7 min read
An organisation using AI in the Netherlands may have to answer two different questions about the same tool. Which requirements apply to the system under the EU AI Act? And what other rules apply to the way the organisation uses it? A customer-service chatbot, an identity verification system and a tool that scores employee performance each bring different issues into play.
The EU Artificial Intelligence Act sets the common framework. In the Netherlands, the GDPR and its Dutch implementation act govern relevant personal data processing. The Dutch Works Councils Act can also affect decisions about workplace technology.
AT A GLANCE
The EU AI Act
The AI Act Regulation (EU) 2024/1689 aims to support the use of Artificial Intelligence while protecting health, safety and fundamental rights. It regulates AI systems and establishes separate obligations for providers of general purpose AI models.
EU Regulations are laws automatically become binding in all EU member states, including the Netherlands, without needing to be transposed into national law.
The EU AI Act applies to organisations that develop, supply or use AI systems within its scope. This includes:
- Providers: organisations that develop an AI system, or have one developed, and make it available under their own name. For example, a software company offering an AI recruitment tool to employers in the EU.
- Deployers: organisations that use an AI system in their professional activities. For example, an employer using the AI recruitment tool to assess job applications or other AI tools.
- Importers and distributors: organisations that bring AI systems from outside the EU onto the EU market or supply them within the EU.
Dutch AI Law, Guidance and Enforcement Policy
- EU AI Act: The EU Artificial Intelligence Act applies directly in the Netherlands. The Dutch implementing law sets out how national supervision and enforcement will be organised.
- Dutch Data Protection Authority (AP): The Dutch Data Protection Authority (AP) already supervises compliance with the GDPR when employers use AI to process personal data. It is also a proposed market surveillance authority under the EU AI Act. As of November 2026, that appointment is pending.
- European Works Council (EWC): An AI rollout that affects operations or employees across countries may trigger the European Works Council’s information and consultation rights on transnational matters.
- Dutch Works Council (OR): The Works Council may have the right to advise on the introduction of significant new technology under Article 25 of the Dutch Works Councils Act. Its consent may be required under Article 27 for arrangements involving employee personal data or monitoring.
Dutch Implementation Bill for EU AI Act
The EU AI Act applies directly in the Netherlands, according to its own application dates. The Dutch implementation bill [Uitvoeringswet AI verordering] sets out who would supervise compliance in the Netherlands and what powers those authorities would have.
The government’s April 2026 consultation draft proposed that existing regulators supervise AI in their respective sectors. It proposed the Dutch Data Protection Authority (AP) for areas without an obvious sector regulator, with the Dutch Data Protection Authority (AP) and the Dutch Authority for Digital Infrastructure (RDI) coordinating supervision. On October 9, 2026, the Dutch Data Protection Authority (AP) said it had yet to be designated as an AI market surveillance authority.
AI and European Works Councils
The EU AI Act includes a duty to inform workers and their representatives before a high-risk AI system is put into use in the workplace, once the relevant requirement applies. Read more about AI and European Works Council Consultation.
AI and Dutch Works Councils
AI in an organisation can change how employees are recruited, assessed, monitored and supported in their work. The Dutch Works Council has a role in examining relevant proposed changes and representing employees’ interests. Its involvement depends on the decision and its consequences, rather than the presence of an AI label. Find out more: AI and Works Council in the Netherlands: Roles and Rights.
Actions for Employers
At the moment now, if an employer for example uses AI to screen job applicants, the Dutch Data Protection Authority (AP) can already supervise the processing of applicants’ personal data under the GDPR. Which authority would supervise compliance with the AI Act depends on the final Dutch designation and the regulator’s remit.
Step 1. Review Existing Use of AI in HR
For each AI tool, all employers should record its purpose, the data it uses and whether it influences decisions about candidates or employees. It is important to assess which GDPR and AI Act obligations apply and when, and whether to involve the Works Council before a decision on rollout.
Step 2. Prepare for Rollout of an AI tool in the Netherlands
For example if the employer is proposing to toll out an AI tool, an HR chatbot that answers policy questions or an AI recruitment screening tool that filters applicants, each tool requires different assessments, even when supplied through one platform.
Actions:
- Describe the proposed use and why the Dutch organisation needs it (case for change).
- Identify the people affected, such as employees, job applicants or contractors.
- Summarise the information the tool receives and the output it produces.
- Record who can see the output and which decisions it could influence.
- Record which functions are already enabled in the Netherlands and which the employers is proposing to enable.
- Assess the impact on the Dutch organisation, including changes to workflows, responsibilities, workload and decisions affecting staff.
- Ask the supplier to confirm where data is hosted, processed and backed up, and from which countries the supplier or its subcontractors can access it. Record whether those locations are inside or outside the European Economic Area (EEA).
- Ask the supplier for its EU AI Act classification and rationale, intended purpose and instructions for use. Check these against the proposed Dutch configuration. For example: screening or evaluating candidates and monitoring or evaluating workers in an AI tool may fall within the high-risk employment category. Read more about this high-risk employment category here: EU Artificial Intelligence Act: Scope Requirements.
Step 3. Check Privacy and Test the Safeguards
- Assess whether a data protection impact assessment (DPIA) is required before processing.
- If the AI tool or system can automatically reject for example applicants before meaningful human review, assess GDPR Article 22 and any applicable exception and safeguards.
- Document how employees or users of the tool can raise a concern.
- Read the applicable GDPR Articles 13 to 15, 22 and 35 for guidance.
- Reach out to the vendor for their terms on data retention, access and reuse.
Step 4: Involve the European Works Council and Dutch Works Council
For group rollouts of AI tool involvement of the European Works Council where its transnational remit is required For the local Dutch Works Council it is important that they are informed about the new AI tool or changes in the current one as this can be trigger their Right of Advice under Article 25 of the Dutch Works Councils Act (WOR) or prior consent under Article 27 WOR.
HR Services Support
Human in Progress provides Works Council consulting, HR services, and guidance, alongside Academy courses for Works Council members and executives such as CEOs, CFOs, HR Director and management.
Contact Human in Progress to schedule a call and discuss your need for support with Artificial Intelligence matter in HR.
