A chatbot used in the Netherlands must comply with three regimes at once: Dutch copyright law (Auteurswet), the GDPR and the EU AI Act (Regulation (EU) 2024/1689). Each places duties on the organisation that deploys the chatbot, not only on its developer; most customer-facing chatbots only need to tell users they are dealing with a machine, but a chatbot that screens job applicants or assesses credit falls under the strict high-risk regime.
Meza ya yaliyomo
Which legal regimes apply to every chatbot?
There is no single Dutch AI statute. Copyright covers what goes into and comes out of the model, the GDPR covers personal data in conversations, and the AI Act covers the system itself.
The three regimes have different supervisors, sanctions and timelines. A chatbot that is flawless on privacy can still infringe copyright, and one with clean training data can still breach the AI Act if it never says it is a machine. Answer all three questions in writing before launch: that file is the first thing a regulator asks for.
| Eneo la kisheria | Wasiwasi kuu | Sheria |
|---|---|---|
| Ulinzi wa data | Processing conversation data without a lawful basis, or keeping it too long. | GDPR, supervised by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) |
| Copyright | Copying protected works for training; outputs that reproduce a work. | Auteurswet, Articles 15n and 15o (text and data mining) |
| Uwazi | Users not told they are dealing with a machine; synthetic content not marked. | AI Act transparency obligations |
| Liability for output | Who answers for wrong advice or decisions by the chatbot. | Contract, tort (Article 6:162 BW) and product liability |
The European Commission withdrew its proposed AI Liability Directive, so claims about a faulty chatbot answer are decided under ordinary Dutch civil law, including the general tort rule in Article 6:162 of the Dutch Civil Code (BW). See our article on dhima ya makosa katika maudhui yanayozalishwa na AI.
When is training a model on protected works allowed?
Training copies protected works, and under the Auteurswet that is a reproduction that needs permission or a statutory exception. Dutch and EU law have no US-style “fair use” doctrine.
Article 15n Auteurswet allows research organisations and cultural heritage institutions to mine works they lawfully access for scientific research. Article 15o Auteurswet allows anyone to mine lawfully accessible works, unless the rightholder has expressly reserved this in an appropriate way, for online works by machine-readable means (the TDM opt-out).
That gives a two-step test: did the trainer have lawful access, and was there a reservation? If the work was mined despite a valid opt-out, the exception does not apply and the copying infringed copyright.
Where does the deployer carry the risk?
The business that deploys a chatbot and publishes its output performs its own acts of reproduction and communication to the public. Three failure points recur.
- Mafunzo bila msingi halali. The main exposure is the developer’s, but claims can follow the output downstream.
- Output that copies a work. Publishing text, code or an image that recognisably reproduces a protected work is a new infringement by the publisher. Style is not protected; a substantial part of a concrete work is.
- Contracts that leave the risk with you. Many AI licences cap liability at the annual fee and exclude third-party IP claims. Read the indemnity clause first.
Purely machine-generated output is unlikely to be protected by copyright, because Dutch law requires a work with its own original character bearing the maker’s personal stamp. Competitors can then reuse it freely. Our guide on wakati maudhui yanachukuliwa kuwa ya umma chini ya sheria ya hakimiliki explains the principles. Ask your vendor in writing which datasets were used, whether opt-outs were respected and what indemnity is offered.
How does the AI Act classify a chatbot?
The AI Act regulates the purpose, not the technology. The same model can be minimal-risk in one use and high-risk in another, so your own written classification is the first compliance step.
| Kiwango cha hatari | Mfano wa Chatbot | Wajibu mkuu |
|---|---|---|
| Ndogo | A bot answering questions about opening hours. | No specific obligations; voluntary codes. |
| Limited | A customer service bot for returns and orders. | Tell users they are dealing with AI; mark synthetic output. |
| High | A bot that pre-screens job applicants or assesses credit eligibility. | Risk management, data governance, documentation, logging, human oversight, conformity assessment. |
| Haikubaliki | A bot that exploits vulnerable groups or infers employees’ emotions at work. | Prohibited in the EU. |
High-risk uses are listed in an annex to the AI Act and include recruitment, access to essential services such as credit or benefits, education and law enforcement. See our guides to mifumo ya hatari ya AI na desturi zilizopigwa marufuku za akili bandia.
