{"id":33035,"date":"2026-04-23T19:55:08","date_gmt":"2026-04-23T17:55:08","guid":{"rendered":"https:\/\/yourtechclub.nl\/blog\/the-ai-act-and-the-data-act-how-is-your-company-dealing-with-the-new-ai-legislation\/"},"modified":"2026-04-23T19:55:13","modified_gmt":"2026-04-23T17:55:13","slug":"the-ai-act-and-the-data-act-how-is-your-company-dealing-with-the-new-ai-legislation","status":"publish","type":"post","link":"https:\/\/yourtechclub.nl\/en\/blog\/the-ai-act-and-the-data-act-how-is-your-company-dealing-with-the-new-ai-legislation\/","title":{"rendered":"The AI Act and the Data Act: How is your company dealing with the new AI legislation?"},"content":{"rendered":"\n<p>De opkomst van kunstmatige intelligentie (AI) en data-analyse biedt enorme kansen voor bedrijven. Tegelijk ontstaan er nieuwe <strong>AI legislation<\/strong> om AI veilig en verantwoord te laten verlopen. <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:32024R1689\" data-type=\"link\" data-id=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:32024R1689\" target=\"_blank\" rel=\"noopener\">The European <strong>AI Act<\/strong> and <strong>Data Act<\/strong><\/a> are recent laws that businesses in the Netherlands cannot ignore. These regulations require <strong>AI compliance<\/strong> \u2013 demonstrably meeting legislation for <strong>safe AI<\/strong> and careful data use. What do the AI Act and Data Act entail, and how can you ensure that <strong>AI for businesses<\/strong> stays within the rules? In this article, we answer these questions and provide practical tips for compliance and <strong>data governance<\/strong>.<\/p>\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li class=\"\"><a href=\"#wat-is-de-ai-act\">What is the AI Act?<\/a><\/li><li class=\"\"><a href=\"#wat-is-de-data-act\">What is the Data Act?<\/a><\/li><li class=\"\"><a href=\"#waarom-zijn-de-ai-act-en-data-act-belangrijk-voor-bedrijven\">Why are the AI Act and Data Act important for businesses?<\/a><\/li><li class=\"\"><a href=\"#hoe-bereidt-uw-bedrijf-zich-voor-op-deze-ai-wetgeving\">How does your company prepare for this AI legislation?<\/a><ul><li class=\"\"><a href=\"#hoe-zorgt-your-tech-club-zelf-voor-veilige-ai\">How does Your Tech Club itself ensure safe AI?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div><br>\n\n<h2 class=\"wp-block-heading\" id=\"wat-is-de-ai-act\">What is the AI Act?<\/h2>\n\n<p>The <em>EU AI Act<\/em> is the world\u2019s first comprehensive law on artificial intelligence, which came into force on 1 August 2024. This <strong>AI Act<\/strong> (officially <em>Regulation (EU) 2024\/1689<\/em>) establishes a risk-based framework for the use and development of AI systems. Put simply, the <a href=\"http:\/\/digital-strategy.ec.europa.eu.\" target=\"_blank\" rel=\"noopener\">classifies AI applications<\/a> into categories ranging from unacceptable risk (prohibited) to high, limited and minimal risk. Specific obligations apply to each level:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>High-risk AI<\/strong>: AI systems that can have a significant impact on a person\u2019s safety or rights (such as AI in medical devices, recruitment or lending) are referred to as \u2018high-risk\u2019. Developers of such systems must meet strict requirements in the areas of risk management, data quality, technical documentation, transparency and human oversight. This includes conducting risk analyses, maintaining logs and ensuring human oversight before the AI is used. These AI systems must also obtain CE marking\/certification before they are placed on the market. <\/li>\n\n\n\n<li><strong>Prohibited AI<\/strong>: Some AI applications are banned outright because they pose an unacceptable risk, such as AI used for manipulation or social credit scoring. <\/li>\n\n\n\n<li><strong>Low-risk AI<\/strong>: This refers to AI such as chatbots or generative AI that interacts with people. In this context, the AI Act primarily mandates <strong>transparency<\/strong>: users must be aware that they are dealing with a machine or that content has been generated by AI. For example, if your company uses an AI chatbot on its website, it must be clear that this is not a human. <br\/><br\/>The AI Act focuses on both \u201cproviders\u201d (developers\/suppliers of AI systems) and \u201cusers\u201d (organisations that implement AI). This means that not only tech companies, but <em>all<\/em> organisations that use AI must comply with the rules. From February 2025, the first obligations will apply to certain AI systems. From then on, for example, organisations must stop using prohibited AI and ensure that staff have sufficient AI knowledge. Most other requirements (e.g. for high-risk AI) will follow gradually in 2025 and 2026. In short: the law is in place, and the rules will come into effect gradually over the coming years \u2013 so companies now have a transition period to prepare.