Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Dutch AP establishes new directorate for AI oversight and coordination

The the Dutch DPA on 09 October 2026 launched its new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA), to prepare for artificial intelligence (AI) oversight. This new directorate will continue the coordinating supervision of AI and algorithms that the AP has been carrying out since 2023, and will also prepare for market supervision under the forthcoming AI Act.

The AP's new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA), is a significant step in preparing for AI oversight. It will build upon the AP's existing coordinating supervision of AI and algorithms, which commenced in 2023, and will also prepare for market supervision under the forthcoming AI Act. The AP, alongside the Rijksinspectie Digitale Infrastructuur (RDI), is also developing an AI sandbox and a joint AI Coordination Centre.

The TCA directorate consists of two departments. The AI/Algoritmes Risicoanalyse & Coördinatie (ARC) department focuses broadly on the impact of AI and algorithms on individuals, fundamental rights, and society. ARC identifies developments and risks, conducts research, builds knowledge, and collaborates with other supervisors, paying particular attention to impactful algorithmic systems, algorithm registers, and auditing frameworks. The Markttoezicht AI (MTA) department prepares for future supervision under the AI Regulation, building knowledge and technical expertise to examine and test AI systems. MTA also provides information and support for responsible innovation, collaborating with national supervisors and the AI Office on AI safety, including testing frontier models.

While the AP is the designated market supervisor for AI, it will only gain enforcement powers once the Dutch Implementation Act for the AI Regulation comes into force. The deadline for designating supervisors was 02 August 2025. The AP is actively engaged in collaboration, information provision, and supporting responsible innovation, drawing on its experience with the GDPR to protect individuals from risks associated with personal data use in AI.

Original title: AP zet volgende stap in toezicht op AI

AP news release

Who this binds
This news release is advisory for all organisations developing or deploying artificial intelligence systems in the Netherlands, as it outlines the Dutch DPA's preparatory steps for future enforcement under the AI Act.
What changed
The the Dutch DPA established a new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA), on 09 October 2026 to formalise and expand its AI oversight activities.
What to watch
Organisations should watch for the Dutch Implementation Act for the AI Regulation to come into force, as this will grant the Dutch DPA its full enforcement powers.
What this does not mean
This development does not mean that the Dutch DPA currently has full enforcement powers under the AI Act, as these are contingent on the national implementation law.

Not settled: The the Dutch DPA will only possess full enforcement powers for AI market supervision once the Dutch Implementation Act for the AI Regulation comes into force, which is currently still being drafted.

Send this to your team

The the Dutch DPA on 09 October 2026 established a new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA), to enhance its oversight of artificial intelligence and prepare for future enforcement under the AI Act, impacting all organisations developing or deploying AI in the Netherlands.

Today's question

A privacy professional is reviewing the Dutch AP's establishment of its new directorate, Toezicht en Coördinatie AI/Algoritmes (TCA). Which of the following best describes a primary focus of the AI/Algoritmes Risicoanalyse & Coördinatie (ARC) department within the TCA?

  1. Identifying developments and risks of AI and algorithms on individuals, fundamental rights, and society.
  2. Preparing for market supervision under the forthcoming AI Act by building technical expertise.
  3. Providing information and support for responsible innovation, collaborating with national supervisors.
  4. Developing an AI sandbox and a joint AI Coordination Centre alongside the Rijksinspectie Digitale Infrastructuur (RDI).

Answer this question on the site

Worth knowing

  1. OPC Canada updates guidance on handling voice data from customer calls, including biometrics

    Organisations recording customer calls in Canada must review their practices, especially concerning voiceprint collection, to ensure compliance with the OPC's updated guidance on consent and biometric data handling under PIPEDA.

  2. Jefferson-Blount-St. Clair Mental Health Authority pays $700,000 to settle data breach lawsuit

    Healthcare organisations must prioritise robust data security measures and incident response planning to mitigate the significant financial and legal risks associated with data breaches, as demonstrated by this $700,000 settlement.

  3. OPC draft guidance moves vendor privacy due diligence upstream

    Canadian organisations should review the OPC's draft guidance to understand the commissioner's expectation for proactive privacy due diligence with third party service providers.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.