{"id":4463,"date":"2026-05-08T18:01:23","date_gmt":"2026-05-08T16:01:23","guid":{"rendered":"https:\/\/transformingthedots.nl\/?p=4463"},"modified":"2026-05-16T16:22:00","modified_gmt":"2026-05-16T14:22:00","slug":"eu-ai-act-voor-nederlandse-organisaties-wat-je-echt-moet-weten-en-doen","status":"publish","type":"post","link":"https:\/\/transformingthedots.nl\/en_US\/eu-ai-act-voor-nederlandse-organisaties-wat-je-echt-moet-weten-en-doen\/","title":{"rendered":"EU AI Act for Dutch organizations: what you really need to know and do"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

EU AI Act for Dutch organizations: what you really need to know and do<\/h1>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

May 8, 2026 \u00b7 Joos Luteijn \u00b7 8-minute read<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

A practical guide, not a legal text<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

On May 7, 2026, Europe decided that some parts of the AI Act would take effect later than planned. Organizations that use AI to assess people\u2014such as CV screening, loan applications, municipal benefits, and school results\u2014have until December 2027 instead of August 2026. It sounds like a relief, and for some, it is.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

However, nothing changes for the most important part of the law. AI literacy among your employees has already been required since February 2025. Unacceptable AI applications remain prohibited. And if someone in your organization misuses AI, the bill lies with you as the employer, regardless of which date is stated in the law.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

This guide explains what the AI Act means for your organization. What is mandatory, what is not, and what to do if you haven't arranged anything yet. With practical examples and without having to hire a battery of lawyers first.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Does this law actually apply to my organization?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Almost certainly, yes. The law distinguishes between those who make AI and those who use AI. The makers are a handful of large companies (OpenAI, Microsoft, Google). The users are virtually everyone. If your people use Copilot in Word, ChatGPT in the browser, or an AI chatbot on the website, then you fall under the law.<\/p>

Three common misconceptions:<\/p>

  • \u201cWe do not develop AI, so this does not affect us.\u201d<\/strong> That is incorrect. Anyone who deploys AI bears independent obligations, even if the tool belongs to someone else.<\/li>
  • \u201cWe are too small for this law.\u201d<\/strong> That is incorrect. The size of your company does not matter. However, there are lighter obligations and proportional supervision for SMEs.<\/li>
  • \u201cOur AI is for internal use only, so no problem.\u201d<\/strong> That is incorrect. Internal use is covered by the law just as much as external use.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t

    The four risk levels, with examples from practice<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    The law does not look at which AI you use, but at what you do with it. The same model can be low risk in one context and high in another. Four levels, increasing in severity.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t

    1. Forbidden<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    AI that you are simply not allowed to deploy. For example, systems that monitor employees' emotions during their work (think of call center software that measures \u201cstress\u201d), AI that manipulates vulnerable groups, or social scoring where people receive a general \u201cscore\u201d based on their behavior. Since May 7, one application has been added: AI that generates non-consensual sexual images or abusive material. That ban takes effect on December 2, 2026.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t

    2. High risk<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    AI used to make decisions that directly affect people. This is the category receiving the most attention, and rightly so. Examples:<\/p>

    • A recruiter who uses AI to screen resumes or rank candidates.<\/li>
    • A bank or leasing company that uses AI for loan applications.<\/li>
    • A municipality that uses AI to assess benefit applications or detect fraud.<\/li>
    • An educational institution that uses AI for admissions or for assessing exam work.<\/li>
    • A healthcare institution with AI in medical equipment that supports diagnoses.<\/li><\/ul>

      For these applications, the law requires that you know what the system does, can demonstrate that it operates fairly, that a human can intervene, and that you document its use. Not impossible, but certainly work. Last week, the deadline was pushed back to December 2027, or August 2028 if the AI is embedded in a physical product (medical equipment, machinery).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t

      3. Limited risk<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      AI about which you must be transparent, but for which few rules apply otherwise. A chatbot on your website must make it clear that it is not human. AI-generated content (images, video, audio) must be provided with a digital watermark as of December 2, 2026. Customer service using AI to formulate answers must mention this in their communication.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t

      4. Minimal risk<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Virtually everything you use daily. Spam filters in Outlook, grammar check in Word, Netflix recommendations, translations via Google Translate, autocomplete on your phone. No obligations under the AI Act, although the GDPR and other legislation remain applicable.<\/p>

      The practical question is: in which category does AI usage fall within my organization? For most companies, the answer is: primarily minimal and limited, sometimes high risk. Those who do not engage in recruitment, credit assessment, or make government decisions are rarely in a high-risk category.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t

      Which deadlines take effect when<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Due to the Omnibus deal of May 7, some dates have been shifted. Below is the current status.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t