The AI Act is a European regulation. That means it applies directly in the Netherlands, without its rules first being copied into Dutch law. A Dutch law is still needed: the Dutch AI Act Implementation Act. It does not set what you must do. It sets who checks that you do it and how the rules are enforced.
This article explains how that works, which supervisors the proposal designates and what it means for your organisation.
A regulation, not a directive
Europe legislates in two ways. A directive, such as NIS2, must first be transposed by each country into its own law. A regulation, such as the GDPR and the AI Act, applies directly in every member state from its start date.1
So you do not need to look for the substantive AI Act rules in Dutch legislation. Prohibited practices, the AI literacy duty, the transparency obligation and the high-risk requirements are in the regulation itself. When each part applies is covered in What is the EU AI Act?.
The rules come from Europe. The implementation act sets who supervises them.
What the Dutch implementation act covers
The regulation deliberately leaves some matters to member states. Each country designates its own supervisors, sets their powers and arranges how fines are imposed. That is what the Dutch AI Act Implementation Act is for.
The Dutch government opened a public consultation on the bill on 20 April 2026.2 The consultation has since closed.3 The bill is not yet law: it still goes to the Council of State and parliament, so details can change.
What the bill covers:
- Which supervisors are competent in each domain.
- Which powers they get, such as requesting information and examining systems.
- How enforcement works, within the maximum fines the regulation itself sets.
- Who designates notified bodies, the parties that assess certain high-risk systems in advance.
Who supervises
In the bill the Netherlands chooses a hybrid model with ten market surveillance authorities.4 The principle: as far as possible you deal with a supervisor you already know.
- The Dutch Data Protection Authority (AP) supervises prohibited AI, the transparency obligation and high-risk applications. Where a field has no clear sector supervisor, the AP takes that role.4
- Sector supervisors stay responsible in their own domain. The AFM and DNB, for example, supervise AI in the financial sector.4
- Product safety inspectorates supervise AI built into products, such as machinery and vehicles.4
- The AP and the Dutch Authority for Digital Infrastructure (RDI) also get a coordinating role, so the system works as a whole.4
The judiciary is a special case. High-risk AI used for the courts is supervised by judicial bodies themselves, to protect judicial independence.5
Ten supervisors, each in its own domain, with the AP and RDI coordinating.
What this means for your organisation
The implementation act not being adopted yet does not mean you can wait. The regulation already applies and the obligations in force today stay in force. The supervision system mainly determines who you will answer to.
Three things to arrange now:
- Know which supervisor fits you. For a logistics company without a sector supervisor, that is the AP for most AI applications. If you use AI in machinery or vehicles, product safety supervision comes on top.
- Record an owner per application. A supervisor does not ask about your AI policy in general, but about a specific system: what it does, on which data, and who intervenes when it goes wrong.
- Make sure you can prove it. Which data an application uses, which version ran at a given moment and who approved what. You can only show that if it is recorded when it happens, not afterwards.
How boards and supervisory boards organise this per application is covered in AI governance for the executive and supervisory board.
