We’re an Amsterdam-based company. So when the Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, reports that AI and algorithm governance in the Netherlands has worsened since its last assessment, that’s not news about some other market. It’s about ours.
On 5 March 2026, the AP published the sixth edition of its Rapportage AI & Algoritmes Nederland (RAN), its regular stocktake of the risks and effects of algorithms and AI across Dutch government and private organisations. The AP’s own composite measure, the AI Impact Barometer, has deteriorated since the previous edition. AP chairman Aleid Wolfsen has publicly warned that organisations need to act now to avoid “a new scandal,” and the AP is pressing the incoming cabinet to move faster on enforcing the EU AI Act.
Not a survey. A regulator’s own record
This differs from the boardroom research and UK reliability data covered elsewhere in this series. Those are third-party surveys of how executives and employees perceive the AI governance gap. The RAN is the supervisory authority’s own periodic assessment of the market it regulates: six editions in, with a barometer now trending the wrong way on the regulator’s own terms.
A survey can be dismissed as one pollster’s or vendor’s framing. A regulator reporting a worsening picture of the market it supervises is a different kind of signal, and an easy one to underweight because it arrives as a report rather than a headline fine.
The structure organisations now need to understand
Alongside the RAN, the AP published its 2026 annual plan, which sets a sharpened supervisory strategy for 2026 through 2028 around three themes: mass surveillance, AI, and digital resilience. Privacy supervision is no longer only about protecting personal data in individual cases. It increasingly covers structural questions of power, autonomy and transparency in a digital society, a far broader mandate than checking whether consent was obtained.
Then there is the Uitvoeringswet AI-verordening, the Dutch law implementing the EU AI Act. It was in public consultation from April to June 2026 and is now moving through the Council of State toward parliamentary debate. Its structure is distinctly Dutch: rather than creating a single AI regulator, it splits supervision across roughly ten existing sectoral bodies. The AP and the Rijksinspectie Digitale Infrastructuur (RDI) act as joint coordinators. The AP leads on prohibited AI practices, transparency obligations and most high-risk systems under Annex III of the AI Act (recruitment, education, benefits and law enforcement among them), and is the default supervisor wherever no sectoral regulator has remit.
Why coordinated supervision makes compliance harder
A single AI regulator at least gives an organisation one door to knock on. The Dutch model deliberately doesn’t. An organisation running AI across HR, customer service and financial risk scoring could answer to the AP for one use case, a sectoral regulator such as the AFM or DNB for another, and the RDI for a third, depending on what each system does and who it affects.
That isn’t a criticism. Using existing sectoral expertise is a defensible choice, and it fits how the Netherlands already governs public-sector algorithms through its national Algorithm Register. But it changes the compliance question. It is no longer simply “are we AI Act compliant?” It’s “for each system we run, which regulator has jurisdiction, and could we answer that if asked?”
Most organisations we talk to cannot answer that quickly. Under the coordinated model the Uitvoeringswet is building, that is no longer a minor gap. It is the first question a compliance programme needs a current answer to, system by system.
What “stepping up” looks like in practice
The AP’s message that government and private organisations must step up is easy to nod along to and hard to operationalise. Based on the priorities flagged in the RAN and the 2026 annual plan, three things are worth doing now rather than waiting for the Uitvoeringswet to pass.
First, an honest inventory of every AI system in use, mapped not only to what it does but to the regulator (one of the roughly ten sectoral bodies, or the AP by default) that would have jurisdiction. Second, real evidence, not a policy statement, that each system has a documented risk and impact assessment, the kind of record the AP’s supervisory approach is built to ask for. Third, a live view of which systems touch the Annex III high-risk categories (recruitment, education, benefits, law enforcement), since these carry the heaviest obligations and the most direct AP scrutiny.
A policy document in a shared drive, updated whenever someone remembers, won’t achieve this. It takes what every jurisdiction in this series points back to: a system that tracks which regulator governs what, which assessments are done and when they were last reviewed, kept current rather than reconstructed under pressure once a regulator asks.
Our own regulator has said on the record that the trajectory is wrong. For a company built in this market, that’s not background noise. It’s the clearest reason to make sure our answer to “could you prove it?” is better than most.
Talk to our team about what that inventory looks like for your organisation.
Sources
- RAN sixth edition (5 March 2026), AI Impact Barometer deterioration (four of nine gauges red, versus two previously), and AP chairman Aleid Wolfsen’s public comments. Verified directly against three independent outlets (Computable, Telecompaper, NOS). Wolfsen’s actual quote, “whoever wants to prevent a new scandal must act now,” is narrower than earlier drafts implied, and the text has been corrected to match.
- AP’s 2026 annual plan and 2026–2028 supervisory themes (mass surveillance, AI, digital resilience)
- Uitvoeringswet AI-verordening structure (AP and RDI as coordinators, roughly ten sectoral regulators, AP as default supervisor for Annex III systems outside existing sectoral remit, consultation April–June 2026, now before the Council of State