Dutch DPA report March 2026: AI impact barometer turns red
Adopted 2026-06-12 · ≈ 1 min read · 
edited by Dirk Baaijen
The sixth AI & Algorithmic Risks Report Netherlands by the Dutch Data Protection Authority turns its AI impact barometer red. Three headlines: AI in recruitment is growing fast with major risks, transparency and explainability fall short, and preparation for the AI Act is lagging.
In March 2026 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) published the sixth edition of its semi-annual AI & Algorithmic Risks Report Netherlands (RAN) — and turned its AI impact barometer red for the first time: structural risks surround the deployment of AI, and the collective control measures fall short.
The three headlines
- **AI in recruitment and selection is growing fast and carries major
risks.** Automated CV screening and candidate assessment are spreading faster than the safeguards; this is precisely the application area marked high-risk in Annex III of the AI Act.
- Transparency and explainability fall short. Organisations often
cannot explain how their systems reach outcomes — a problem for the people affected, but also for their own demonstrability towards supervisors.
- Preparation for the AI Act is lagging, while acceleration is needed:
the national enforcement structure becomes operational on 2 August 2026, regardless of the expected delay of the high-risk dates.
Reading the signal
The RAN is not legislation, but it is the authoritative semi-annual picture of the Dutch AI risk landscape, and its signals feed the supervisory priorities of the DPA and the RDI. A red barometer weeks before enforcement begins makes the message to organisations unambiguous: the duties that already apply — prohibited practices, AI literacy — and recruitment practice deserve priority. The next edition is expected in the autumn of 2026; this signal entry will then be updated.
Sources
- https://www.autoriteitpersoonsgegevens.nl/en/documents/report-ai-algorithms-netherlands-march-2026
AI & Algorithms Report Netherlands (RAN), sixth edition, Dutch Data Protection Authority, March 2026. - https://www.autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/ai-algorithmic-risks-developments-in-the-netherlands
DPA theme page collecting all editions of the semi-annual risk report.
Read next
Can an algorithm reject a candidate? Automated decisions in recruitment
Rejecting a candidate fully automatically is in principle not allowed: GDPR Art. 22 prohibits decisions based solely on automated processing that significantly affect someone, unless safeguards apply. The AI Act adds human oversight and transparency for high-risk recruitment.
The Algorithm Register for Dutch public authorities
The Dutch Algorithm Register (algoritmes.overheid.nl) is the central public platform where government organisations voluntarily publish information about the algorithms they use; registration in the Dutch register is not legally mandatory, but public authorities deploying high-risk AI systems…
Right to explanation of an AI decision: what Article 86 of the AI Act gives you
If you are affected by a decision based (in part) on a high-risk AI system, Article 86 of the AI Act gives you the right to a clear explanation of the AI system's role and the main elements of the decision — from the deployer, on top of your GDPR rights.