<\/li>\n<\/ul>\n\n<p> <\/p>\n\n<figure class=\"wp-block-image size-large is-resized\"><img decoding=\"async\" class=\"aligncenter wp-image-32215\" style=\"width: 637px; height: auto;\" src=\"https:\/\/yourtechclub.nl\/wp-content\/uploads\/2025\/08\/european-union-flag-depicted-on-table-with-interne-2025-03-16-13-32-03-utc-900x596.jpg\" alt=\"AI Act Data EU flag\" width=\"900\" height=\"596\" srcset=\"https:\/\/yourtechclub.nl\/wp-content\/uploads\/2025\/08\/european-union-flag-depicted-on-table-with-interne-2025-03-16-13-32-03-utc-900x596.jpg 900w, https:\/\/yourtechclub.nl\/wp-content\/uploads\/2025\/08\/european-union-flag-depicted-on-table-with-interne-2025-03-16-13-32-03-utc-510x338.jpg 510w, https:\/\/yourtechclub.nl\/wp-content\/uploads\/2025\/08\/european-union-flag-depicted-on-table-with-interne-2025-03-16-13-32-03-utc-768x509.jpg 768w, https:\/\/yourtechclub.nl\/wp-content\/uploads\/2025\/08\/european-union-flag-depicted-on-table-with-interne-2025-03-16-13-32-03-utc-1536x1017.jpg 1536w, https:\/\/yourtechclub.nl\/wp-content\/uploads\/2025\/08\/european-union-flag-depicted-on-table-with-interne-2025-03-16-13-32-03-utc-2048x1356.jpg 2048w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n<p><\/p>\n\n<h2 class=\"wp-block-heading\" id=\"wat-is-de-data-act\">What is the Data Act?<\/h2>\n\n<p>The <em>EU Data Act<\/em> (officially <em>Regulation (EU) 2023\/2854<\/em>) is a new European law that regulates the fair use of and access to data. Whereas the AI Act focuses on AI systems, the Data Act centres on <strong>data sharing and data rights<\/strong>. This law aims to make data exchange between businesses, consumers and public authorities smoother and fairer, whilst respecting confidentiality and competition. Some key points of the Data Act for businesses:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>Access to IoT and device data<\/strong>: Companies that provide \u2018smart\u2019 products or services (e.g. sensor-equipped devices, vehicles, smart machines) must give users access to the data generated by those devices. Consider a manufacturer of smart agricultural machinery that must share agricultural data with the farmer using the device. This gives customers greater control over <strong>their own data<\/strong>.<\/li>\n\n\n\n<li><strong>Data sharing on request<\/strong>: At the request of a user or a third party, data controllers must make certain data accessible, subject to reasonable conditions. This is intended to stimulate innovation \u2013 for example, a car dealer may request data from a car manufacturer to provide better maintenance services, provided the customer consents. Contracts that unnecessarily restrict data sharing will be declared invalid.<\/li>\n\n\n\n<li><strong>Cloud and switching services<\/strong>: The Data Act also includes rules to make it easier for customers to switch from one cloud service to another (portability) without excessive costs or technical barriers. Cloud and data service providers will have to adapt to this so that lock-in decreases.<\/li>\n<\/ul>\n\n<p><strong>Government requests in emergencies<\/strong>: In exceptional circumstances (such as public emergencies), the government may demand access to certain private data. Companies must then provide data under strict conditions, for example to manage disasters. <\/p>\n\n<p>For Dutch companies, the Data Act primarily means that they must ensure their <strong>data governance<\/strong> is in order. You need to know what data your products and systems generate, who has access to it, and how you can share it securely. The Data Act was adopted on 13 December 2023 and will also come into force in phases. Companies are expected to comply with most provisions from <a href=\"https:\/\/www.cliffordchance.com\/content\/dam\/cliffordchance\/briefings\/2023\/07\/eu-data-act. pdf#:~:text=,the%20Council%20of%2013\" target=\"_blank\" rel=\"noopener\">September 2025<\/a>. This allows some time to adapt data flows and contracts, but it is important to start identifying now where adjustments are needed.<\/p>\n\n<h2 class=\"wp-block-heading\" id=\"waarom-zijn-de-ai-act-en-data-act-belangrijk-voor-bedrijven\">Why are the AI Act and the Data Act important for businesses?<\/h2>\n\n<p><strong>New obligations and the risk of fines:<\/strong> For businesses, the AI Act and Data Act mark a major shift. Whereas AI development and data use have been largely unregulated until now, a clear framework with strict requirements is now emerging. Failure to comply carries the risk of substantial penalties. Fines under the AI Act can amount to<a href=\"https:\/\/www.isms.online\/iso-42001\/everything-you-need-to-know-so-far-about-the-eu-ai-act\/#: ~:text=Penalties%20for%20violating%20the%20EU,whichever%20is%20higher%2C%20for\" target=\"_blank\" rel=\"noopener\"> \u20ac30 million or 6% of global annual turnover<\/a> \u2013 comparable to the highest fines under the GDPR (privacy legislation). The Data Act also imposes fines (to be determined by each EU country) on companies that cut corners. The financial and reputational risks of non-compliance are therefore considerable.