The Dutch data protection authority has created a dedicated AI and algorithm supervision directorate, but it does not yet have formal AI Act powers

Dutch AP launches AI and algorithm supervision directorate. The Leveraged Years regulation briefing card.

The Autoriteit Persoonsgegevens says it is the intended AI market surveillance authority but is not yet designated. It gets powers only once the Dutch implementation act for the AI Act is in force, so this non-binding organisational announcement creates no new duty and the new directorate prepares supervision rather than starting enforcement.

The short version

Bottom line: This is a non-binding organisational announcement that creates no new duty for companies. On 9 October 2026 the AP announced a new directorate, TCA, for AI and algorithm supervision. The AP says it "is beoogd markttoezichthouder op AI, maar nog niet aangewezen", meaning it is the intended market supervisor but not yet designated.

Who this affects: Companies deploying AI in the Netherlands, compliance teams tracking which authority will supervise the AI Act, and public bodies that publish algorithm registers.

Issue date: 9 October 2026. The notice sets no compliance date for companies.

What changed: The AP started TCA, which combines its coordinating supervision of AI and algorithms, run since 2023, with preparation for AI market surveillance.

Analysis: In our reading, nothing new is required of companies yet. The practical point is that the Dutch enforcement route is still unsettled, so a firm would want to plan for the AI Act duties that already apply rather than wait for a named enforcer.

Instrument (English)
News notice, "AP zet volgende stap in toezicht op AI" (AP takes next step in AI supervision)
Authority
Autoriteit Persoonsgegevens (AP), the Dutch data protection authority
Jurisdiction
Netherlands
Status
Published organisational announcement; the Dutch implementation act for the AI Act (Uitvoeringswet AI-verordening) is still being worked on, per the notice
Bindingness
Not applicable (non-binding). It is an announcement, not a rule, and creates no duty for companies
Issue date
9 October 2026
Effective date
Not stated in the source for TCA. The AP gets AI market surveillance powers only once the implementation act is in force; no date is given
What changed
The AP started the directorate Toezicht en Coördinatie AI/Algoritmes (TCA), with two departments, ARC and MTA
Who this affects
Companies deploying AI in the Netherlands, compliance teams, and public bodies running algorithm registers
Primary source
Autoriteit Persoonsgegevens, AP zet volgende stap in toezicht op AI
Workflow impact
Not stated in the source as a requirement. The notice says AI Act rules already apply, including some bans and transparency duties
Operational next step
Keep your AI Act obligations map current and record which Dutch authority you expect to deal with, noting that the designation is not final
Last verified
2026-10-25

Primary source: Autoriteit Persoonsgegevens, AP zet volgende stap in toezicht op AI (in Dutch)

Key takeaways

  • The notice is organisational. It creates no new duty and sets no compliance date.
  • The AP says it has power in AI market surveillance only once the Dutch implementation act is in force.
  • The AP says the deadline for designating AI supervisors was 2 August 2025, and the Dutch act is still being worked on.
  • The AP points out that some AI Act rules already apply, including bans and transparency duties.

What did the AP announce on 9 October 2026?

The AP announced the start of a new directorate, Toezicht en Coördinatie AI/Algoritmes, or TCA. According to the notice, the directorate continues the coordinating supervision of AI and algorithms that the AP has carried out since 2023. It also prepares AI market surveillance, and it works with the Rijksinspectie Digitale Infrastructuur (RDI) on the "AI sandbox" and a joint AI Coördinatiecentrum. The AP says the start of TCA is a next step in preparing for the central role the cabinet plans to give the AP and the RDI in Dutch supervision of the AI Act.

Does the AP have AI Act enforcement powers yet?

No. The AP states: "De AP is beoogd markttoezichthouder op AI, maar nog niet aangewezen." It adds: "De AP beschikt pas over bevoegdheden in het AI-markttoezicht zodra de Nederlandse Uitvoeringswet AI-verordening van kracht is." The notice says talks on the AP's designation, powers and funding are under way at several levels, and that the AP reviewed the implementation act earlier this year and mapped the capacity and funding it needs. It also says the Netherlands is still working on the act, and that the deadline for designating supervisors was 2 August 2025. See also our earlier article on Dutch implementation.

How is TCA organised, and what do ARC and MTA do?

