Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Application deadline for AP's FRIA pilot by 21 September 2026

21 September 2026

Organisations interested in gaining experience with the Fundamental Rights Impact Assessment (FRIA) for high risk AI systems can apply to participate in the Autoriteit Persoonsgegevens (AP) pilot. The date is 21 September 2026, in 24 days.

Public and private organisations providing public services in the Netherlands

The instrument is AI Act. Organisations should review the pilot invitation and submit their application if they meet the criteria and wish to prepare for the AI Act's FRIA requirements.

AI Act sets 21 September 2026 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.

AI Act

Who this binds
Public and private organisations providing public services in the Netherlands
What changed
What is fixed is the date: 21 September 2026, when organisations interested in gaining experience with the Fundamental Rights Impact Assessment (FRIA) for high risk AI systems can apply to participate in the Autoriteit Persoonsgegevens (AP) pilot.
What to check
Organisations should review the pilot invitation and submit their application if they meet the criteria and wish to prepare for the AI Act's FRIA requirements.
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

Application deadline for AP's FRIA pilot is set for 21 September 2026. Public and private organisations providing public services in the Netherlands

Today's question

Under the EU AI Act, following a security incident at an AI supplier, what is the primary obligation of an AI system deployer regarding incident evidence?

  1. To accept the supplier's public statement as sufficient evidence of non compromise.
  2. To collect and preserve evidence demonstrating the incident's impact on their own AI system and operations.
  3. To immediately cease using the affected AI system until a new supplier is found.
  4. To notify all affected data subjects within 72 hours, regardless of actual impact.

Answer this question on the site

Worth knowing

  1. EU AI Act Deployers Need Supplier Incident Evidence Following OpenAI-TanStack Incident

    Organisations deploying AI systems should establish robust processes for collecting and retaining evidence of security incidents affecting their AI suppliers, particularly in anticipation of EU AI Act obligations.

  2. noyb Sends Cease and Desist to SCHUFA Over 'Shadow Database' Scandal and Opens Class Action Interest List

    Organisations handling extensive personal data, especially for credit scoring, must ensure strict adherence to data retention policies and GDPR Article 15 access rights to avoid significant legal challenges and potential class actions.

  3. NZ Privacy Commissioner Sets Expectations for Smart Glasses

    New Zealand's Office of the Privacy Commissioner expects smart glasses developers to implement privacy by design, signalling regulatory scrutiny for emerging wearable technologies.

  4. ICO Statement on Meta Trial Outcome and Children's Privacy

    Organisations providing online services to children must ensure their products are designed with children's best interests at heart, aligning with the ICO's Children's Code and broader regulatory focus on youth privacy.

  5. Cybercrooks jet off with Manchester Airports Group customer data

    Privacy professionals advising UK airports must review their incident response plans for customer data breaches given Manchester Airports Group's recent cyber attack.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.