<\/p>\n\n<p><strong>Protecting rights and trust:<\/strong> At the same time, these laws have been introduced to <strong>boost trust<\/strong> in AI and data. They complement the existing privacy regulations (GDPR). Whilst the GDPR protects personal data, the AI Act ensures that AI systems are <strong>secure, transparent and human-centred<\/strong>, and the Data Act ensures that data is shared fairly. Together, they form a basis for enabling innovation <strong>without<\/strong> compromising the rights of citizens and customers. For businesses, compliance can therefore also be an <em>opportunity<\/em>: it demonstrates that you handle AI and data responsibly, which instils confidence in customers and partners.<\/p>\n\n<p><strong>Impact on business operations:<\/strong> In practice, many departments within your organisation will be involved in this. Legal teams, IT departments, data analysts, HR \u2013 all will have to deal with new procedures. For example, <strong>HR<\/strong> must pay attention to AI tools used in recruitment (is this still permitted, does it meet non-discrimination requirements?), and <strong>IT<\/strong> must ensure that data from your products can be exported by customers. This is likely to involve additional administrative work, such as drawing up technical documentation for AI (for high-risk systems) and keeping track of <em>where<\/em> your data is stored and with whom it is shared. This requires investment in expertise and possibly new roles, such as an AI compliance officer or data steward.<\/p>\n\n<p><strong>The Netherlands is leading the way:<\/strong> It is worth noting that the Netherlands aims to take the lead with this AI legislation. The Dutch government has even announced that it will apply the core provisions of the AI Act <strong>with immediate effect<\/strong> even before the law comes fully into force across the EU. In a policy document dated January 2024, the government stated that the AI Act is already regarded as applicable law in the Netherlands. In other words: regulators and government bodies (such as the <a href=\"https:\/\/autoriteitpersoonsgegevens.nl\/nl\/onderwerpen\/algoritmes\/ai-act\" data-type=\"&#x2018;link&#x2019;\" data-id=\"&#x2018;https:\/\/autoriteitpersoonsgegevens.nl\/nl\/onderwerpen\/algoritmes\/ai-act&#x2019;\" target=\"_blank\" rel=\"noopener\">Dutch Data Protection Authority<\/a> for AI) are already preparing to enforce it. Companies would therefore be wise not to wait, but to take action now.<\/p>\n\n<h2 class=\"wp-block-heading\" id=\"hoe-bereidt-uw-bedrijf-zich-voor-op-deze-ai-wetgeving\">How is your company preparing for this AI legislation?<\/h2>\n\n<p>As the <strong>AI Act<\/strong> and <strong>Data Act<\/strong> are due to come into force shortly, it is crucial to ensure your organisation is prepared in good time. Here are a few steps you can take now to ensure proper <strong>AI compliance<\/strong> and data compliance:<\/p>\n\n<h3 class=\"wp-block-heading\" id=\"hoe-zorgt-your-tech-club-zelf-voor-veilige-ai\">How does Your Tech Club ensure the safety of its AI?<\/h3>\n\n<p>At <a href=\"https:\/\/yourtechclub.nl\/en\/\" data-type=\"&#x2018;page&#x2019;\" data-id=\"&#x2018;30888&#x2019;\">Your Tech Club <\/a>, we believe in leading by example. As a tech company, we use AI innovatively, but always with an emphasis on safety and ethics. For example, we carry out <strong><a href=\"https:\/\/yourtechclub.nl\/ai-workshop-op-locatie-voor-bedrijven\/\">internal AI audits<\/a><\/strong> on the tools and models we develop \u2013 we test for biases, privacy and reliability before deploying anything to clients.<\/p>\n\n<p>We have also drawn up a clear AI code of conduct: <strong>AI must never make autonomous decisions that have a significant impact without human oversight<\/strong>. Our teams regularly receive <strong><a href=\"https:\/\/yourtechclub.nl\/ai-workshop-op-locatie-voor-bedrijven\/\" data-type=\"&#x2018;link&#x2019;\" data-id=\"&#x2018;https:\/\/yourtechclub.nl\/ai-workshop-op-locatie-voor-bedrijven&#x2019;\">training<\/a><\/strong> on the latest AI guidelines and risks, ensuring everyone is \u201cAI-aware\u201d. Furthermore, we work according to strictly <a href=\"https:\/\/yourtechclub.nl\/en\/about-us\/\">certified processes <\/a>(such as ISO 27001 for information security), which aligns seamlessly with <strong>AI compliance<\/strong> requirements. All of this ensures that we apply <strong>secure AI<\/strong> and can help our clients do the same \u2013 from advising on AI risks to building AI solutions that comply with the law.<\/p>\n<h3 class=\"rank-math-question\">What is the AI Act and who does it apply to?