Netherlands

The Netherlands has not adopted any express constitutional provisions specifically regulating AI. Considering the overarching provisions in international treaties, Dutch domestic constitutional protections will be discussed in the context of specific human rights concerns in Section 1.2, below.

Right to privacy and data protection

The right to privacy is enshrined in several legal provisions, including Article 10 of the Dutch Constitution, Article 8 of the ECHR, and Article 7 of the Charter. This right covers various aspects, such as personal autonomy, respect for private and family life, and the protection of home and correspondence. Interference with this right is allowed under specific circumstances, such as national security or public safety, provided it is legally justified and necessary in a democratic society.

The extensive data processing capabilities of AI systems can infringe upon privacy rights, particularly through smart devices and Internet-of-Things (IoT) applications. Government data collection in smart cities further exacerbates these concerns.

These privacy concerns are reflected in European case law. The Court of Justice of the European Union (CJEU) has ruled that government surveillance can violate privacy rights. This principle extends to employer surveillance of electronic communications using AI, as highlighted in the European Court of Human Rights ruling in Bărbulescu v. Romania (2017).

In the Netherlands, System Risk Indication (SyRI), which is a profiling system used to detect social benefits and tax fraud, was ruled by the District Court of The Hague to infringe on Article 8 of the ECHR due to its significant interference with privacy and lack of transparency.

More recently, in March 2026, the Amsterdam District Court issued an injunction in summary proceedings against X (as the developer of the Grok AI chatbot), prohibiting the generation and distribution of non-consensual sexual imagery of persons residing in the Netherlands, as well as the production and distribution of child pornographic material under Dutch law. Although the court did not clarify whether X is liable for the generated images, it held that X unlawfully and culpably contributed to a climate of online transgressive behaviour.

Autonomy and health

AI can also threaten individual autonomy, for example through emotional AI, which recognises and measures human emotions via behaviour, facial expressions, body language and voice. While offering potential benefits, emotional AI poses risks of surveillance and manipulation, potentially leading to self-censorship and chilling effects on freedoms of expression, association and thought.

The impact of AI on human autonomy is illustrated by the DPA’s investigations into the use of chatbots to provide voting advice for the 2025 national elections and the 2026 municipal elections in the Netherlands. The DPA warned that chatbots, despite presenting themselves as neutral, may provide incorrect voting advice and exhibit significant bias, thereby directly affecting the integrity of free and fair elections (see www.autoriteitpersoonsgegevens.nl/actueel/ap-waarschuwt-chatbots-geven-vertekend-stemadvies).

Beyond its impact on autonomy, the DPA has also identified risks to the health of individuals, noting that people may use AI for medical advice, as a digital therapist, or as a substitute for professional help. The DPA warns that improper use of chatbots poses serious risks for individuals seeking assistance with mental health issues. Moreover, the use of such AI applications means that the provider may gain access to highly sensitive personal data, which creates additional privacy risks (see AP’s Vision on Generative AI of February 2026).

Freedom of expression

Freedom of expression, including the right to access information, is protected by Article 7 of the Dutch Constitution, Article 10 of the ECHR, and Article 11 of the Charter. Restrictions on this right can only be imposed through formal legislation, with a strong prohibition against preventive censorship. Governments must ensure access to diverse and unbiased information. However, AI systems deployed by search engines and social media platforms can create “filter bubbles”, thereby limiting information diversity. While AI can be used to combat hate speech, it also risks censoring legitimate yet controversial expressions. Striking an appropriate balance between pursuing legitimate goals and preserving freedom of expression remains a key challenge.

Right to a fair trial

The right to a fair trial is safeguarded by Articles 6 and 13 of the ECHR and Article 47 of the Charter. This includes fair proceedings, impartial judges and well-reasoned judgments. The use of AI in judicial decisions can jeopardise these principles, especially where the AI system lacks transparency or introduces biases. In addition, AI in judicial contexts is considered high-risk under the EU Artificial Intelligence Act (EU AI Act). In this context, the Dutch courts have issued a statement on the responsible and innovative use of AI in the Dutch judicial system, setting out a 10-point plan for the responsible use of AI by Dutch courts (see www.rechtspraak.nl/organisatie-en-contact/innovatie-binnen-de-rechtspraak/ai-decree). AI is currently not used for judicial decision-making, but experiments have been conducted in which AI assists in drafting the text of judgments (see www.rechtspraak.nl/organisatie-en-contact/organisatie/rechtbanken/rechtbank-rotterdam/nieuws/rechtbank-rotterdam-doet-proef-met-artificial-intelligence-als-schrijfhulp-in-een-strafvonnis).

