A regulator ahead of its statute
In October 2026 the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), created a new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA), to coordinate AI oversight and prepare for enforcement of the EU AI Act. Binnenlands Bestuur reported that TCA has two departments: one for risk analysis and coordination on algorithms and AI, and one preparing for market supervision. The AP has held a coordinating role on AI since 2023.
The AP is not yet the legal AI market supervisor. It is the intended one, but it is not formally designated. The designation depends on the Dutch implementing act (Uitvoeringswet AI-verordening), which has not entered into force. The same report notes that the EU deadline for naming national authorities, in August 2025, passed more than a year ago.
The case for moving early
The strongest argument for the AP's approach is that waiting would be worse. Some AI Act rules already apply, including the bans on certain AI uses, which have applied since 2 February 2025. Companies and public bodies deploying AI today need someone who can answer questions and build technical competence. Regulators that start hiring and testing only after the statute passes will be slow on the day enforcement begins. Regulation 2024/1689 itself, in Article 70, requires each Member State to establish or designate national competent authorities, so the AP is preparing for a duty the Netherlands already owes.
That argument is fair. A directorate that builds expertise is a reasonable use of public money. It does not create new obligations for anyone.
Where the risk lies
The weaknesses are in the design of the system the AP will operate, not in the directorate itself.
The Dutch model is hybrid. According to Stibbe's analysis, ten market surveillance authorities each oversee AI in the domain they already regulate. The AP covers prohibited practices, transparency obligations and much of the high-risk AI used in recruitment, education, credit and government decisions. The AP and the Rijksinspectie Digitale Infrastructuur (RDI) coordinate the system. The Dutch government's own 20 April 2026 announcement describes cooperative supervision, with the AP, including a dedicated AI board member, covering areas with no clear existing supervisor, and the AP and RDI coordinating.
Three problems follow from this.
- Overlap. Stibbe notes it is unclear who leads when an AI system touches several domains. A credit-scoring model, for example, could fall under the AP, the financial supervisors (AFM or DNB), or both. A company facing two or three regulators with different interpretations bears the cost.
- Capacity. Stibbe also flags that the AP already has limited resources for its GDPR work. Binnenlands Bestuur reports that funding and capacity for the AI role are still under discussion, with no final decisions announced. A directorate without settled funding can coordinate, but it cannot yet test models at depth.
- Dependence on one body for two jobs. The AP is both the data protection enforcer and the intended AI market supervisor. Both mandates are legitimate, but AI development routinely touches personal data, and the same regulator will judge both. That is efficient for firms with a single interlocutor. It also concentrates discretion in one institution.
The sandbox is where this succeeds or fails
The most useful part of the announcement is the planned AI sandbox, a supervised environment where organisations can develop and test AI systems and align them with EU rules, built with the RDI together with a joint AI coordination centre. A sandbox is the right tool for a pro-innovation regime. It gives start-ups and public bodies a legally safer route to test systems, in return for regulator access.
Sandboxes only work if they are used, and that depends on details not yet public. Participation criteria, timelines, the treatment of personal data inside the sandbox, and whether regulators will commit to not penalising good-faith participants all matter. A sandbox that is slow to admit applicants, or that admits only large firms with legal teams, delivers compliance theatre rather than innovation support. Because the legal basis is still pending, the AP cannot yet promise much.
Timing is the unglamorous problem
The implementing act went into internet consultation on 20 April 2026, running until 1 June 2026. After consultation it goes to the Raad van State and then to parliament. Binnenlands Bestuur notes that the national law is expected to take effect later than the AI Act requires, while the EU rules apply directly in the meantime. The AI Act applies in full from 2 August 2027, as the same outlet reports, although the amended timetable for high-risk systems is a point businesses should check against the final omnibus text.
This gap matters. Companies cannot rely on a Dutch regulator that is not yet legally empowered to give binding guidance, yet the underlying rules already bind them. Legal uncertainty falls hardest on small firms.
What to watch
Proportionate regulation here means three things. The Dutch government should pass the implementing act promptly and fund the AP's AI work as a separate line, so GDPR enforcement does not shrink. It should publish clear lead-regulator rules so multi-domain systems get one answer. And it should open the sandbox with transparent, low-barrier entry criteria. Building a regulator before the statute exists is defensible. Leaving businesses to guess who regulates them is not.