If your Dutch business uses AI that processes personal data, the GDPR (AVG) applies in full today, enforced by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). On top of that, the EU AI Act imposes duties that depend on the risk of the system: the bans on prohibited practices and the AI literacy duty have applied since 2 February 2025, while most of the high-risk regime has been postponed.
The most common mistake is to treat AI as a future compliance problem. The postponement in the AI Act does not suspend anything in the GDPR. This page explains which rules apply now, which come later, and what you should do first.
Table of contents
Which GDPR rules apply when you use AI?
All of them, as soon as the AI system processes personal data. You need a legal basis for each processing operation, a specific purpose, and no more data than that purpose requires.
The legal bases are the usual ones: consent, performance of a contract, a legal obligation or a legitimate interest. Purpose limitation matters most with AI. Customer data you collected to run a chatbot may not simply be reused to train another model. If you buy an AI tool, check whether the supplier uses your input to train its own models; if it does, the supplier may be processing for its own purposes and you need clear contractual terms on controller and processor roles.
The AP has pointed out that many AI models were trained on data scraped from the internet without a valid legal basis. As a user you remain responsible for your own processing, so you cannot shift your GDPR duties to the AI provider.
What about sensitive data?
Special categories of personal data, such as health data, ethnic origin, religion and biometric data used to identify someone, may in principle not be processed. Only narrow exceptions in the GDPR and the Dutch GDPR Implementation Act (UAVG) allow it.
AI used for recruitment, customer profiling or health services quickly touches such data, sometimes indirectly, because a model can infer it. Identify which systems process sensitive data, limit the input, and document the exception you rely on. If none applies, do not use the system for that purpose.
When may AI take decisions about people?
The GDPR prohibits decisions based solely on automated processing that have legal effects or similarly significant effects on a person, such as rejecting a loan application or a job applicant, unless a narrow exception applies.
Where an exception applies, the person has the right to human intervention, to express their view and to contest the decision. You must also tell people that automated decision-making takes place and give meaningful information about the logic involved and its consequences. You do not have to reveal trade secrets, but a general statement that “AI is used” is not enough. Real human review means the reviewer has the authority and the information to change the outcome.
When do you need a DPIA?
A data protection impact assessment (DPIA) is mandatory before processing that is likely to result in a high risk for the people concerned. AI used for profiling, for evaluating employees or applicants, or combining large datasets will often meet that threshold.
The DPIA describes the processing and its purpose, tests necessity and proportionality, identifies the risks and sets out your measures. If a high risk remains, you must consult the AP before you start. Repeat the DPIA when you change the system or the data it uses.
What does the AI Act require, and when?
The AI Act sorts systems into four levels: prohibited practices, high-risk systems, systems with transparency duties, and minimal-risk systems. It applies to providers and to deployers, meaning businesses that use an AI system under their own authority.
| Date | What applies |
|---|---|
| 2 February 2025 | Bans on prohibited AI practices; AI literacy duty for providers and deployers |
| 2 August 2025 | Rules for providers of general-purpose AI models; governance and penalty provisions |
| 2 August 2026 | General date of application, including the transparency duties |
| Deferred | High-risk rules, postponed by the AI omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) |
The deferral concerns only the high-risk regime. Under the omnibus, the high-risk rules for the areas listed in the Act’s annex, such as employment and credit scoring, are planned to apply from 2 December 2027, and those for AI in products already covered by EU product legislation from 2 August 2028.
Which AI uses are high-risk?
High-risk systems include AI used in employment and HR (for example to screen applicants or evaluate staff), in access to essential services such as credit scoring and insurance pricing, in education, critical infrastructure, law enforcement, migration and the administration of justice.
For these systems, deployers will have to use them according to the instructions, ensure human oversight by trained staff, monitor their operation and keep logs. Some deployers must also carry out a fundamental rights impact assessment. A general-purpose model such as a large language model can become part of a high-risk system when you use it for one of these purposes, such as CV screening.