AI may also impact the right to a fair trial where other legal operators, such as lawyers, use AI in legal proceedings. There have been multiple cases in which a party referred to hallucinated content (e.g. non-existent or incorrect case law). This may constitute a breach of the parties’ duty of truth, in which case the court may draw such conclusions as it deems appropriate. Courts have generally left hallucinated case law out of consideration, but could also take more far-reaching measures, such as rejecting a claim. Notably, judicial disapproval is evident in several of these decisions, not only because hallucinated references waste court resources, but also because they impose a burden on the opposing party to verify the cited content and prepare a defence. Examples include ECLI:NL:RBDHA:2026:9527, ECLI:NL:RBOBR:2026:909, ECLI:NL:RBGEL:2026:1608 and ECLI:NL:RBOBR:2026:934.

AI could also impact the creation and status of legal arguments and evidence. Courts have generally declined to accept AI-generated legal arguments or reports as evidence, on the basis that the underlying sources cannot be verified. However, some courts have reached this conclusion specifically because the prompt and settings of the AI system were not disclosed, thereby leaving open the possibility that full transparency regarding the use of AI could lead a court to accept such evidence to some extent (see ECLI:NL:RBOBR:2026:2232, ECLI:NL:GHSHE:2026:232, ECLI:NL:GHAMS:2025:2647, ECLI:NL:TAHVD:2025:151, ECLI:NL:GHDHA:2024:1771 and ECLI:NL:GHDHA:2024:711). A further challenge is demonstrating that AI has been used for certain purposes where such use is denied, although the transparency obligations under the EU AI Act may mitigate this challenge once they come into effect. This issue has arisen particularly in the context of academic fraud. In several cases, students used AI for school projects, which led the relevant exam committee to declare fraud under the applicable exam regulations. Students frequently claim that they did not use AI but were merely careless with their sources or cited them incorrectly. However, courts tend to conclude that AI was used where the sources show signs of hallucinations (see ECLI:NL:RVS:2026:2090, ECLI:NL:RVS:2025:3585 and ECLI:NL:RVS:2025:3551) or where there are other indicators of AI use (e.g. where the assignment contained multiple mentions of “thought for X seconds”, see ECLI:NL:RVS:2026:459).

In the Netherlands, patents are governed by the Dutch Patents Act (Rijksoctrooiwet) and the European Patent Convention (EPC). To obtain patent protection, an invention must be novel, inventive and capable of industrial application. Various aspects of AI systems, such as inference models, network architectures and training methods, may fall within the scope of patentability, provided they meet these requirements.

According to the European Patent Office’s (EPO) Guidelines for Examination, algorithms and models are generally considered abstract mathematical concepts, which are excluded from patentability when claimed as such. However, this exclusion does not apply when they are included in a computer program or implemented in a computer. It is also notable that the EPO has rejected patent applications where an AI system is indicated as the inventor, as the EPC requires the inventor to be a natural person (EPO Legal Board of Appeal, cases J 8/20 and J 9/20, oral proceedings on 21 December 2021).

The Netherlands Patent Office (Octrooicentrum Nederland) currently advises caution when sharing confidential information relating to inventions with AI systems, as the input data may be reused for AI training purposes, which could compromise the novelty of the invention. It also recommends against using AI to draft patent applications, on the basis that AI systems lack sufficient understanding of the relevant technical and legal nuances.

According to the Dutch Copyright Act, a work is protected by copyright if it is original and personal, meaning it is the author’s own intellectual creation.

With the rise of AI applications, such as ChatGPT, questions about copyright ownership of AI-generated works have emerged. In the Netherlands, in the absence of relevant case law, the general consensus is that copyright protection does not extend to works created with AI in the absence of sufficient creative choices by the creator, even where elaborate human instructions are given. In 2011, the CJEU ruled that creative input in various phases (e.g. preparation, selection and editing) is necessary for copyright protection. This principle may also be applied to AI-generated content. The extent of human creativity required for authorship remains an open question, awaiting further clarification through future court rulings.

The output of GenAI applications may also result in copyright infringements if users fail to prevent the creation of works similar to existing ones, as GenAI bases its output on existing data. Additionally, the question arises as to whether the training of AI on copyright-protected works constitutes infringement. The EU AI Act addresses this latter issue by establishing certain provisions, including clarifying that the text and data mining exception may be relied upon for the use of copyright-protected materials for training purposes, provided that the applicable requirements are met (e.g. respecting opt-outs and technical protection measures, and limiting use to training only). Article 53(1)(c) of the EU AI Act furthermore mandates that providers of general-purpose AI models implement policies to respect EU copyright law, particularly regarding the reservations of rights expressed under Article 4(3) of the EU Directive on copyright and related rights in the Digital Single Market.

Trade secrets are protected by the Dutch Trade Secrets Protection Act, implementing Directive (EU) 2016/943. Information is considered a trade secret if:

• it is not generally known to the public or known by or easily accessible to persons who normally deal with that type of information;
• it has commercial value because it is a secret; and
• it is subject to reasonable measures to keep it secret.

