The Act will be implemented in phases and will be fully in force by August 2nd, 2027. A number of AI systems are likely to be prohibited as early as from February 2nd, 2025. Other AI-systems will have to meet additional requirements from August 2nd, 2026. Preparation for complying with the AI Act should start now. You can find more information in the ‘quick answers’ on this page.  

AI & Algorithmic Risks Report Netherlands
Every six months, the Dutch Data Protection Authority (DPA) publishes its AI & Algorithmic Risks Report Netherlands (ARR) to provide insight into risk developments and trends.

Why this Act? 

The EU AI Act is intended to ensure that everyone across Europe can rest assured that AI systems are secure and that fundamental rights are protected. Even though there are countless systems with low risk and all kinds of benefits to AI, there is also a whole other side to AI. While existing legislation, such as the General Data Protection Regulation (GDPR) and the Dutch Police Data Act (‘Wet politiegegevens’ (Wpg)), already offer protection, such as when AI systems are used to process personal data, the protection offered is inadequate to address all risks associated with AI. Irresponsible use of AI can, for example, lead to discrimination, restrictions of our freedoms, and to people being misled and exploited. The EU AI Act will ensure that AI system developers address risks and implement supervision of these efforts. 

What does the EU AI Act regulate? 

The EU AI Act classifies AI systems into risk groups. The higher the risk for citizens and society as a whole, the tighter the rules. Key points regulated by the Act are, for example, that: 

• applications that involve an unacceptable risk are prohibited;
• applications that represent a high risk are subject to stricter rules. Examples of high-risk AI systems include AI systems intended for recruitment and selection purposes or for law enforcement. Deployers of such systems will be under an obligation to, for example, log system activity, set up adequate data management, and ensure that human oversight is possible. They must also be able to show that they comply with these requirements. The EU AI Act contains a list of high-risk systems that have to meet these and other requirements.  Applications that represent a lower risk must meet various transparency rules. A system that generates artificial content, for example, must make it clear to citizens that the content it creates is artificial; 
• market surveillance authorities will be designated that will be able to enforce compliance with the Act, oblige organisations to withdraw a product from the market, and impose fines.

If your organisation develops or deploys an AI system, it will be your responsibility to check what category your system falls into. Before the requirements for high-risk AI systems come into force, guidelines will be issued to help organisations assess into what risk group to classify their systems. See also: EU AI Act risk groups. 

To whom do the rules of the EU AI Act apply? 

The EU AI Act will govern both organisations that provide AI and organisations that deploy AI, ranging from public authorities and healthcare institutions to SMEs.

Providers must, for example, make sure that the systems they develop meet the requirements before placing them on the market and putting them into service. They will also be under an obligation to keep monitoring for risks that, for example, undermine the protection of fundamental rights. And to take action when there is something wrong with their system. Providers will also have to see to it that high-risk systems are sufficiently transparent, so as to ensure that they are deployed correctly.

Organisations will, for example, have a responsibility to deploy a high-risk AI systems as per the instructions for use issued by the provider. Deploying organisations must for these systems also ensure human oversight, use relevant and sufficiently representative input data, and report incidents to the provider and market surveillance authority. In certain cases, they must also register their use of a system in a European database. 

Additionally, the EU AI Act gives anyone who comes into contact with an AI system the right to:

• lodge a complaint with a market surveillance authority;
• in some cases, get an explanation on a decision made on the basis of output from a high-risk AI system.

Specific rules for public authorities 

The EU AI Act also provides additional rules for public authorities and entities providing public services. These must always conduct a so-called ‘fundamental rights impact assessment’ for high-risk systems and, from August 2nd, 2026, register their deployment of high-risk AI systems in the European database for high-risk AI systems.

Providers of general-purpose AI models  

There will also be rules governing providers of ‘general-purpose AI models’, also referred to as 'general purpose AI'. These are models that are the foundation for other applications, such as language models used for AI chatbots. 

The developers of such models will be required to provide technical documentation on their product, make their system ‘explainable’, and have a policy in place to protect copyright. Enforcement will largely be handled on a European level, by the European AI Office.