<\/h3>\n<p><\/p>\n<div class=\"rank-math-answer\">The AI Act is a new EU regulation that sets rules for the development and use of AI systems. It applies to all organizations that \u201cprovide\u201d AI systems (developers, suppliers) or \u201cuse\u201d them (implementers) within the EU. Nearly every sector may be affected \u2013 from IT companies to banks, governments, and SMEs \u2013 as soon as they use AI. The goal is to ensure that AI is applied safely, transparently, and with respect for fundamental rights.<\/div>\n<p><\/p>\n<div class=\"rank-math-faq-item\">\n<h3 class=\"rank-math-question\">What is the Data Act and what does it regulate?<\/h3>\n<div class=\"rank-math-answer\">The Data Act is an EU law concerning fair access to and use of data. The law ensures that users and companies gain access to data from smart devices and services they use. It should also make it easier to share data between businesses and with government authorities in certain situations. In addition, the Data Act includes rules to make switching between cloud services easier. The aim is to ensure that the enormous amount of data in the EU can be used smoothly and fairly, without one party having all the control.<\/div>\n<p><\/div>\n<p><\/p>\n<div class=\"rank-math-faq-item\">\n<h3 class=\"rank-math-question\">How do the AI Act and the GDPR relate to each other?<\/h3>\n<div class=\"rank-math-answer\">The AI Act and the GDPR are complementary. The <strong>GDPR<\/strong> (General Data Protection Regulation) protects personal data and privacy rights. The <strong>AI Act<\/strong> focuses on the safety and ethics of AI systems, regardless of whether personal data is involved. There is overlap: many AI systems process personal data, so both laws must be followed. In principle, this means first complying with the basic GDPR standards (privacy by design, consent, etc.), and then applying the AI Act requirements on top of that (for example, risk analyses and transparency about AI). Together, these laws ensure that AI is both privacy-friendly and socially responsible.<\/div>\n<p><\/div>\n<p><\/p>\n<div class=\"rank-math-faq-item\">\n<h3 class=\"rank-math-question\">When do the AI Act and Data Act come into force?<\/h3>\n<div class=\"rank-math-answer\">The AI Act officially entered into force on 1 August 2024, but its obligations will apply in phases. From February 2025, companies must comply with the first parts of the AI Act (such as the ban on certain AI systems and mandatory AI training for staff). Most other AI Act obligations, for example for high-risk AI systems, will follow during 2025 and 2026. The Data Act was adopted at the end of 2023 and also includes a transition period. The main provisions of the Data Act are expected to apply from 12 September 2025. It is wise to be compliant before these dates so that you do not face last-minute surprises.<\/div>\n<p><\/div>\n<p><\/p>\n<div class=\"rank-math-faq-item\">\n<h3 class=\"rank-math-question\">How do I prepare my business for the AI Act and Data Act?<\/h3>\n<div class=\"rank-math-answer\">Start by identifying which AI systems and data within your organization fall under the new laws. Carry out a thorough risk and gap analysis: which processes need to be adjusted to comply? Create a plan with measures such as drafting an AI policy, training employees, and implementing data governance procedures. Involve different departments (IT, Legal, HR, Data) in this preparation. You can also seek external advice \u2013 for example for an AI compliance scan or legal review. The important thing is to start now; this prevents panic shortly before the deadlines and demonstrates to customers and regulators that you are proactively working on <strong>safe, responsible AI<\/strong> and proper data use.<\/div>\n<p><\/div>\n<p><\/p>\n<p><script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"How does Your Tech Club itself ensure safe AI?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"At Your Tech Club, we believe in leading by example. As a tech company, we use AI innovatively, but always with a strong focus on safety and ethics. For example, we conduct internal AI audits on the tools and models we develop \u2013 we test for bias, privacy, and reliability before deploying anything for clients. We have also established a clear AI code of conduct: AI may never make autonomous high-impact decisions without human oversight. Our teams receive regular training on the latest AI guidelines and risks, ensuring everyone is AI-aware. In addition, we work according to strictly certified processes (such as ISO 27001 for information security), which aligns seamlessly with AI compliance requirements. All of this ensures that we apply safe AI ourselves and can help our clients do the same \u2013 from advising on AI risks to building AI solutions that comply with the law.