The use or implementation of AI tools, such as ChatGPT, poses substantial risks to the protection of trade secrets. In many cases, by agreeing to the terms of use of such providers, individuals consent to the provider using their input to further develop and improve its services. As a result, information shared with such providers (some of which may constitute trade secrets) may no longer qualify as secret and consequently lose its protected status under the Dutch Trade Secrets Protection Act. This risk is further compounded by the obligation under the EU AI Act for providers to provide a sufficiently detailed summary of the content used for training. It is therefore advisable to implement strict internal guidelines and reasonable measures, and to provide mandatory training for employees to raise awareness of the potential risks.

Notwithstanding the growing relevance of AI to intellectual property law, there are currently no known ongoing proceedings or judgments in the Netherlands specifically addressing the implications of AI for intellectual property rights.

In the Netherlands, a “database” is protected under the Dutch Database Act (Databankenwet). A database is defined as a collection of data that is systematically arranged and the creation of which required substantial investment. The Database Act may therefore also apply to training datasets or large language models to the extent that the datasets concerned constitute structured data.

The Database Act aims to protect companies that have made significant investments and efforts in creating a database or dataset and prevents third parties from using the same database or dataset without themselves having made such investments. Database rights are infringed if a person extracts (which includes permanent or temporary transfer) or reutilises (which means making the contents available to the public) all or a substantial part of the contents of a protected database without the rights holder’s consent. However, the text and data mining exception, as explained in Section 2.2 above, also applies to the use of databases to train AI.

Any processing of personal data is governed by the General Data Protection Regulation (GDPR) and, in the Netherlands, the Dutch GDPR Implementation Act (Implementatiewet Algemene Verordening Gegevensbescherming).

The term “processing” is defined broadly under the GDPR and encompasses virtually all handling of personal data, including storage. As such, AI systems will frequently involve the processing of personal data at some stage of their operation.

AI and GDPR

Although the GDPR does not currently specifically mention AI, it does indirectly regulate AI, in particular through provisions governing automated decision-making (ADM, Article 22, GDPR). As AI systems are often used to take such automated decisions, the ADM requirements under the GDPR can be seen as an additional form of protection, on top of the protection afforded under the EU AI Act.

At the same time, in some respects, there is tension between the GDPR and AI. For example, the GDPR requires that personal data is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. AI systems, however, typically require large datasets, especially during their training phase, and their capacity to perform a wide variety of tasks can make it difficult to precisely determine the purposes for which data is being processed. Compliance with the GDPR’s transparency requirements may also be challenging given that most AI systems have complex algorithms and continuous learning capabilities.

Insofar as the design, development or use of AI systems involves the processing of personal data, the EU AI Act will apply in addition to the GDPR. The EU AI Act does not affect the obligations of providers and deployers of AI systems under the GDPR, and data subjects continue to enjoy all the rights and guarantees afforded to them under the GDPR. Moreover, there is considerable overlap between the data protection principles under the GDPR and the principles and requirements established by the EU AI Act for the safe development and use of AI systems.

The new proposals for the Digital Omnibus Regulation and the Digital Omnibus on AI Regulation aim to further align the EU AI Act and the GDPR. Some key proposed changes include:

• the introduction of a new exception permitting the processing of special categories of personal data for the purposes of detecting and correcting bias;
• the possibility, under specific circumstances, to process residual special categories of personal data for the training of AI systems; and
• the explicit recognition of the processing of personal data for the training of AI as a legitimate interest, subject to prescribed mitigating measures.

Dutch DPA

The DPA has developed rules of thumb for organisations developing and using AI (see www.autoriteitpersoonsgegevens.nl/themas/algoritmes-ai/algoritmes-ai-en-de-avg/regels-bij-gebruik-van-ai-algoritmes). The DPA states that organisations should ensure compliance with the GDPR’s general processing principles and, in the development phase of an AI system, also with the principles of privacy by design and default. It also urges organisations to conduct a data protection impact assessment and a human rights impact assessment prior to developing or using a new AI system.

Furthermore, the DPA regularly publishes on the topic of AI. It periodically publishes a Report AI & Algorithms Netherlands (RAN) on trends in AI, associated risks, and the governance of AI and algorithms. The DPA recently published its vision on generative AI and intends to publish further guidance on the privacy preconditions for the use of AI. In addition, the DPA aims to stimulate the responsible use of AI by publishing a handbook on the ethical use of AI.

