Skip to content

Knowledge base · AI in HR

Where can an applicant or employee lodge a complaint about an AI system?

Since 2 August 2026, anyone who considers that the AI Act has been infringed can lodge a complaint with the relevant market surveillance authority. On 9 October 2026 the AP announced that it is the intended market surveillance authority for AI but has not yet been designated. Its powers for AI market surveillance follow once the implementing act applies. If the complaint concerns the processing of personal data, the data subject can lodge a complaint with the Dutch Data Protection Authority.

In force now (since 2 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Ask a specialist

A complaint about the AI Act

Any natural or legal person having grounds to consider that the Regulation has been infringed may lodge a complaint with the relevant market surveillance authority [1]. That article applies from the general date of application, 2 August 2026 [2].

Who is the market surveillance authority in the Netherlands?

Formally, nobody yet. On 9 October 2026 the AP announced that it is the intended market surveillance authority for AI but has not yet been designated; its powers for AI market surveillance follow once the implementing act applies [8]. The government proposes to designate ten market surveillance authorities, with the Dutch Data Protection Authority (AP) and the Rijksinspectie Digitale Infrastructuur (RDI) as coordinating supervisors [7]. That is a proposal; the tasks follow only from the implementing act.

A complaint about personal data

Every data subject who considers that the processing of their personal data infringes the GDPR has the right to lodge a complaint with a supervisory authority, in particular in the country where they live or work [3]. In the Netherlands that is the Dutch Data Protection Authority [4].

What you do as an employer

A good explanation often prevents a complaint. For a decision, the affected person can ask for an explanation of the role of the system and the main elements of the decision [5]. Article 86 has applied since the general date of application, 2 August 2026 [2]. The right concerns decisions based on a high-risk system from Annex III (except point 2) that produce legal effects or similarly significant adverse effects [5]. The classification rules of Chapter III apply to Annex III systems only from 2 December 2027 [6], and for systems already in use the transitional rule of Article 111(2) applies [9]. Assess per system and per decision, therefore, whether the right already applies. Also take the exceptions of Article 86 into account. Set up a fixed point of contact for questions about the use of AI.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Explanation of individual decisions on request AI Act 86

Sources

  1. [1] AI Act Art. 85 (AI Act, Regulation (EU) 2024/1689). Complaints about infringements of the Regulation can be lodged with the market surveillance authority.
    Without prejudice to other administrative or judicial remedies, any natural or legal person having grounds to consider that there has been an infringement of the provisions of this Regulation may submit complaints to the relevant market surveillance authority.
    Source, retrieved on 3 October 2026.
  2. [2] AI Act Art. 113, second paragraph (AI Act, Regulation (EU) 2024/1689). The Regulation applies from 2 August 2026.
    It shall apply from 2 August 2026.
    Source, retrieved on 3 October 2026.
  3. [3] GDPR Art. 77(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Right to lodge a complaint with a supervisory authority.
    1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement
    Source, retrieved on 3 October 2026.
  4. [4] UAVG Art. 6(2) (Dutch GDPR Implementation Act (UAVG); Dutch law, unofficial translation). The Dutch Data Protection Authority is the Dutch supervisory authority. Original Dutch text:
    2 De Autoriteit persoonsgegevens is de toezichthoudende autoriteit, bedoeld in artikel 51, eerste lid, van de verordening.
    Source, retrieved on 3 October 2026.
  5. [5] AI Act Art. 86(1) (AI Act, Regulation (EU) 2024/1689). Right to an explanation for decisions based on an Annex III system.
    Any affected person subject to a decision which is taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III,
    Source, retrieved on 3 October 2026.
  6. [6] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The postponement to 2 December 2027 concerns only Chapter III, Sections 1 to 3; Article 86 is in Chapter IX and falls under the general date of application.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 3 October 2026.
  7. [7] Kamerstukken II 22 112, no. 4318 Art. brief van 20 april 2026 (Letter to Parliament on the implementation of the AI Act (Kamerstukken II 2025/26, 22 112, no. 4318); Dutch law, unofficial translation). The government wants to designate ten market surveillance authorities; the AP and the RDI coordinate. Original Dutch text:
    De coördinatie en kennisdeling wordt verzorgd door de samenwerking tussen AP en RDI.
    Source, retrieved on 22 October 2026.
  8. [8] AP Art. nieuwsbericht van 9 oktober 2026 (Dutch Data Protection Authority (AP); Dutch law, unofficial translation). The AP is the intended market surveillance authority for AI but has not yet been designated; its powers for AI market surveillance follow once the implementing act applies. Original Dutch text:
    AP zet volgende stap in toezicht op AI
    Source, retrieved on 22 October 2026.
  9. [9] Regulation (EU) 2026/1744 Art. 1(39)(a) (replaces AI Act Art. 111(2)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Transition for existing high-risk systems: the Regulation applies to systems placed on the market before the date of application of Chapter III only if they undergo significant design changes from that date; Article 5 remains unaffected.
    Without prejudice to the application of Article 5 as referred to in Article 113, third paragraph, point (a), this Regulation shall apply to operators of high-risk AI systems, other than the systems referred to in paragraph 1 of this Article, that have been placed on the market or put into service before the date of application of Chapter III referred to in Article 113, only if, as from that date, those systems are subject to significant changes in their designs.
    Source, retrieved on 22 October 2026.

Related questions

Can an applicant or employee demand an explanation of a decision taken with AI?May an applicant request their AI score or assessment?What do we have to tell applicants if we use AI to process their data?

Next step

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed. Describe your question; we reply within one working day.

Ask a specialist

This page gives general information based on the text of the law. It is not legal advice for your situation.