What applies now, and what has been postponed?
The AI Act entered into force on 1 August 2024 and applies in phases. The prohibitions, the AI literacy duty, the rules for general-purpose AI models and the transparency obligations already apply.
The AI omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, postponed only the high-risk regime, to late 2027 for the annex-listed uses and 2028 for AI in regulated products. If your chatbot needs to disclose that it is a machine, that duty already applies. Fines are capped at a percentage of worldwide annual turnover, with the highest cap for prohibited practices.
How must a chatbot tell users it is AI?
Under the AI Act a person interacting with an AI system must be informed of this, unless it is obvious to a reasonably well-informed user. The notice must be clear and given at the latest at the first interaction.
A line in a privacy statement three clicks away is not enough. Providers of systems that generate synthetic text, audio, images or video must mark that output in a machine-readable way. For a chatbot on your own website: a visible statement at the start of the conversation, a clear route to a human, and no design suggesting the user is talking to a named employee.
Dutch consumer law adds a layer. Presenting a machine as a person, or letting a chatbot make claims a salesperson could not lawfully make, can be a misleading commercial practice under Articles 6:193b and 6:193c BW.
How does the GDPR apply to chatbot conversations?
The GDPR applies as soon as the chatbot processes data about an identifiable person, and conversation logs almost always do. First fix the lawful basis: consent, performance of a contract, or legitimate interests.
Three points cause most problems. Retention: transcripts are often kept indefinitely, which breaches the storage limitation principle. Secondary use: using live conversations to train a model is a new purpose that needs its own assessment and information notice. Special category data: in healthcare, insurance or HR settings the chatbot will collect health or other sensitive data, which is prohibited unless a specific GDPR exception applies.
A platform running the chatbot for you is normally a processor, and a data processing agreement is then mandatory. If the chatbot profiles users on a large scale, assume you need a data protection impact assessment (DPIA); the AP’s list of processing requiring a DPIA covers large-scale evaluation of individuals. See our articles on majukumu ya kidhibiti na kichakataji chini ya GDPR na kutumia akili bandia (AI) katika biashara ya Uholanzi.
What does human oversight require?
High-risk systems must be designed so that people can effectively oversee them during use. The overseer must understand the system’s limits, recognise automation bias, interpret output correctly and be able to stop the system.
A person clicking “approve” on advice they cannot assess is not oversight. Name the role, train the people, give them access to the reasoning behind an output and record their interventions.
The GDPR adds a separate test. A person has the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. If a chatbot rejects an application or sets a price automatically, you must offer human intervention, an explanation and a way to contest. Biased output that tracks a protected characteristic can amount to indirect discrimination under the Equal Treatment Act (Algemene wet gelijke behandeling); see our article on dhima ya upendeleo wa algoriti.
Nani anasimamia AI nchini Uholanzi?
The Dutch supervisory structure is still being built. The government proposes that sector regulators keep oversight in their own domains, with the AP and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) in coordinating roles.
The Dutch implementing act (Uitvoeringswet AI-verordening) has not yet been adopted, so national powers and penalties are not final. That does not stop enforcement: the GDPR applies in full, and the AI Act prohibitions apply directly. In its February 2025 AI and algorithmic risks report the AP warned against using generative AI chatbots for voting advice because the outcomes were unreliable and skewed; see the Ripoti ya AP kuhusu AI na hatari za algoriti.
Are you the provider or the deployer?
The AI Act assigns obligations by role. A provider develops a system and places it on the market under its own name; a deployer uses a system under its own authority. Buying a chatbot off the shelf makes you a deployer.
A deployer becomes a provider of a high-risk system if it puts its own name or trademark on it, substantially modifies it, or changes its purpose so that it becomes high-risk. White-labelling a chatbot, or using a customer service bot to sift job applicants, is enough. Provider duties, such as conformity assessment, technical documentation and registration in the EU database, are public-law duties that a contract cannot shift.