In terms of enforcement, the Dutch DPA has been particularly active in recent years:

• In 2021, the Dutch DPA fined the Dutch Tax Authority (Belastingdienst) for discriminatory and unlawful conduct in connection with the use of a risk-classification model (see autoriteitpersoonsgegevens.nl/documenten/boete-belastingdienst-kinderopvangtoeslag). For years, the Tax Authority had used this model to detect incorrect applications for childcare benefits and potentially fraudulent use of the benefits system. The risk-classification model incorporated a self-learning algorithm in which a person’s non-Dutch nationality was included as a risk indicator. This led to algorithmic bias that caused many parents and caregivers to be wrongfully classified as fraudulent. The DPA held that the use of this model violated Articles 5 and 6 of the GDPR and imposed a fine of EUR 2.75 million on the Dutch Tax Authority. The Dutch government resigned over this scandal, known as the “benefits affair”.
• In 2023, the Dutch DPA intensified its supervision of the Dutch Institute for Employee Benefit Schemes (UWV) in relation to the UWV’s use of an algorithm without a sufficient legal basis under the GDPR (see autoriteitpersoonsgegevens.nl/actueel/ap-ziet-toe-op-hersteloperatie-uwv-na-illegale-inzet-algoritme). The algorithm was used to identify individuals who were wrongly receiving benefits from the Dutch government while residing abroad.
• In 2024, the Dutch Authority for Digital Infrastructure imposed a fine of EUR 175,000 on Odido for privacy violations in connection with the use of location data from mobile phones to train an algorithm. The Dutch DPA is closely monitoring the remedial actions Odido is taking as a result of the fine (see autoriteitpersoonsgegevens.nl/actueel/ap-houdt-vinger-aan-de-pols-bij-odido).
• In 2024, the Dutch DPA fined Clearview AI Inc. a total of EUR 30,500,000 for multiple serious violations of the GDPR in connection with its facial recognition service Clearview for law-enforcement and public defenders (see autoriteitpersoonsgegevens.nl/documenten/besluit-boete-clearview-ai). Clearview built a database of over 30 billion photographs by systematically scraping publicly accessible internet sources and used facial recognition technology to identify individuals across images. The Dutch DPA found five categories of GDPR violations, including the unlawful processing of personal and biometric data, inadequate transparency, and failure to facilitate access requests.

Beyond its enforcement activities, the Dutch DPA was also appointed as the competent regulator for algorithms in the Netherlands on 1 January 2023. In this capacity, the Dutch DPA cannot yet exercise specific investigative powers, but this is expected to change in the near future. For further details, see Section 9, below.

Synergy between open data and AI

Open data and AI have the potential to support and enhance each other’s capabilities. On the one hand, open data can improve AI systems by serving as a valuable resource that provides diverse and extensive datasets. The more varied and extensive the data an AI system has access to, the better its predictions and overall performance. For instance, an AI system designed to forecast consumption trends in Europe would be more accurate if it is trained on a wide-ranging dataset that includes transactions from various countries, cities and socio-economic backgrounds. In this way, the availability of open data contributes to better performing AI systems.

On the other hand, AI can unlock additional value from open data. By applying AI to extensive datasets, it is possible to uncover patterns and insights that might not have been revealed through more traditional methods of analysis. As such, AI can be a powerful analytical tool, leveraging the value of open data.

An example of open data being combined with AI is the European Commission’s European Cancer Imaging Initiative (see www.digital-strategy.ec.europa.eu/en/policies/cancer-imaging). The initiative aims to create an open dataset that links existing resources and databases across Europe, working towards a more open, available and user-friendly infrastructure for cancer imaging. As part of the initiative, cancer images will be made available to an AI testing and experimentation facility.

Data sharing regulations

Increasing access to high-quality open data is key to unlocking the synergy between open data and AI. In the Netherlands, several domestic laws are in place that may contribute to this aim, including:

• The Government Information Reuse Act (Wet hergebruik van overheidsinformatie), which sets out the conditions under which citizens and companies can request specific information from governmental bodies for reuse. In general, the requested information must be provided, unless exemptions or restrictions apply, such as those relating to GDPR compliance.
• The Open Government Act (Wet open overheid), which establishes provisions for actively making governmental information public and easily accessible. The Act aims to enhance government transparency.

On a European level, new regulations and directives have been adopted as part of the European Strategy for Data:

• The Data Governance Act. This regulation entered into force on 23 June 2022 and, following a 15-month grace period, has been directly applicable in all Member States since September 2023. The Data Governance Act aims to increase data availability and promote data sharing between sectors and EU Member States. It governs the processes and structures facilitating voluntary data sharing.
• The Data Act. This regulation entered into force on 11 January 2024 and has applied in all Member States since September 2025. The Data Act complements the Data Governance Act by providing clarity on who has the ability to create value from data and the conditions under which they can do so. The Act aims to promote a fair distribution of the value derived from data by establishing clear and equitable rules for accessing and utilising data within the European data economy.

