The EU AI Act has been in force for two years. August 2026 was the date most Dutch businesses should have had marked in their calendar — that was when the requirements for high-risk AI systems came into full effect. Most business owners I speak to either haven't looked at this yet or assume it only applies to the large tech platforms. Neither is a safe assumption if you're building or commissioning software that uses AI in any form.
This post is for non-technical decision-makers: what the Act actually means for typical business software, which category your system probably falls into, and what you need to have arranged. No legal jargon — I'll tell you when to go and get a lawyer instead.
A risk-based framework, not a blanket ban
The EU AI Act classifies AI systems into four tiers based on the risk they pose. Most business software lands in the bottom two.
- Unacceptable risk (banned) — AI systems that manipulate people without their knowledge, social scoring by governments, real-time mass facial recognition in public spaces. None of this applies to typical business software.
- High risk — AI systems used in hiring and HR decisions, credit scoring, access to essential services, critical infrastructure, education grading, and more. These have serious compliance requirements.
- Limited risk — Chatbots, AI-generated content, recommendation engines, document classification. The main obligation: be transparent. Tell users they're interacting with AI.
- Minimal or no risk — Spam filters, AI-assisted search, most automation tools. No additional requirements.
The practical implication: if your software uses AI to process invoices, summarise documents, route support tickets, or generate reports, you're almost certainly in the limited or minimal category. The transparency requirement is easy to meet and low-cost.
Which category is your software in?
The classification isn't always obvious. Two situations that catch Dutch businesses by surprise:
HR software with scoring or ranking. If your software uses AI to screen CVs, rank candidates, assess employee performance, or make recommendations about pay or promotion — that's high-risk under the Act. This includes using a third-party AI tool inside your HR platform, not just building your own model. The obligation follows the use case, not who built the AI.
Credit or financial risk assessments. Software that uses AI to evaluate creditworthiness, set pricing based on customer risk profiles, or flag transactions — high-risk. If you're a Dutch lender or insurance platform building a custom system with any of these features, the August 2026 requirements apply to you now.
For most other business software — inventory forecasting, document extraction, customer segmentation, automated reporting — you're in limited or minimal risk territory. The requirements are manageable.
If you're high-risk: what the rules actually require
For high-risk AI systems, the Act requires:
- Risk management system — An ongoing process for identifying and mitigating risks the AI system poses.
- Technical documentation — How the system works, what data it trained or relies on, its performance and limitations.
- Logging and monitoring — The system must log enough information to allow human oversight and audit after the fact.
- Transparency to users — People affected by high-risk AI decisions must be told an AI was involved and, in some cases, have the right to an explanation.
- Human oversight — High-risk systems must be designed so a human can understand and override outputs. Fully automated consequential decisions without a human check are a red flag.
- Conformity assessment — Demonstrating compliance, either through self-assessment or, for certain categories, third-party audit.
None of these requirements are impossible to meet, but they take real time and money to implement properly. A conformity assessment for a high-risk HR system — including the documentation and audit trail work — typically runs €5,000–€20,000 depending on complexity, plus ongoing monitoring and review costs each year.
Using third-party AI APIs (GPT, Claude, and others)
Many Dutch businesses don't build their own AI — they connect to a model via API. OpenAI, Anthropic, Google and others fall under the "general-purpose AI" (GPAI) rules, which took effect in August 2025. Your API provider handles their GPAI obligations. Your responsibility as the developer using their API is different:
- You're the deployer of the AI system, not the provider. The risk classification of your use case is yours to assess.
- Your data processing agreement with the API provider needs to cover GDPR requirements — specifically, where the data goes and whether it's used for model training. The standard consumer tier often doesn't cover this; enterprise agreements usually do.
- If you're building a high-risk application on top of a third-party model, the high-risk requirements apply to your application regardless of who built the model.
The short version: using OpenAI or another provider's API doesn't exempt you from the Act. It shifts who handles the model-layer obligations, but the application-layer obligations are still yours. The data and compliance considerations for AI integrations cover this in more detail.
What this costs in practice
For limited-risk AI features (chatbots, document processing, recommendations): the main cost is documentation and transparency notices. If the feature was built properly — with logging, a data processing agreement with the AI provider, and a disclosure to users — compliance is mostly a matter of writing it down. Typically €500–€2,000 in documentation work if the codebase is already sound.
For high-risk AI systems: the compliance cost is meaningful. Budget for a risk management process, technical documentation, an audit trail, and a conformity assessment. Realistically €5,000–€20,000 for the initial assessment, plus €1,000–€5,000 per year in ongoing review and monitoring. For a system handling HR decisions for hundreds of employees, that's a reasonable cost of doing it properly. For a system that could be redesigned to keep AI out of the consequential decision, weigh that option first.
The security and GDPR foundations are also relevant here: the GDPR and the AI Act overlap significantly in their data processing requirements. If your software handles personal data through AI, both frameworks apply simultaneously.
Five questions to ask your software developer
Whether you're commissioning new software or reviewing an existing system with AI features:
- What risk tier does the AI functionality in this system fall under, and how did you reach that conclusion?
- Are we using a third-party AI model? If so, do we have an enterprise data processing agreement — not the standard consumer terms?
- Does the system log AI decisions in a way that allows human review and audit?
- Can a human understand and override AI outputs without going through the developer?
- If this is high-risk: what's the conformity assessment plan and timeline?
You don't need to understand every technical detail. You need to know whether your developer can give clear answers — and whether they've thought about this at all. Vague responses or "the Act doesn't apply to us" without a reasoned explanation are warning signs worth following up on.
If you're planning to add AI features to existing software, or commissioning new software with AI components, I'm happy to look at the use case and give you an honest read on the risk tier, what compliance requires, and whether AI is actually the right tool for what you're trying to solve.