Deployers of high-risk systems must use the system as instructed, assign competent oversight, ensure relevant input data, monitor operation, keep the logs and inform workers before a high-risk system is used at work. Under Article 27(1)(k) and (l) of the Works Councils Act (WOR) the works council has a right of consent on rules for processing employee data and on systems that monitor employee behaviour or performance.
How do you protect confidential information?
Staff entering client data, draft contracts or source code into a public chatbot is often the most concrete risk. Depending on the terms of service, the provider may keep or use those inputs for training.
That can breach contractual confidentiality, undermine trade-secret protection under the Trade Secrets Protection Act (Wet bescherming bedrijfsgeheimen), which requires reasonable measures to keep information secret, and be a data breach that must be reported to the AP. A written AI use policy naming approved tools, combined with an enterprise contract that excludes training on your inputs, largely removes this exposure.
Unapaswa kuangalia nini kama msambazaji?
- Record the AI Act classification of each chatbot and why, and review it when the use changes.
- Show a clear AI notice at the start of each conversation and offer a route to a human.
- Fix the GDPR lawful basis, the retention period for transcripts and the processing agreement with the platform.
- Check whether a DPIA is needed and whether the works council must consent (Article 27 WOR).
- Do not put your own brand on a third-party system or change its purpose without checking whether you become a provider.
- Adopt an AI use policy for staff on confidential information.
What should you check as a provider or developer?
- Document the sources of training data and how text and data mining opt-outs under Article 15o Auteurswet were respected.
- Mark synthetic output in a machine-readable way.
- Determine whether your system or model falls under the general-purpose AI rules or the high-risk regime.
- Prepare technical documentation and instructions for deployers.
- Draft licence terms that allocate AI Act roles, IP indemnities and audit rights clearly.
Tunaweza kukufanyia nini kuhusu kufuata sheria za chatbot?
Utawala Wanasheria wa TEHAMA advise businesses on the legal side of AI; our Miongozo ya sheria za TEHAMA cover the wider contractual landscape.
- We classify your chatbot under the AI Act and record the reasoning.
- We review the vendor contract on data sourcing, IP indemnities, AI Act roles and exit.
- We draft the GDPR documentation: privacy notice, processing agreement and DPIA.
- We draft an AI use policy for your staff.
- We assess whether a chatbot output infringes copyright and handle the claim.
- We advise on the works council’s right of consent before you introduce AI at work.
Muhtasari
- A chatbot must comply with the Auteurswet, the GDPR and the AI Act at the same time.
- Text and data mining is allowed under Article 15o Auteurswet unless the rightholder has opted out.
- Most customer-facing chatbots are limited-risk: users must be told they are dealing with AI.
- The omnibus Regulation (EU) 2026/1744 postponed only the high-risk regime.
- Rebranding or repurposing a chatbot can turn a deployer into a provider with heavy obligations.
Maswali yanayoulizwa mara kwa mara
Nani atawajibika ikiwa chatbot itakiuka hakimiliki?
Often both. The developer may be liable for training on protected works without permission or a valid exception under the Auteurswet; the business that publishes infringing output commits its own infringement. Ask your vendor about data sources and negotiate an IP indemnity.
Does the GDPR apply to chatbot conversations?
Yes, as soon as a conversation can be linked to an identifiable person. You need a lawful basis, a clear information notice, data minimisation, a retention period and procedures for access and deletion requests. The Dutch Data Protection Authority (AP) supervises compliance.
What is the first step to make our chatbot compliant?
Classify the chatbot under the AI Act based on what it does: minimal, limited, high-risk or prohibited. A simple FAQ bot has few duties; a bot that screens job applicants or assesses credit is high-risk. Record the classification and your reasoning.
Is chatbot output protected by copyright?
Purely machine-generated output usually is not, because Dutch copyright requires a work with its own original character and the personal stamp of a human maker. Where a person makes real creative choices in shaping the output, protection is possible.