Under the EU AI Act, the use of biometric categorisation systems that rely on sensitive characteristics is prohibited, as is the untargeted collection of facial images from the internet or CCTV footage for the purpose of creating facial recognition databases. Additionally, the EU AI Act prohibits the use of AI for emotion recognition in workplaces and schools, social scoring, predictive policing solely based on profiling or assessing individual characteristics, and any AI systems that manipulate human behaviour or exploit vulnerabilities.

The GDPR contains a general prohibition on processing biometric data (which includes voice data and facial recognition data) for the purpose of uniquely identifying a natural person. Specific exemptions to this prohibition are set forth in the Dutch GDPR Implementation Act, including where prior explicit consent has been obtained, or where processing biometric data is necessary for authentication and security purposes. When biometric data is processed for purposes other than uniquely identifying a natural person, such as for the purpose of training algorithms, the general processing prohibition does not apply.

The Dutch DPA states in its guidance that facial recognition is prohibited in most cases (see www.autoriteitpersoonsgegevens.nl/documenten/juridisch-kader-gezichtsherkenning). The Dutch DPA also confirms in this guidance that it considers the processing of biometric data for the purpose of confirming an individual’s identity to fall equally under the processing prohibition of Article 9 of the GDPR. This has been further confirmed by the enforcement procedures of the DPA against Clearview AI Inc. in connection with the creation of a facial recognition service (see Section 3.2, above) and an investigation into the use of facial recognition by Dutch holiday parks (see www.autoriteitpersoonsgegevens.nl/en/current/holiday-parks-adjust-use-of-facial-recognition-after-investigation-by-dutch-dpa).

The right to non-discrimination is enshrined in Article 1 of the Dutch Constitution, Articles 21 and 23 of the Charter, and Article 14 of the ECHR. Discrimination based on any ground such as sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or other opinion, membership of a national minority, property, birth, disability, age, or sexual orientation is strictly prohibited. Dutch national law also includes specific legislation that implements various EU principles, such as the General Equal Treatment Act, as well as sector-specific acts addressing the aforementioned grounds.

AI systems may threaten the right to equal treatment by producing biased outcomes, a phenomenon known as algorithmic bias. This bias can arise from several factors:

• Replication and exaggeration of societal biases. AI systems can replicate and even exaggerate existing biases or discrimination present in the training data.
• Design bias. Bias or discrimination can also stem from the instructions provided by the AI system’s designers.
• Contextual fairness issues. AI systems may fail to account for contextual notions of fairness without human involvement, especially when deployed in social contexts that already undermine the rights of certain groups.

The opacity of AI decision-making processes, often referred to as the “black box” problem, can further exacerbate these issues. For example, the DPA’s enforcement action concerning the childcare benefits system highlighted how a lack of transparency can lead to biased outcomes. Systems that were designed to detect misuse of the benefits scheme mistakenly labelled over 20,000 parents as fraudsters, a disproportionate number of whom had an immigration background. A more recent example concerns the use of an algorithm to determine whether an individual should be granted a short-stay visa, in which the court identified that the algorithm may contain bias that could result in discrimination. Explicitly referring to the lessons learned from the discriminatory algorithm in the childcare benefits affair, the court ordered an ex officio assessment of the algorithm (see ECLI:NL:RBDHA:2025:14544).

The Netherlands Institute for Human Rights

In 2022, the Netherlands Institute for Human Rights ruled in favour of a university student who had presented sufficient evidence to establish a presumption of algorithmic discrimination. The student alleged that the university had discriminated against her by using anti-cheating software during the COVID-19 crisis. The software employed facial recognition algorithms that failed to detect her when logging in for online exams, which the student argued was due to her darker skin colour. More recently, in 2025, the Netherlands Institute for Human Rights found that Meta’s advertisement algorithm may create a one-sided profile of a user based on the user’s clicking behaviour, resulting in unjustified stereotyped advertisements (e.g. job advertisements for receptionists were shown 97% to female users and job advertisements for mechanics were shown 96% to male users).

These cases underscore the importance of addressing algorithmic bias in AI systems to ensure compliance with anti-discrimination legislation and to uphold the principles of equality and non-discrimination.

Accordingly, the deployment of AI must be carefully managed to prevent and mitigate biases that could result in discrimination. Ensuring transparency, accountability and fairness in AI systems is essential to safeguarding fundamental human rights.

The Netherlands Institute for Human Rights will also serve as a fundamental rights authority in the enforcement of the EU AI Act, as further described in Section 9, below.

In the Netherlands, cybersecurity-related requirements applicable to operators of critical digital infrastructure are primarily governed by the Network and Information Systems Security Act (NISSA, Wet beveiliging netwerk- en informatiesystemen), implementing the NIS 1 Directive ((EU) 2016/1148). The NISSA applies to operators of essential services in sectors such as energy, transport, banking and healthcare, as well as digital service providers, requiring both categories to implement appropriate technical and organisational security measures and to notify competent authorities of significant incidents without undue delay. The National Cyber Security Centre (NCSC) serves as the national point of contact, playing a central coordinating role in incident response and information sharing at both national and EU level.

