Part of the AI Regulation News hub.
The Netherlands added a disclosure duty to BGfo article 77 requiring distance financial services providers to state, where applicable, that costs were personalised on the basis of automated decision-making, in force 28 August 2026
The interesting part is what the government refused to do. An industry body asked for safeguards on automated decision-making and price differentiation. The government declined, reasoning that the Directive is silent and national additions would be nationale koppen, and pointed instead at the AI Regulation.
Bottom line: A binding implementing decree. Signed 30 June 2026, the Staatsblad was issued 27 August 2026, and it entered into force 28 August 2026. It implements Directive (EU) 2023/2673 on distance financial services contracts.
Who this affects: Financial undertakings providing services to consumers at a distance: banks, insurers, credit providers, investment firms and crypto service providers, together with their pricing, personalisation and compliance functions. The duty is limited to distance selling.
The duty: BGfo article 77(1), onderdeel h. Note that h was not created here: the decree says Onderdelen f en h komen te luiden, so an existing onderdeel was REPLACED. In the original: en indien van toepassing, dat de kosten zijn gepersonaliseerd op basis van geautomatiseerde besluitvorming. Literally: and, where applicable, that the costs have been personalised on the basis of automated decision-making.
What the government refused: Adfiz asked for frameworks and safeguards covering automated decision-making and price differentiation. The Nota van toelichting records the refusal: zijn geen aanvullende voorschriften opgenomen, no additional rules have been included, because the Directive says nothing and to avoid nationale koppen.
Enforcement, stated precisely: Breach is punishable by an administrative fine in category 2, with a base amount of 500,000 euro and a maximum of 1,000,000 euro, enforced by the AFM. The liability arises because the new onderdeel sits inside article 77(1), which was ALREADY a fineable offence, not because this decree made it one.
Primary sources: Staatsblad 2026, 251, full text
- Instrument
- Besluit van 30 juni 2026 tot wijziging van het Besluit Gedragstoezicht financiele ondernemingen Wft ter implementatie van Richtlijn (EU) 2023/2673
- Publication
- Staatsblad 2026, 251
- Authority
- The Crown, on the proposal of the Minister van Financien
- Jurisdiction
- Netherlands
- Three dates, kept apart
- The besluit's own signing date is 30 June 2026. The Staatsblad was issued (uitgegeven) 27 August 2026. Entry into force is 28 August 2026, which follows by computation from Artikel III rather than being stated as a calendar date
- Status
- In force
- Bindingness
- Binding. An algemene maatregel van bestuur implementing an EU directive
- Scope
- Distance financial services contracts with consumers, binding the financieledienstverlener. Narrower than it first appears: life insurers, non-life insurers and payment service providers discharge article 77(1) through other, unamended articles, so this duty does not reach their pricing. It is not a general pricing-transparency rule
- The operative wording
- BGfo art. 77(1)(h): en indien van toepassing, dat de kosten zijn gepersonaliseerd op basis van geautomatiseerde besluitvorming
- Sanction
- Administrative fine, category 2. Under Wft art. 1:81(2) that is a basisbedrag of 500,000 euro, minimum 0, maximum 1,000,000 euro
- Enforcer
- The AFM. The decree's own Uitvoeringstoets records that the AFM assessed the impact of the precontractual-information articles as laag, low, and expects to need one structural FTE not provided for in its 2025-2028 cost framework
- Fine mechanism, corrected
- Artikel II of this decree inserts fine categories for the NEW articles 77a, 77b, 77c, 77d and 81.0a. It does NOT add article 77. Article 77(1) was already listed as fineable at category 2 in the Besluit bestuurlijke boetes financiele sector before this decree
- Timing
- Directive (EU) 2023/2673 required transposition well before this. The Netherlands is late; this is not an early or leading implementation
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://zoek.officielebekendmakingen.nl/stb-2026-251.html
The duty itself is one clause, and it is narrow
The obligation is a single onderdeel inside an existing precontractual information list. Where applicable, the provider must state that the costs have been personalised on the basis of automated decision-making. One point of precision: onderdeel h was not created by this decree. The instruction reads Onderdelen f en h komen te luiden, replacing existing onderdelen rather than adding a new one.
Three limits are worth noting before anyone treats this as a general algorithmic-pricing rule. It applies to distance financial services contracts with consumers, and it binds the financieledienstverlener. It is narrower still in practice: life insurers, non-life insurers and payment service providers satisfy article 77(1) through separate, unamended provisions, so the new wording does not reach their pricing at all. It is a disclosure duty, not a restriction: nothing here limits personalising a price. And it is triggered by personalisation on the basis of geautomatiseerde besluitvorming, so the compliance question is when a pricing model crosses from a tariff table into automated decision-making, which the decree does not define.
That last point is the one to put to a client. The statute supplies the duty and leaves the trigger boundary to be worked out.
What the government was asked for, and declined
The Nota van toelichting records an industry request and a refusal, and the refusal is the most quotable thing in the document.
Adfiz observed that no frameworks or safeguards had been included for automated decision-making and price differentiation. The government's answer: Aangezien de richtlijn hierover niets zegt, zijn geen aanvullende voorschriften opgenomen om «nationale koppen» te voorkomen. Since the Directive says nothing about this, no additional rules have been included, in order to avoid national gold-plating.
It then adds: Overigens is de AI-verordening van toepassing indien de kosten zijn gepersonaliseerd op basis van geautomatiseerde besluitvorming. Incidentally, the AI Regulation applies where the costs are personalised on the basis of automated decision-making.
That is a documented policy choice with a named dissenting industry body: safeguards on algorithmic pricing are routed to the AI Regulation rather than written into Dutch conduct-of-business rules.