What are the transparency duties?
People must know when they are dealing with AI. A chatbot must make clear that it is not a human, and AI-generated or manipulated images, audio or video (deepfakes) must be disclosed as such.
Most everyday uses, such as drafting emails, summarising documents, spam filters or stock planning, are minimal risk and carry no specific AI Act duties beyond AI literacy. The GDPR still applies if personal data is involved.
Who supervises AI in the Netherlands?
For personal data, the AP. For the AI Act, the Netherlands is building on existing sector supervisors, with the AP supervising areas without a sector supervisor and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) coordinating.
The Dutch act that anchors this structure (Uitvoeringswet AI-verordening) is still a bill. Until it is in force, enforcement against AI-related breaches runs largely through the GDPR, for which the AP needs no new powers. If your AI system supports an essential or important service, the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, may apply as well.
What does AI literacy mean in practice?
Since 2 February 2025 providers and deployers must take measures to ensure that staff who operate or use AI systems have a sufficient level of AI literacy. The duty is risk-based: what is sufficient depends on the system and on what employees do with it.
- Adopt a written AI policy stating which tools are approved and what data may be entered.
- Train staff per role: HR on recruitment tools and bias, marketing on profiling, customer service on chatbots.
- Teach staff to check output and to escalate errors.
- Record who was trained, when and on what.
What should you check as a business using AI?
- Do you have an inventory of every AI system in use, its supplier, its input and its output?
- Is there a legal basis and a specific purpose for each processing of personal data?
- Does the supplier use your data to train its own models, and does the contract deal with that?
- Does any system take decisions about people without real human review?
- Have you carried out a DPIA for high-risk processing?
- Are any of your uses on the list of prohibited practices or high-risk areas?
What should you check as an AI supplier?
- Are you a provider under the AI Act, and which risk category does your system fall into?
- Was your training data collected with a valid legal basis?
- Do your customers get the instructions and information they need to meet their own duties?
- Does your system tell users that they are interacting with AI and label generated content?
- Are your processing agreements clear about controller and processor roles?
What can we do for you with AI and the GDPR?
Our IT and privacy lawyers advise businesses on both regimes at once.
- We map your AI systems against the AI Act risk categories and the GDPR.
- We draft your internal AI policy and the AI literacy framework.
- We review supplier contracts and processing agreements for AI tools.
- We carry out or review DPIAs and fundamental rights impact assessments.
- We assist you in enquiries and investigations by the AP.
Summary
- The GDPR applies in full to any AI that processes personal data; the AI Act deferral changes nothing there.
- Prohibited practices and the AI literacy duty have applied since 2 February 2025; most other AI Act rules since 2 August 2026.
- The high-risk regime is deferred by the AI omnibus (Regulation (EU) 2026/1744).
- Solely automated decisions with significant effects on people are restricted and require safeguards.
- Start with an inventory of your AI systems; it determines every other step.
Frequently asked questions
Does the AI Act deferral mean I can wait with compliance?
No. The deferral only concerns the high-risk rules. The bans on prohibited practices and the AI literacy duty have applied since 2 February 2025, and the GDPR applies in full to any AI that processes personal data.
Can I enter customer or employee data into a public AI chatbot?
Only if you have a legal basis, the purpose is compatible and the supplier’s terms allow it. If the supplier uses your input to train its models, you may be disclosing personal data for a new purpose; many businesses therefore ban this in their AI policy.
Is AI-based CV screening allowed?
It is allowed, but it is a high-risk use under the AI Act and usually requires a DPIA under the GDPR. A rejection may not be based solely on automated processing without the safeguards the GDPR requires, such as real human review.
Who enforces AI rules in the Netherlands?
The Dutch Data Protection Authority (AP) enforces the GDPR. For the AI Act, existing sector supervisors will act within their own sectors, with the AP for areas without a sector supervisor and the RDI coordinating; the Dutch implementing act is still a bill.