TCA has two departments, according to the notice. The department AI/Algoritmes Risicoanalyse & Coördinatie (ARC) looks at the impact of AI and algorithms on people, fundamental rights and society, and pays particular attention to high-impact algorithmic systems, algorithm registers and audit frameworks. The notice gives risk-selection instruments as an example, to be checked for discrimination and accuracy. The department Markttoezicht AI (MTA) prepares future supervision under the AI Act, builds technical expertise to investigate and test AI systems, and works on guidance and support for responsible innovation. For AI safety, the notice says national supervisors work with the AI Office, including on testing and evaluating frontier models and systems.

What does it mean for companies and public bodies?

The notice does not add a duty, but it says rules already apply. It says some AI uses are already banned and that transparency duties apply to AI-generated content such as video, images or text. It also says a ban on AI that virtually undresses people without consent applies from 2 December; the notice gives no year. For public bodies, the notice lists algorithm registers and audit frameworks among ARC's areas of attention; it sets no inspection plan. The notice says the cabinet plans to give the AP, together with the RDI, a central role, and that the AP is not yet designated.

What should compliance teams do now?

Treat the notice as a signal about who will supervise, not as a change in obligations.

  • Check your AI Act obligations map for the bans and transparency duties the notice says already apply.
  • Note the AP and the RDI as the expected supervisors, and mark the designation as pending until the Dutch implementation act is in force.
  • If you hold or publish an algorithm register, confirm it is current, since ARC lists registers as an area of attention.
  • If you are building a high-risk system, ask whether the AI sandbox the AP and RDI describe is open to you; the notice gives no application terms.

Which dates does the notice mention?

DateWhat the notice says
2023The AP has carried out coordinating supervision of AI and algorithms since 2023; TCA continues it.
2 August 2025The deadline for designating the AI Act supervisors, as reported by the AP. The Dutch implementation act is still being worked on.
9 October 2026Date of the AP notice announcing TCA.
2 December (year unstated)The AP says a ban on AI that virtually undresses people without consent applies from this date. The notice gives no year.
No date givenThe AP gets AI market surveillance powers once the implementation act is in force; the notice states no date for that.

FAQ

Does the Dutch AP have AI Act enforcement powers now?

No. The AP says it is the intended market surveillance authority but is not yet designated, and that it gets powers only once the Dutch implementation act for the AI Act is in force.

What is TCA?

TCA is the AP's new directorate, Toezicht en Coördinatie AI/Algoritmes. The AP says it continues its coordinating supervision of AI and algorithms, which it has run since 2023, and prepares for AI market surveillance.

Is the announcement a new rule for companies?

No. It is an organisational announcement. It describes how the AP is structured and says existing AI Act rules already apply, but it creates no new duty.

What does the AP say about the AI sandbox?

The AP says TCA works with the Rijksinspectie Digitale Infrastructuur (RDI) on an AI sandbox, a controlled environment where organisations can work with the supervisors on AI systems and align them with the AI Act.

What date does the AP mention for the ban on AI that undresses people?

The AP says the ban on AI that virtually undresses people without consent applies from 2 December. The notice does not give the year, so check the AI Act text for the exact date.

What we did not verify

What we opened: the AP news notice "AP zet volgende stap in toezicht op AI", dated 9 October 2026, on 25 October 2026 (UTC).

What we did not open: the PDF "Toezicht en coordinatie AI en algoritmes" linked from the notice, the Uitvoeringswet AI-verordening, the AP's earlier review of it, the AP notice of 20 April 2026, and any press coverage of the announcement.

What we refuse to claim: that the AP has any AI Act enforcement power today, a date for the implementation act, who the final designated authorities will be, or any year for the 2 December ban beyond what the notice says.

Key compliance takeaway

The AP's new directorate prepares AI supervision but gives the AP no AI Act powers yet. Keep working to the AI Act duties that already apply, and record the Dutch supervisor as expected rather than designated until the implementation act is in force.

Source File

Primary: https://www.autoriteitpersoonsgegevens.nl/actueel/ap-zet-volgende-stap-in-toezicht-op-ai

Secondary: None relied on for the facts above.

Last checked: 2026-10-25 (UTC)

Status: Published organisational announcement, not binding.

Editorial note: Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Sponsored Training

Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.