The AI Act in the Netherlands: which law applies and who supervises

The AI Act is a European regulation. That means it applies directly in the Netherlands, without its rules first being copied into Dutch law. A Dutch law is still needed: the Dutch AI Act Implementation Act. It does not set what you must do. It sets who checks that you do it and how the rules are enforced.

This article explains how that works, which supervisors the proposal designates and what it means for your organisation.

A regulation, not a directive

Europe legislates in two ways. A directive, such as NIS2, must first be transposed by each country into its own law. A regulation, such as the GDPR and the AI Act, applies directly in every member state from its start date.¹

So you do not need to look for the substantive AI Act rules in Dutch legislation. Prohibited practices, the AI literacy duty, the transparency obligation and the high-risk requirements are in the regulation itself. When each part applies is covered in What is the EU AI Act?.

The rules come from Europe. The implementation act sets who supervises them.

What the Dutch implementation act covers

The regulation deliberately leaves some matters to member states. Each country designates its own supervisors, sets their powers and arranges how fines are imposed. That is what the Dutch AI Act Implementation Act is for.

The Dutch government opened a public consultation on the bill on 20 April 2026.² The consultation has since closed.³ The bill is not yet law: it still goes to the Council of State and parliament, so details can change.

What the bill covers:

• Which supervisors are competent in each domain.
• Which powers they get, such as requesting information and examining systems.
• How enforcement works, within the maximum fines the regulation itself sets.
• Who designates notified bodies, the parties that assess certain high-risk systems in advance.

Who supervises

In the bill the Netherlands chooses a hybrid model with ten market surveillance authorities.⁴ The principle: as far as possible you deal with a supervisor you already know.

• The Dutch Data Protection Authority (AP) supervises prohibited AI, the transparency obligation and high-risk applications. Where a field has no clear sector supervisor, the AP takes that role.⁴
• Sector supervisors stay responsible in their own domain. The AFM and DNB, for example, supervise AI in the financial sector.⁴
• Product safety inspectorates supervise AI built into products, such as machinery and vehicles.⁴
• The AP and the Dutch Authority for Digital Infrastructure (RDI) also get a coordinating role, so the system works as a whole.⁴

The judiciary is a special case. High-risk AI used for the courts is supervised by judicial bodies themselves, to protect judicial independence.⁵

Ten supervisors, each in its own domain, with the AP and RDI coordinating.

What this means for your organisation

The implementation act not being adopted yet does not mean you can wait. The regulation already applies and the obligations in force today stay in force. The supervision system mainly determines who you will answer to.

Three things to arrange now:

1. Know which supervisor fits you. For a logistics company without a sector supervisor, that is the AP for most AI applications. If you use AI in machinery or vehicles, product safety supervision comes on top.
2. Record an owner per application. A supervisor does not ask about your AI policy in general, but about a specific system: what it does, on which data, and who intervenes when it goes wrong.
3. Make sure you can prove it. Which data an application uses, which version ran at a given moment and who approved what. You can only show that if it is recorded when it happens, not afterwards.

How boards and supervisory boards organise this per application is covered in AI governance for the executive and supervisory board.

Frequently asked questions

Does the AI Act still need to be transposed into Dutch law?

No. The AI Act is a regulation and applies directly. The Dutch implementation act only covers supervision and enforcement.

Do the rules already apply without the implementation act?

Yes. The obligations that already apply under the regulation apply now. The implementation act sets who checks them.

Who is my supervisor?

That depends on your sector and the application. If you have a sector supervisor, it usually stays competent. Otherwise, under the bill, it is the Dutch Data Protection Authority.

Can the bill still change?

Yes. The bill still goes to the Council of State and parliament. Its main lines, a hybrid model with the AP and RDI coordinating, are broadly supported.