The NIS 2 Directive ((EU) 2022/2555) significantly expands this framework, broadening the scope of covered sectors, tightening incident reporting timelines, introducing senior management accountability, and elevating maximum administrative fines to EUR 10 million or 2% of global annual turnover for essential entities. Transposition into Dutch law is being effected through the Cybersecurity Act (Cyberbeveiligingswet), which passed the Dutch House of Representatives (Tweede Kamer) in early 2026 — missing the October 2024 transposition deadline — and is currently pending before the Dutch Senate (Eerste Kamer). For organisations deploying AI systems within or alongside critical infrastructure, the security-by-design, supply chain risk management, and incident response obligations under the new Act will be of direct and immediate relevance.

Algorithmic collusion

AI is anticipated to transform market competition, potentially resulting in new types of anti-competitive practices, such as algorithmic collusion. Unlike traditional collusion, which involves direct communication between competitors, the European Commission defines “algorithmic collusion” as any form of anti-competitive agreement or coordination among competing firms that is facilitated or implemented through automated systems.

AI can facilitate dynamic price adjustments and coordinated interactions between competitors on digital platforms, which may foster anti-competitive behaviour. Additionally, dominant companies may use AI to exclude competitors from the market by giving preferential treatment to their own products and services. AI may also be used by manufacturers to monitor, track and control resale prices.

These actions may infringe Article 6 of the Dutch Competition Act (Mededingingswet) and Article 101 of the Treaty on the Functioning of the European Union (TFEU).

Competition is regulated by the Dutch Competition Act and the TFEU. The Netherlands Authority for Consumers and Markets (Autoriteit Consument en Markt, ACM) is the competent supervisory authority for competition matters and has published a position paper on the oversight of algorithms in 2020, which companies may consult. In 2025, the ACM announced that it will initiate an inquiry into computer-based consumer pricing, aimed at exploring the concrete effects of computerised and personalised pricing. It started with a market study into computer-driven consumer pricing in the aviation sector, examining how airlines use dynamic and potentially personalised pricing algorithms to set ticket prices for consumers resident in the Netherlands. The study is examining whether algorithmic pricing contributes to reduced price transparency, difficulties in price comparability, or risks of tacit coordination between pricing algorithms.

AI agents are not specifically addressed in the EU AI Act, and under Dutch law AI agents have not been recognised as having legal personality, contractual capacity or the ability to act as legal principals. Only natural persons and legal persons (companies, associations, public bodies) have legal personality under Dutch law. In the absence of Dutch case law on this topic, there is uncertainty as to how AI agents should be qualified under Dutch law, whether entities using an AI agent are bound by the agreements concluded by their AI agent, and to what extent the party engaging an AI agent can be held liable for the acts of the agent. It is currently assumed that a party can be bound by the agreements concluded by its AI agent, provided that the agent’s conduct gave rise to a legitimate expectation on the part of the other party that an agreement had been concluded. Depending on how the AI agent is used, it may also be possible to be held liable for the actions of the AI agent (e.g. where it commits an unlawful act). The AI Liability Directive could have provided clarity in this regard, but it was withdrawn in 2025.

There are currently no sector-specific agentic AI regulations in the Netherlands, nor have any binding rules specifically targeting agentic AI as a distinct category been adopted.

There are currently no specific liability rules governing AI systems in the Netherlands. Instead, general liability rules apply. AI systems are generally characterised as a service under Dutch law, in which case parties seeking to claim damages must rely on the standard liability regimes available under Dutch civil law, such as liability on the basis of an unlawful act (onrechtmatige daad) or an imputable failure to perform contractual obligations (toerekenbare tekortkoming). However, where AI is integrated as a part or component of a so-called “movable product” (roerende zaak), the rules on product liability may also provide an avenue to claim damages caused by the product. This may be the case, for example, where damages are caused by a defect in the AI system of a self-driving car. In such circumstances, the producer of the product may be held strictly liable for defects in the product. Given that the rules on product liability currently apply exclusively to movable products, it is generally assumed that AI systems offered as a standalone service or deployed as software do not qualify as a “product” within the meaning of the product liability regime. However, this remains a topic of ongoing legal debate that has not yet been resolved decisively in Dutch case law or legislation.

