedure: under Article 33 GDPR a personal data breach must be reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) without undue delay and, where feasible, within 72 hours.

Since 2 August 2026, Article 50 AI Act requires that people are told when they interact with an AI system, unless that is obvious. Synthetic audio, images, video and text must be marked in a machine-readable way. Translate this into instructions: what the chatbot says in its opening message, how AI-assisted content is labelled and what candidates are told about AI in a selection procedure.

How do you arrange human oversight, bias testing and AI literacy?

For every system that affects a person, the policy must say when a human decides and what that person can actually do. Under Article 14 AI Act, the reviewer must understand the system’s limits and be able to disregard or override its output.

Under Article 22(3) GDPR, a person subject to an automated decision keeps the right to human intervention, to give their point of view and to contest the decision. A sign-off box in a workflow does not meet that standard.

Why test for bias?

Systems used in recruitment, performance assessment and credit decisions should be tested periodically for differences in outcomes between groups, with the results recorded. That record supports your AI Act documentation and is your evidence if a rejected candidate alleges discrimination: under the Dutch Equal Treatment Act (Algemene wet gelijke behandeling, AWGB, Article 10) facts suggesting discrimination shift the burden of proof to the employer.

What does AI literacy require?

Article 4 AI Act obliges providers and deployers to take measures to support a sufficient level of AI literacy among staff who work with AI systems. In practice that means a basic module for everyone, deeper training for HR, IT, procurement and management, and a record of who was trained and when.

Who supervises the AI Act in the Netherlands?

The Netherlands is organising supervision through existing regulators. The draft AI Regulation Implementation Act (Uitvoeringswet AI-verordening) was published for consultation on 20 April 2026 and has not yet been adopted.

Under the draft, the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) and the AP share a coordinating role, and sector supervisors keep their own domains. The fines come from Article 99 AI Act: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for most other infringements.

How do you get from a first inventory to a working AI policy?

Start with an inventory of what is actually in use, including AI features inside existing software and tools employees adopted themselves. Then work through these steps:

• Classify each application: prohibited, high-risk under Annex III, subject to Article 50, or low-risk.
• Assess the risks, combining the AI Act classification with the GDPR analysis and, where staff are affected, the Article 27 WOR question.
• Draft the policy and align it with your privacy, information security, procurement and HR frameworks.
• Implement it where decisions are made: purchasing templates, the software intake process, the recruitment procedure and the training calendar.
• Review it at least once a year, and when a significant new system arrives, the law changes or an incident occurs.

What should you check as the organisation using AI?

As deployer you carry your own duties under Article 26 AI Act, whoever built the system. Check these points:

• No system in use falls under the Article 5 bans, which have applied since 2 February 2025.
• Chatbots and content tools meet the Article 50 transparency duties that apply since 2 August 2026.
• A DPIA under Article 35 GDPR is done for AI that processes personal data with a high risk.
• The works council has consented under Article 27 WOR to AI that monitors or assesses staff.
• Contracts for future high-risk systems secure documentation and logging before 2 December 2027.

What should you check as the supplier of an AI system?

As provider of a high-risk system you carry the heaviest obligations, set out in Article 16 AI Act. Check these points:

• Whether your system falls under Annex III or Annex I, and which date applies to it.
• Whether your risk management, data governance and technical documentation meet Articles 9 to 11.
• Whether the system logs events and comes with instructions for use (Articles 12 and 13).
• Whether the conformity assessment (Article 43) and EU database registration (Article 49) are planned.
• Whether your generative output is marked in a machine-readable way under Article 50(2).

What can we do for you with your AI policy?

Our IT lawyers advise on the AI Act together with the privacy and employment questions that come with it. Concretely:

• We review your AI inventory and classify each system under the AI Act.
• We draft or review your AI policy and align it with your privacy and HR rules.
• We review supplier and licence agreements for AI systems on documentation, logging and liability.
• We carry out or review the DPIA for AI applications that process personal data.
• We prepare the consent request to the works council under Article 27 WOR.

Summary

• The AI Act does not require a document called an AI policy, but without one you can hardly show compliance with the AI Act, the GDPR and Dutch employment law.
• The bans, the rules for general-purpose AI models and the Article 50 transparency duties already apply.
• Regulation (EU) 2026/1744 postponed the high-risk regime to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• AI that monitors or assesses staff will often need the consent of the works council under Article 27 WOR.
• Start with an inventory, then classify, assess, draft, implement and review.

Frequently asked questions