Since 15 August 2026 the Dutch Cybersecurity Act, the Dutch implementation of NIS2, has applied to more than 8,000 organisations. The Act does not mention AI agents, but an agent belongs to the systems you must secure, and an incident involving an agent can call for an early warning within 24 hours. This article walks through the duty of care, the duties of the management body and the reporting duty, and sets the reporting deadlines of the Cybersecurity Act, the GDPR and the AI Act side by side.
Can an AI agent process personal data? Yes, under the same GDPR rules as any other processing, but an agent searches, combines and remembers on its own, so you must arrange more up front. This article walks through legal basis, roles, DPIA, rights, security, breaches, transfers and retention, and ends with a checklist.
When does an AI agent take an automated decision under GDPR Article 22, and what follows? Article 22 is a prohibition in principle, but it is not a hard stop for agents, and explicit consent is usually the weakest way out. A guide built on SCHUFA, Dun & Bradstreet, WP251 and the 2026 regulator guidance on agents, with a decision tree and three worked use cases.
A letter from the Dutch DPA or another European regulator about your AI systems rarely arrives at a convenient moment. This is the file you need ready within weeks: from an AI inventory and risk classifications to DPIAs, Article 50 measures and evidence of AI literacy.
Medical AI software classified as MDR class IIa or higher becomes high-risk under the AI Act through Article 6(1). That does not mean running a second certification track: the AI Act requirements are folded into the existing notified body assessment. Here is how to avoid duplicating work.
Workforce analytics, time-tracking AI, productivity scoring, sentiment analysis, attrition prediction: almost all modern monitoring tools hit Annex III point 4(b). Practical overview.
Workforce planning AI suggests team structures, predicts capacity and can be input for restructuring. Annex III point 4(b) plus works council law plus labor law: the stacking is heaviest here.
Skills graphs, talent intelligence hubs and AI-inferred skills feed recruiting, performance, mobility and compensation. One underlying AI layer touches virtually every HR decision.
Performance management is getting more AI: calibration suggestions, feedback generation, predictive performance. Almost all of it hits Annex III point 4(b). Practical overview for HR.
Salary benchmarks, raise recommendations, pay equity audits with AI: compensation AI directly hits Annex III point 4(b). Plus the pay transparency directive changing in 2026.
CV screening is for almost every employer the first AI contact in HR. But parsing, skills inference and ranking have completely different AI Act classifications. Practical overview.
Many organizations already use AI agents without clearly knowing which legal role they occupy. When are you a deployer under the EU AI Act, and why does that distinction matter so much in practice?
Onboarding seems low-risk but increasingly contains AI: chatbots, buddy matching, learning AI, integration suggestions. The transition from candidate to worker brings new AI Act obligations.
Game-based assessments, situational judgment tests, personality tests and video interviews with AI scoring are standard 4(a) high-risk. Practical overview for recruiters and compliance.
Dutch DPA identifies critical security risks in autonomous AI agents—from privilege escalation to data leakage. Key steps to protect your organization.
Before a candidate applies, AI already decides who is approached, which vacancies they see and which profiles recruiters get suggested. That is Annex III point 4(a) — before the first click.
Yes: CV screening and candidate ranking are Annex III high-risk, with duties from 2 December 2027. Emotion recognition in interviews is already banned.
The final part of the AI & Finance under the EU AI Act series – how financial institutions can connect individual use cases into one coherent governance...
Since April 2025, a landmark EU Court of Justice case challenges AI training data practices. Here's why Like Company v. Google Ireland is a turning point.