Currently, there is no case law in the Netherlands regarding liability for damages caused by AI systems in products. The intersection of AI and product liability gives rise to a range of complex and, as yet, unresolved legal questions. These include, for example, how to establish that a product containing AI was not defective at the time it was put into circulation, particularly given the effect of software updates and continuous learning capabilities on the assessment of liability. Further questions arise as to what a party may reasonably expect of an AI system from a safety perspective, considering that it is well known that AI systems can produce inaccurate or fabricated outputs (commonly referred to as “hallucinations”). In addition, satisfying the burden of proof in demonstrating that the AI component was defective and that the defect caused the damages in question presents significant evidentiary challenges.

The rules on product liability in the Netherlands are set to undergo significant changes, as the Dutch government is required to transpose the Revised EU Product Liability Directive (Directive (EU) 2024/2853) into Dutch law by 9 December 2026. Notably, this directive confirms that software may fall within the scope of product liability rules and explicitly encompasses AI systems as well. In the current legislative proposal of the Dutch government to transpose the directive, it appears that product liability rules will be declared directly applicable to software, even where such software does not form part of a movable product. If adopted in this form, this would expand the scope of product liability and create additional liability exposure for producers of AI systems. The directive further provides clarity on how certain complex legal questions, some of which are discussed above, should be addressed. By way of example, the directive provides that the producer should remain liable for the behaviour of the product even where that behaviour is capable of evolving after the product has been brought into circulation, thereby addressing the challenges posed by AI systems with continuous learning capabilities.

As discussed above, there is currently legal uncertainty as to whether standalone AI systems that are not embedded in a movable product may fall within the scope of the existing product liability regime, including the strict liability framework applicable to defective products. The prevailing view in Dutch legal doctrine is that such standalone AI systems do not qualify as products for the purposes of the product liability regime, although this remains a topic of ongoing legal debate. This position may, however, be subject to change following the transposition of the Revised EU Product Liability Directive, which is expected to bring standalone software, including AI systems, within the scope of the product liability framework. In cases where an AI system does form part of a movable product, the current consensus is that the Dutch product liability regime, including the strict liability rules as described above, will apply to the product in its entirety, encompassing the AI component integrated therein.

The Dutch framework for general product safety and recalls has traditionally been oriented towards movable products, and the Netherlands has not adopted any standalone national legislation specifically addressing the recall of AI systems. However, leaving a potentially harmful AI system in operation could be considered unlawful and may expose the producer of the AI system to claims for damages. Therefore, the general liability framework in the Netherlands may give rise to an obligation to recall defective AI systems (e.g. by withdrawing them from the market) to issue warnings to users, and to provide corrective updates.

In terms of a more formal legal framework governing product safety and recalls, two EU instruments are of particular relevance. First, the Cyber Resilience Act may apply to AI systems that qualify as products with digital elements, particularly where the defectiveness of the product relates to its cybersecurity features. Second, the General Product Safety Regulation (Regulation (EU) 2023/988) may provide an additional basis for product safety measures, as its scope explicitly extends to software, thereby encompassing AI systems offered on a standalone basis as well (as also confirmed in the EU AI Act).

As at the date of this publication, there are no Dutch civil court judgments or known pending claims in which the liability for damages caused by AI systems has been assessed under the product liability framework or under general tort law.

As an EU Member State, the Netherlands’ approach to AI regulation is driven first and foremost by EU law. The cornerstone of that framework is the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), which entered into force on 1 August 2024. The phased implementation of the EU AI Act is well under way. The prohibition on unacceptable-risk AI systems became applicable on 2 February 2025, obligations for providers of general-purpose AI models followed on 2 August 2025, and most of the high-risk AI and transparency requirements apply from 2 August 2026 (although the Digital Omnibus on AI Regulation may delay these obligations).

A draft bill implementing the EU AI Act into Dutch law (Wetsvoorstel Uitvoeringswet AI-verordening) has been published for consultation. Under that bill, the Minister of Economic Affairs and Climate Policy (EZK), acting through the RDI, will act as the notifying authority. The DPA, the RDI and various other sectoral supervisory authorities will serve as market surveillance authorities. This results in a decentralised but fragmented supervisory landscape, meaning that organisations may need to engage with multiple supervisory authorities in relation to a single query or incident. The sectoral supervisory authorities will be designated at a later date, although the Explanatory Memorandum to the Act (Memorie van Toelichting) already indicates which market surveillance authorities the government intends to appoint. These include the Inspectorate for the Environment and Transport (ILT), the Health and Youth Care Inspectorate (IGJ), the Netherlands Food and Consumer Product Safety Authority (NVWA), the Netherlands Labour Authority (NLA), the Authority for the Financial Markets (AFM) and the Dutch Central Bank (DNB), as well as designated market surveillance authorities for Dutch courts. The RDI and the DPA will also serve as market surveillance authorities and act as coordinating supervisory authorities, to improve cooperation between the supervisory authorities and ensure the consistent interpretation of key concepts under the EU AI Act. The precise allocation of responsibilities among the various authorities will be further detailed at a later stage. The DPA and the Netherlands Institute for Human Rights (CRM) will act as fundamental rights authorities to supervise the protection of fundamental rights. The bill implementing the EU AI Act does not impose additional substantive requirements beyond those set forth in the EU AI Act itself.

