Why now?
These dates and duties apply to government
Since 2 August 2026: Article 50
The Article 50 transparency obligations apply. Anyone talking to a municipal AI chatbot or voicebot must know it is AI.
2 December 2027: high-risk and FRIA
The obligations for Annex III high-risk AI start to apply, including the Article 27 FRIA for public bodies. Systems already in use before then: by 2 August 2030 at the latest, or earlier after a significant change (Article 111(2)).
IAMA and algorithm register
The IAMA is the usual Dutch method for a human rights assessment and fits the FRIA. Publication in the algorithm register is not yet a legal duty; high-risk AI of public bodies must be registered in the EU database, except for critical infrastructure (Article 26(8) and Article 49(3)).
Supervision Intensifies
Dutch Data Protection Authority and AI Office become more active
High-risk AI in Government
These AI applications fall under the strictest AI Act requirements (Annex III)
Automated Decision-Making
AI systems making decisions about benefits, allowances, permits and subsidies, direct impact on citizens.
Fraud Detection & Risk Profiling
Systems screening citizens for fraud or risks, think SyRI-type systems. Extra sensitive after the benefits scandal.
Surveillance & Predictive Policing
Camera analysis, behavioral prediction and predictive enforcement in public spaces.
Youth Care & Social Support
AI detecting risk signals for vulnerable groups, extra high requirements for accuracy and non-discrimination.
Specific Challenges for Government
The AI Act brings unique compliance challenges for public organizations
Algorithm Register Publication
The AP calls for registration. There is no legal duty, and the cabinet does not see one as opportune at this moment (yet). Our template helps you register voluntarily.
IAMA Execution
When is a Human Rights and Algorithms Impact Assessment needed? And how do you conduct one thoroughly?
Legacy Systems
Decision rules in spreadsheets and old systems that nobody fully understands, but that do make decisions about citizens.
Transparency Obligations
Open Government Act requires openness about algorithm use. This also affects AI Act obligations, extra stringent for government.
Decentralized AI Adoption
Departments procure AI independently without central oversight. Who is responsible? IT, policy or operations?
Human Oversight
How do you ensure meaningful human oversight? Political pressure to innovate vs. conservative compliance culture.
Implementation Roadmap
Detailed 6-phase timeline for government organizations
Phase 1.Inventory
Month 1-2Phase 2.Classification
Month 2-3Phase 3.IAMA & Gap Analysis
Month 3-5Phase 4.Governance Setup
Month 5-7Phase 5.Implementation
Month 7-12Phase 6.Audit & Assurance
Month 12-15AI System Inventory Guide
Typical AI systems in government and their likely classification
Note: Many governments think "we don't use AI", but decision rules in spreadsheets, decision trees in IT systems and automated selection ARE algorithms that may fall under the AI Act.
Benefits & Allowances
Usually high-riskAnnex III, automated decisions about access to public services
Fraud Detection & Enforcement
High-riskExtra sensitive after SyRI ruling and benefits scandal, strict requirements
Permits & Subsidies
Often high-riskHigh-risk if it makes autonomous decisions about applications
Surveillance & Public Order
High-risk / ProhibitedReal-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited in principle (Article 5(1)(h)), other biometrics are often high-risk
Internal Support
Limited riskTransparency obligations (Art. 50), citizen must know it is AI
Data Analysis & Reporting
Usually minimal riskMinimal risk if it does not make decisions affecting individuals
Classification Decision Tree for Government
Quickly determine the risk classification of your AI system
Does the system make decisions about individual citizens (benefits, allowances, permits)?
Likely high-risk (Annex III)
Go to next question
Is the system used for fraud detection, risk profiling or enforcement?
High-risk, extra sensitive for government
Go to next question
Does it involve surveillance, biometrics or monitoring in public spaces?
High-risk or prohibited, legal review required
Go to next question
Does it interact directly with citizens (chatbot, information provision)?
Limited risk, transparency obligation
Go to next question
Is it purely internal analysis without impact on individual citizens?
Minimal risk
Consult an expert for classification
This is a simplified decision tree. Final classification requires legal review, consult your privacy officer or legal advisor.
Governance Structure for Government
Recommended organizational structure for AI governance in government organizations
Start with existing structures: privacy officer, information security and data management. Build AI governance on top of these instead of creating a separate silo.
