Enforcement per member state
AI Act enforcement in Netherlands
Last verification round: 2026-08-10
- Who supervises · in a bill
- Dutch Data Protection Authority (AP) and Netherlands Authority for Digital Infrastructure (RDI), intended coordinators within a system of ten existing supervisors
- Single point of contact
- RDI (intended single point of contact for the Netherlands; designation follows only with the implementing act).
- Implementing law
- in consultation
The situation in this country
The Netherlands missed the 2 August 2025 deadline for formal designation. In April 2026 the cabinet opted for a system in which ten existing supervisors each keep their own domain, with the AP and RDI as coordinators and the RDI as intended single point of contact. The AP is the intended supervisor for prohibited practices, most Annex III systems and areas without a clear existing supervisor. The public consultation on the AI Act Implementation Act closed on 1 June 2026 with thirty responses; the bill has not yet been submitted to parliament.
Obligations at play here
What has happened
2026-04-20 | Ministerie van Economische Zaken
Dutch AI Act Implementation Act enters public consultation
On 20 April 2026 the Dutch cabinet opened public consultation on the AI Act Implementation Act. The bill designates ten existing market surveillance authorities (including AP, RDI, ILT, IGJ, NVWA, the Labour Inspectorate, AFM and DNB), gives the AP and RDI a coordinating role and makes the RDI the intended single point of contact towards the Commission. The consultation ran until 1 June 2026.
2025-02-02 | Autoriteit Persoonsgegevens
Dutch DPA gathers input on prohibited AI practices
Around the prohibitions of Article 5 becoming applicable on 2 February 2025, the Dutch DPA, as intended coordinating supervisor for prohibited AI, ran a series of public calls for input, including on manipulative and deceptive AI systems, on emotion recognition in the workplace and education, and on social scoring. This actively prepared its Article 5 supervision.
2024-09-03 | Autoriteit Persoonsgegevens (AP)
Dutch DPA fines Clearview AI 30.5 million euros
The Dutch DPA fined Clearview AI 30.5 million euros for building an illegal database of billions of facial images, including of Dutch citizens. The DPA also explicitly warned that use of Clearview by Dutch organisations is prohibited. This scraping practice now also falls under the Article 5 prohibition of the AI Act.
Autoriteit Persoonsgegevens, boetebesluit, bekendgemaakt 3 september 2024
2022-04-12 | Autoriteit Persoonsgegevens (AP)
Dutch DPA fines Tax Administration 3.7 million euros for the FSV fraud blacklist
From 2013 to 2020 the Tax Administration kept signals of possible fraud on around 270,000 people in the Fraud Signalling Facility (FSV). The Dutch DPA imposed six fines, 3.7 million euros in total (decision of 7 April 2022, announced on 12 April 2022), among others for the lack of a legal basis, inaccurate data, excessive retention and asking the data protection officer for advice on the DPIA too late. According to the DPA, staff were also instructed to base the fraud risk partly on nationality and appearance. An AI system that flags fraud in benefits or allowances can fall under Annex III point 5(a) of the AI Act if its output is used to grant, reduce, revoke or reclaim a benefit or allowance, unless Article 6(3) exempts the system.
Autoriteit Persoonsgegevens, persbericht 12 april 2022 en boetebesluit 7 april 2022
2021-12-07 | Autoriteit Persoonsgegevens (AP)
Dutch DPA fines Tax Administration 2.75 million euros over nationality in childcare benefits
For years the Benefits department unlawfully kept the dual nationality of Dutch citizens and used applicants’ nationality in a risk model and in fraud detection for childcare benefits, although this was not necessary. The Dutch DPA held the processing unlawful and, being discriminatory, also unfair, and imposed a fine of 2.75 million euros (decision of 25 November 2021, announced on 7 December 2021). Under the AI Act a FRIA describes the risks of harm to groups, and the provider of a high-risk system examines its datasets for bias.
Autoriteit Persoonsgegevens, persbericht 7 december 2021 en boetebesluit 25 november 2021
2020-02-05 | Rechtbank Den Haag
SyRI: legislation for a government risk model offers insufficient safeguards
The court declared the statutory basis of the System Risk Indication (SyRI), which the government used to link data to flag benefit and allowance fraud, non-binding for breach of Article 8 ECHR. Without insight into the risk indicators and the risk model, or statutory safeguards that compensate for that, it cannot be established that the interference with private life is proportionate. The court drew on the GDPR principles of transparency, purpose limitation and data minimisation. An AI system that assesses eligibility for a benefit falls under Annex III point 5(a) of the AI Act, with obligations applying from 2 December 2027.