The Dutch government is continuously taking steps to ensure that the Netherlands remains at the forefront of developing innovative and responsible AI. Some key initiatives include:

• The founding of an AI factory. In 2025, the government published its industrial policy for the coming period, stressing that early adoption is key to staying ahead and benefiting most from new technology. For this reason, AI plays an important role in the policy. The government refers to the dependence on foreign cloud providers and wishes to prevent a similar dependence from arising in the field of AI. To expand the AI ecosystem in the Netherlands, the government intends, among other things, to found an AI factory in Groningen.
• Focusing on responsible AI applications. The Dutch AI Coalition (NL-AIC) collaborates with government, businesses, educational institutions, research organisations, and societal groups to develop socially responsible AI applications.
• GPT-NL. The Dutch government has committed significant resources towards projects that strive to strengthen sovereignty and strategic autonomy. One of these projects is GPT-NL, an initiative aimed at training a Dutch-English LLM aligned with public interests as derived from European regulations and constitutional fundamental rights. The project can be seen as a direct response to the rise and dominance of ChatGPT.
• AiNed Programme. This public-private multi-year programme, part of the National Growth Fund, aims to position the Netherlands among leading AI nations. It contributes to economic recovery and growth, strengthens the economic base, and promotes human-centred and responsible AI use.
• Government support for AI in education. The Ministries of Economic Affairs and Climate Policy (EZK) and Education, Culture and Science (OCW) are significantly investing in the National Education Lab AI (NOLAI). This initiative fosters collaboration among teachers, scientists and companies to advance responsible AI innovations in education.
• Safe AI Investments. Significant investments have been made in safe AI through the Innovation Centre for Artificial Intelligence (ICAI), which conducts extensive research and experimentation with a total budget of EUR 87 million.
• Supervision. The supervisory authorities have indicated that they are developing the supervisory framework in anticipation of their official designation as supervisory authorities. The DPA is currently the most advanced in this regard and already actively publishes on AI-related topics.

Domestic oversight

In addition to the policy initiatives described above, the Netherlands has been developing its domestic oversight framework for AI. The Dutch DPA is currently the competent regulator for algorithms in the Netherlands. As algorithm regulator, the DPA focuses on:

• identifying and analysing cross-sectoral and overarching risks and effects of algorithms and sharing knowledge about them;
• optimising (existing) collaborations with fellow regulators, market supervisors and state inspectorates, and mapping overarching supervision in the field of algorithms and AI; and
• developing joint standards for implementation and creating an overview of legal and other frameworks (by means of guidance). The algorithm regulator cannot yet exercise specific investigative powers.

The supervisory framework for the EU AI Act in the Netherlands is still to be formally established. In 2024, the DPA and RDI submitted a proposal to the Dutch government for the organisation of AI oversight in the Netherlands, placing the DPA at the centre while maintaining a role for sectoral regulators. The current legislative proposal, as described in Section 9.1, above, largely follows this 2024 model. Effective cooperation between supervisory authorities is considered paramount, with national competent authorities required to record their arrangements in a cooperation protocol, which is to be published in the Government Gazette (Staatscourant) at a later date. Key provisions include:

• AI supervision in various sectors is aligned as much as possible with existing product supervision. The supervision of high-risk AI products that already require CE marking may remain with existing sectoral authorities. For example, the Health and Youth Care Inspectorate (IGJ) retains supervision over AI in medical devices.
• The supervisory authority responsible for a high-risk AI system listed under Annex III will depend on the intended use of the AI system. The DPA will supervise most use cases, but, for example, the use of AI systems to evaluate the creditworthiness of natural persons will be supervised by the Dutch Authority for the Financial Markets (AFM). This ensures sufficient specialist knowledge and expertise.
• The same approach is taken in relation to prohibited AI, as set out in the Explanatory Memorandum to the Act (Memorie van Toelichting). The DPA will supervise most use cases, except for financial use cases, which will be supervised either by the AFM or De Nederlandsche Bank.
• For AI systems used in judicial proceedings, supervision is assigned to the Procurator General at the Supreme Court (for courts, courts of appeal, the Supreme Court and related bodies) and to the Chair of the Administrative Law Division of the Council of State, in order to safeguard the independence of the judicial authorities.
• The Minister of Economic Affairs and Climate Policy (EZK), acting through the RDI, and the DPA are jointly tasked with coordinating AI supervision at national level, contributing to cooperation between the market surveillance authorities and the consistent implementation and interpretation of the EU AI Act in the Netherlands, and supporting market surveillance authorities in developing the necessary knowledge, expertise and infrastructure.