Key Roles
AI System Owner
Responsible per AI system, often the department manager using the system
Privacy & AI Officer
Combines DPO role with AI Act oversight, monitors IAMA execution and algorithm register
Human Oversight Officer
Ensures human oversight of high-risk decisions, as Article 14 and Article 26(2) require
Algorithm Register Admin
Responsible for publication and maintenance of the algorithm register
Practical Templates & Guidelines
Ready-to-use tools for your organization
Download the public sector pack
Four templates for procuring and using AI in the public sector, in one ZIP
With a readme that tells you in which order to fill them in. Each template is also available on its own on the template page, with an explanation. The pack is sent to your business email address.
In the pack:
Compliance Checklist for Government AI
Concrete checkpoints per high-risk AI system
This checklist applies per high-risk system. Combine with your IAMA findings and algorithm register registration.
Common Mistakes in Government
Avoid these pitfalls in AI Act implementation
"We don't use AI"
Yes you do, decision rules in spreadsheets, decision trees in IT systems and automated selection ARE algorithms that may fall under the AI Act.
Algorithm register as checkbox exercise
The register is not just a list, it requires substantive description of workings, impact and safeguards. Citizens must understand it.
No citizen participation
The AI Act emphasizes transparency. Governments that don't involve stakeholders and citizens in AI decisions miss a crucial element.
Decentralized sprawl
Departments independently adopt ChatGPT-like tools. Without central policy, no overview and no compliance.
Skipping or superficial IAMA
An IAMA is not a checklist, it requires multidisciplinary research into impact on human rights and fundamental rights.
Forgetting legacy systems
Old systems running for years are not included. But if they make automated decisions, they fall under the AI Act.
Regulatory Overlap
How the AI Act connects with existing government legislation
GDPR / AVG
Overlap: DPIA, automated decision-making (Art. 22), right to explanation
Practical tip: FRIA and DPIA partially overlap, combine where possible and involve your DPO
Open Government Act (Woo)
Overlap: Transparency about algorithm use, source code disclosure
Practical tip: Algorithm register publication also helps with Woo requests, two birds with one stone
General Administrative Law Act (Awb)
Overlap: Careful decision-making, duty to state reasons, objection & appeal
Practical tip: AI decisions must meet Awb requirements, citizens must be able to object to the algorithm
Baseline Information Security (BIO)
Overlap: Information security, access management, logging
Practical tip: BIO measures for AI systems align well with Art. 15 (cybersecurity), use existing BIO framework
Learn from Others
Case studies of governments that successfully implemented AI governance
Youth Care Risk Signaling
Municipality Jeugdveilig
How a municipality discovered their AI system was making vulnerable families even more vulnerable, and redesigned it responsibly.
Read moreAlgorithm Register Implementation
Municipality Transparantstad
How a municipality struggled with inventorying algorithms, and discovered they didn't know what systems they were actually using.
Read moreFraud Detection Bias
Municipality Veiligwaard
How a municipality scrutinized their fraud detection algorithm, and discovered that well-intentioned doesn't always mean fair.
Read moreThis Applies to Your Organization
The AI Act is relevant for all levels of government
Municipalities
Welfare algorithms, fraud detection, care indication
Provinces
Permit granting, enforcement, subsidy allocation
Water Boards
Dike inspection, water quality, predictive models
Central Government
Tax Authority, Education Agency, Defense
Executive Agencies
UWV, SVB, CBR, CJIB
Independent Bodies
Independent administrative bodies with own AI systems
Rather have a lawyer do it?
A public authority must designate a DPO; only courts acting in their judicial capacity are exempt (Article 37(1)(a) GDPR). Zahed Ashkara is a freelance AI and privacy legal adviser: hire him as external DPO with AI oversight, for a DPIA with a FRIA or IAMA on the same facts, or interim in your team. Also through your framework agreement or hiring platform.
Hire an AI and privacy legal adviser: interim or per project (freelance)
Interim or per project, as privacy officer, AI governance lead or DPO. Directly or through your agency, framework agreement or hiring platform.
Hire an external DPO, with AI oversight (data protection officer)
An independent data protection officer with fixed hours and a fixed point of contact, who also keeps your AI register and reviews new AI applications.
Have a DPIA, FRIA or AI Act classification done, signed
A DPIA, FRIA, AI Act classification, Article 50 check or review of an AI contract, with the legal source for every conclusion. AI drafts it, a legal adviser reviews and signs it. Fixed scope and fixed price, agreed up front.
Ready to determine your government route?
Practical tools and guidance for government organizations