It is also a sentence doing more work than it can carry. Personalised pricing is not, on its own, listed as a high-risk use in the AI Act's Annex III. Anyone relying on that line should establish which AI Act obligation they think actually bites, rather than assuming the deferral lands somewhere.
The fine, and a mechanism that is easy to get wrong
Breach is punishable by an administrative fine in category 2: a base amount of 500,000 euro and a maximum of 1,000,000 euro under Wft article 1:81(2). The AFM enforces.
The mechanism is not what it looks like. Artikel II of this decree amends the Besluit bestuurlijke boetes financiele sector by inserting fine categories for articles 77a, 77b, 77c, 77d and 81.0a. Article 77 is not in that insertion list.
The reason is that article 77(1) was already a fineable offence. The consolidated fine decree in force the day before commencement already listed 77, eerste, vierde, vijfde en zesde lid at category 2. The new onderdeel h inherits that liability because it sits inside article 77(1).
So the accurate sentence is that the new disclosure is fineable because of where it was placed, not because this decree made it fineable. Reporting Artikel II as the source of the penalty would be wrong.
Two things that argue against overstating this
First, the timing. Directive (EU) 2023/2673 required transposition considerably earlier, and this decree lands well past that. Any framing in which the Netherlands moves first or leads Europe on algorithmic-pricing disclosure is not supportable; this is a late implementation of an EU obligation.
Second, the supervisor's own assessment. In the decree's Uitvoeringstoets the AFM rates the impact of the precontractual-information articles as laag, low. It says the tasks are workable but that it expects to need one structural FTE, and that the cost of the new supervisory tasks is not provided for in its 2025-2028 cost framework.
A regulator describing a new duty as low impact and resourcing it with one unbudgeted post is not describing a landmark enforcement moment. The value of this instrument is that the obligation now exists and is fineable, not that it signals an enforcement wave.
If you sell financial services at a distance to Dutch consumers, the operative change from 28 August 2026 is one line in BGfo article 77(1): where applicable, say that the costs were personalised on the basis of automated decision-making. It is a disclosure duty, not a restriction, and it is limited to distance selling. It is fineable at category 2, a base of 500,000 euro and a maximum of 1,000,000, enforced by the AFM, because the new onderdeel sits inside an article that was already fineable. The undefined boundary is when a pricing model becomes automated decision-making. And note what did not happen: the government was asked for safeguards on automated decision-making and price differentiation, declined so as not to create nationale koppen, and pointed at the AI Regulation instead.
Source File
https://zoek.officielebekendmakingen.nl/stb-2026-251.html
Open Staatsblad 2026, 251 at zoek.officielebekendmakingen.nl and confirm the title refers to wijziging van het Besluit Gedragstoezicht financiele ondernemingen Wft ter implementatie van Richtlijn (EU) 2023/2673. Keep the three dates apart: the besluit is signed 30 juni 2026, the Staatsblad is uitgegeven 27 augustus 2026, and Artikel III sets commencement. Find the new onderdeel h in BGfo article 77 and confirm the phrase gepersonaliseerd op basis van geautomatiseerde besluitvorming. Read Nota van toelichting section 5.1 for the Adfiz exchange and the nationale koppen reasoning. Then check Artikel II and confirm it inserts 77a, 77b, 77c, 77d and 81.0a, and that article 77 is NOT in that list; cross-check the consolidated Besluit bestuurlijke boetes financiele sector to see article 77 already listed at category 2.
Aangezien de richtlijn hierover niets zegt, zijn geen aanvullende voorschriften opgenomen om «nationale koppen» te voorkomen. Overigens is de AI-verordening van toepassing indien de kosten zijn gepersonaliseerd op basis van geautomatiseerde besluitvorming. - Nota van toelichting to Stb. 2026, 251 (translated: since the Directive says nothing about this, no additional rules have been included, in order to avoid national gold-plating. Incidentally, the AI Regulation applies where the costs are personalised on the basis of automated decision-making)
FAQ
What exactly has to be disclosed?
Where applicable, that the costs have been personalised on the basis of automated decision-making. In the original: en indien van toepassing, dat de kosten zijn gepersonaliseerd op basis van geautomatiseerde besluitvorming. It is a new onderdeel h in BGfo article 77(1).
Does it ban personalised pricing?
No. It is a disclosure duty, not a restriction. Nothing in the decree limits a provider from personalising a price; it requires the provider to say so where applicable.
Who does it apply to?
The financieledienstverlener, contracting with consumers at a distance, under the regime implementing Directive (EU) 2023/2673. It is narrower than that summary suggests: life insurers, non-life insurers and payment service providers discharge article 77(1) via other, unamended provisions, so the new wording does not reach their pricing. It is not a general pricing-transparency rule.
What is the penalty?
An administrative fine in category 2, which under Wft article 1:81(2) means a base amount of 500,000 euro and a maximum of 1,000,000 euro, enforced by the AFM. Note the mechanism: the liability exists because the new onderdeel sits inside article 77(1), which was already fineable, and not because Artikel II of this decree added it. Artikel II inserts fine categories for the new articles 77a to 77d and 81.0a.
Did the Netherlands add safeguards on algorithmic pricing?
No, and it declined expressly. Adfiz asked for frameworks and safeguards on automated decision-making and price differentiation. The Nota van toelichting records that no additional rules were included, because the Directive is silent and to avoid nationale koppen, and adds that the AI Regulation applies where costs are personalised on the basis of automated decision-making.
Is the Netherlands ahead of other member states here?
No. Directive (EU) 2023/2673 required transposition considerably earlier than August 2026, so this is a late implementation of an EU obligation rather than a national initiative.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.