The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, is creating a new directorate for AI oversight. According to Binnenlands Bestuur (12 October 2026), Toezicht en Coördinatie AI/Algoritmes (TCA) has two departments. ARC, for AI/Algoritmes Risicoanalyse & Coördinatie, continues the AP's coordinating work on the societal effects of algorithms. MTA, Markttoezicht AI, prepares for actual enforcement of the AI Act. With the Rijksinspectie Digitale Infrastructuur (RDI), the AP is also working on an AI sandbox and a joint AI Coördinatiecentrum.
One detail in the same report matters more than the organisation chart: the AP is still not formally designated as an AI market supervisor. That requires the Dutch Uitvoeringswet AI-verordening, the national act implementing the AI Act, to enter into force.
The case for building early
The strongest argument for the AP's move deserves a fair hearing. Enforcement of a technical regulation fails if the regulator cannot test a system. The AI Act asks authorities to assess risk management, data governance and conformity for systems whose behaviour is statistical rather than deterministic. Article 70 requires each Member State to give its authorities "adequate technical, financial and human resources" and "a sufficient number of personnel permanently available". Hiring engineers and building test benches takes quarters, not weeks. A regulator that waits for the statute before it hires will arrive at enforcement unready, and that is worse for companies and citizens alike. Seen this way, the MTA is prudent preparation and not overreach.
The designation gap
The problem is that the preparation is running ahead of the law. The Binnenlands Bestuur report notes that the EU deadline for naming national supervisors passed on 2 August 2025, and that the Netherlands is more than a year past it. Article 70 sets that same date for publicly available contact information and for the first report to the Commission on authorities' resources. The Commission's AI Act regulatory framework page (last updated 19 October 2026) states that from 2 August 2026 "the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act." Dutch authorities therefore hold a responsibility without the statutory powers to discharge it.
The government's own consultation page shows what is being built. The internet consultation on the Uitvoeringswet ran from 20 April to 1 June 2026 and is now closed. It describes a supervisory system of ten existing market surveillance authorities that receive new tasks. They include the AP, the RDI, the IGJ, the AFM and DNB. Two of them jointly coordinate supervision and one acts as the central contact point. The bill also includes provisions for an AI test environment. A bill with this many moving parts still has to pass Raad van State advice and both houses of parliament, and the sources reviewed give no date for entry into force.
Why a distributed model raises the cost of delay
The Dutch design is sectoral by choice. Financial AI goes to the financial supervisors, health AI to the healthcare inspectorate, and the AP and RDI coordinate. That is defensible: a bank supervisor understands credit models better than a general-purpose AI office would. But the model has a cost that the delay magnifies. Ten authorities means ten interpretations of the same obligations unless the coordination layer works from the start. The AI Coördinatiecentrum is that layer, and it too is being assembled before it has a statutory basis. Binnenlands Bestuur reports that financing and capacity are still under discussion with the government. Letting a coordination body form without funding or formal powers is how guidance ends up inconsistent.
For innovators, the practical risk is uncertainty, not strictness. A Dutch startup shipping a hiring tool cannot yet say which authority will test it, on what methodology, or through which sandbox route. The penalties it is trying to avoid are not small. Under Article 99, prohibited practices carry fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. For SMEs the lower of the two figures applies, which is a useful safeguard. Still, a company that cannot learn what compliance looks like from a designated authority is making guesses about a fine that large.
What proportionate implementation would look like
Three steps follow from this analysis.
- Pass the designation act quickly and keep it narrow. The act should assign powers and procedures, and it should not add substantive duties beyond the AI Act. A lean text is faster to adopt and avoids Dutch-specific gold-plating that would weigh on domestic firms.
- Make the sandbox real before enforcement starts. The AI test environment in the bill is the right instrument for letting firms test with a regulator rather than against one. It should have published eligibility criteria and a clear safe harbour for good-faith participants.
- Publish methodology early. If the MTA builds technical testing capacity, it should publish what it tests and how. Transparency from the regulator is the cheapest form of compliance support.
The AP also carries an inheritance. Its algorithm-coordination work since 2023 gives it credibility on risk analysis, but market supervision is a different job. It means certifying and sanctioning commercial products, not mapping societal risk. Keeping ARC's analytical function separate from MTA's enforcement function inside one directorate is a sensible choice, and the AP should say openly how it will keep them apart.
Bottom line
The TCA is a reasonable response to a hard capability problem. Its weakness is not the AP's ambition but the timing of the law that should authorise it. Each month without a designation act leaves a body with sandbox plans and a coordination centre but no powers, and leaves companies guessing. Dutch policymakers should treat adoption of the Uitvoeringswet as the priority for innovation policy this winter.