\"}},{\"@type\":\"Question\",\"name\":\"What is the AI Act and who does it apply to?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The AI Act is a new EU regulation that sets rules for the development and use of AI systems. It applies to all organizations that provide AI systems (developers, suppliers) or use them (implementers) within the EU. Nearly every sector may be affected \u2013 from IT companies to banks, governments, and SMEs \u2013 as soon as they use AI. The goal is to ensure that AI is applied safely, transparently, and with respect for fundamental rights.\"}},{\"@type\":\"Question\",\"name\":\"What is the Data Act and what does it regulate?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The Data Act is an EU law concerning fair access to and use of data. The law ensures that users and companies gain access to data from smart devices and services they use. It should also make it easier to share data between businesses and with government authorities in certain situations. In addition, the Data Act includes rules to make switching between cloud services easier. The aim is to ensure that the enormous amount of data in the EU can be used smoothly and fairly, without one party having all the control.\"}},{\"@type\":\"Question\",\"name\":\"How do the AI Act and the GDPR relate to each other?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The AI Act and the GDPR are complementary. The GDPR (General Data Protection Regulation) protects personal data and privacy rights. The AI Act focuses on the safety and ethics of AI systems, regardless of whether personal data is involved. There is overlap: many AI systems process personal data, so both laws must be followed. In principle, this means first complying with the basic GDPR standards (privacy by design, consent, etc.), and then applying the AI Act requirements on top of that (for example, risk analyses and transparency about AI). Together, these laws ensure that AI is both privacy-friendly and socially responsible.\"}},{\"@type\":\"Question\",\"name\":\"When do the AI Act and Data Act come into force?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The AI Act officially entered into force on 1 August 2024, but its obligations will apply in phases. From February 2025, companies must comply with the first parts of the AI Act (such as the ban on certain AI systems and mandatory AI training for staff). Most other AI Act obligations, for example for high-risk AI systems, will follow during 2025 and 2026. The Data Act was adopted at the end of 2023 and also includes a transition period. The main provisions of the Data Act are expected to apply from 12 September 2025. It is wise to be compliant before these dates so that you do not face last-minute surprises.\"}},{\"@type\":\"Question\",\"name\":\"How do I prepare my business for the AI Act and Data Act?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Start by identifying which AI systems and data within your organization fall under the new laws. Carry out a thorough risk and gap analysis: which processes need to be adjusted to comply? Create a plan with measures such as drafting an AI policy, training employees, and implementing data governance procedures. Involve different departments (IT, Legal, HR, Data) in this preparation. You can also seek external advice \u2013 for example for an AI compliance scan or legal review. The important thing is to start now; this prevents panic shortly before the deadlines and demonstrates to customers and regulators that you are proactively working on safe, responsible AI and proper data use.\"}}]}<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>De opkomst van kunstmatige intelligentie (AI) en data-analyse biedt enorme kansen voor bedrijven. Tegelijk ontstaan&#8230;<\/p>\n","protected":false},"author":38,"featured_media":32219,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[311,252],"tags":[],"class_list":{"0":"post-33035","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-tech-nieuws","8":"category-tech-en"},"_links":{"self":[{"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/posts\/33035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/users\/38"}],"replies":[{"embeddable":true,"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/comments?post=33035"}],"version-history":[{"count":1,"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/posts\/33035\/revisions"}],"predecessor-version":[{"id":33036,"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/posts\/33035\/revisions\/33036"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/media\/32219"}],"wp:attachment":[{"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/media?parent=33035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/categories?post=33035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yourtechclub.nl\/en\/wp-json\/wp\/v2\/tags?post=33035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}