The AI Regulation, also known as the AI Act, is a new piece of European legislation that sets out rules for the development and use of AI systems. Taking a risk-based approach, the regulation aims to ensure that AI is safe, transparent and non-discriminatory. For businesses and users of AI systems, this means, amongst other things, that they must comply with specific regulations. But who will be responsible for enforcing these in the Netherlands, and what are the relevant deadlines?
On 18 November, lawyer Julia van Leeuwen attended the technical briefing organised by the AP and RDI on the advice regarding the supervision of the AI Act.
Status and timeline of the AI Regulation
The AI Regulation came into force on 1 August 2024 and will be implemented in phases. The full set of regulations will come into force on 2 August 2027. Some key dates are:
• February 2025: a ban on AI systems posing unacceptable risks and mandatory AI literacy requirements
• May 2025: publication of codes of conduct for providers of general-purpose AI (GPAI)
• August 2025: implementation of obligations for GPAI providers
• August 2026: start of supervision of high-risk AI systems and transparency requirements applicable, amongst other things, to AI systems with a limited level of risk
Further details about the timeline can be found here.
Supervision and enforcement
In the Netherlands, the Dutch Data Protection Authority (AP) and the National Inspectorate for Digital Infrastructure (RDI) have called for coordinated, cross-sectoral supervision in a recommendation to the government. Integrating supervision into existing sectoral structures makes optimal use of knowledge and expertise, whilst preserving the mandates of sectoral supervisory authorities. Machinery, lifts and toys must already comply with various European safety regulations, as indicated by the CE marking. If these products incorporate AI, they must also meet the requirements of the AI Regulation.
For applications that cut across multiple sectors, cooperation between supervisory authorities is crucial. In the final advice on the supervision of the AI Regulation, the RDI and the AP are assigned a coordinating role. Drawing on their expertise, they will support and advise other supervisory authorities and promote cooperation. The Ministries must now give their opinion on the advice, but it is expected that no substantial changes will be made.
The AP and RDI expect – and believe it is essential – that the regulators overseeing the AI Act adopt a proactive approach. It is important to engage in dialogue with an AI provider or AI operator, identify areas for improvement and set reasonable deadlines for addressing them. Enforcement measures should only be taken if those reasonable deadlines are not met.
Erring on the side of caution is another important point regarding the enforcement of the AI Act. The AP and RDI state that if you are in any doubt as to whether an AI system falls under the ‘high-risk’ category under the AI Act, it is better to assume that it does and to endeavour to comply with the requirements of the AI Act from day one.
Challenges relating to implementing legislation
The European Commission has set 2 August 2025 as the deadline for appointing national supervisory authorities. It is highly unlikely that the Netherlands will be able to meet this deadline. State Secretary Zsolt Szabo has indicated that more time is needed to ensure careful decision-making regarding the structure of the supervisory framework. This means that, as of 2 August 2025, a supervisory authority for prohibited AI may not yet have been appointed. If the regulations are breached, affected citizens and businesses may initiate legal proceedings on the grounds of a tort. However, supervisory authorities can already take steps towards enforcement. Engaging in dialogue with the parties involved and assessing what needs to be amended always takes around half a year.
Priorities for businesses
It is essential for organisations to have a full understanding of their AI systems. Priorities include identifying which AI applications are in use, examining the associated roles and responsibilities, and determining the risk category of these systems. Strict obligations apply to high-risk AI, such as applications for social credit scoring, the manipulation of individuals and biometric identification for law enforcement. A timely and thorough analysis is therefore crucial.
As technology lawyers, we support AI providers and operators in this regard, for example by drafting contractual provisions and/or general terms and conditions and carrying out AI risk assessments.
