Ang EU AI Act (Regulation (EU) 2024/1689) ay hindi literal na nangangailangan ng isang dokumentong tinatawag na "patakaran ng AI". Sa pagsasagawa, kailangan mo ito: kung walang mga panloob na patakaran kung aling mga sistema ng AI ang iyong ginagamit, kung paano ang mga ito inuuri at kung sino ang responsable, hindi mo maipapakita ang pagsunod sa AI Act, sa GDPR o sa batas sa pagtatrabaho ng Netherlands.
Generative tools draft correspondence, recruitment software ranks candidates and finance systems flag transactions, often through features added to software you already license. Since 2 August 2026 the transparency duties of Article 50 AI Act apply, and the high-risk regime follows on 2 December 2027. Below we explain what a workable AI policy contains, which deadlines apply and how to build a policy people actually use.
Ano ang isang patakaran sa AI, at bakit mo ito kailangan?
An AI policy is the set of internal rules that decides how, why and under what conditions your organisation may use artificial intelligence. It turns the duties in the AI Act, the GDPR and the Works Councils Act into instructions an employee can follow.
The policy states which systems it covers, what may be entered into them, who approves a new tool, when a person must review the outcome and what happens after an incident. The risks are concrete: client data pasted into a public chatbot is a potential data breach under Article 4(12) GDPR, and a selection tool that filters out a group of applicants can breach the Dutch Equal Treatment Act. In each case the organisation that deployed the system carries the responsibility, not the supplier.
Aling mga patakaran ang nalalapat: ang AI Act, ang GDPR at batas sa pagtatrabaho sa Netherlands?
Three sets of rules apply at the same time. The AI Act regulates the system, the GDPR regulates the data, and Dutch employment law regulates what you may do to your own staff with it.
Paano inuuri ng AI Act ang mga sistema ng AI?
The AI Act takes a risk-based approach. Article 5 bans a small number of practices outright, including social scoring and certain manipulative techniques; our article on mga ipinagbabawal na kasanayan sa AI explains them. Since the AI omnibus of July 2026, generating non-consensual intimate images of identifiable people is banned as well.
Uses listed in Annex III count as mataas na panganib na AI, for example recruitment and selection, decisions on promotion and dismissal, creditworthiness assessments and access to essential services. For those systems Articles 9 to 15 require:
- isang sistema ng pamamahala ng peligro;
- pamamahala ng datos;
- teknikal na dokumentasyon at pag-log;
- transparency patungo sa deployer (ang organisasyong gumagamit ng sistema);
- pangangasiwa ng tao;
- katumpakan at katatagan na angkop sa layunin.
Everything else is mainly subject to the transparency duties of Article 50, or to no specific AI Act obligation at all.
Ano ang idinaragdag ng GDPR?
The GDPR applies in full wherever personal data is processed, including for training. Purpose limitation, data minimisation and the need for a lawful basis under Article 6 bite hardest in AI projects.
Article 22 GDPR restricts decisions based solely on automated processing that have legal or similarly significant effects. Where a system is likely to result in a high risk, Article 35 GDPR requires a data protection impact assessment (DPIA) before use. Our article on paggamit ng AI sa iyong negosyong Dutch tinatalakay ang mga obligasyong ito nang mas detalyado.
Ano ang hinihingi ng batas sa pagtatrabaho sa Netherlands?
Under Article 27(1)(k) and (l) of the Works Councils Act (Wet op de ondernemingsraden, WOR), the works council must consent to arrangements on the processing of employee personal data and on systems suitable for monitoring the presence, behaviour or performance of staff. An AI policy that governs monitoring, productivity analytics or automated assessment of employees will often fall within this provision.
A decision taken without the required consent is void if the works council invokes that within one month (Article 27(5) WOR). Consultation is therefore a question of timing, not a formality.
Aling mga deadline ng AI Act ang nalalapat ngayon, at alin ang nabago na?
The bans, the rules for general-purpose AI models and the transparency duties already apply. The obligations for high-risk systems have been postponed to 2 December 2027 and 2 August 2028.
Ang Batas ng AI ay nagkabisa noong Agosto 1, 2024 at nalalapat sa mga yugto:
- 2 2025 Pebrero: nagkabisa ang mga pagbabawal sa mga hindi katanggap-tanggap na kasanayan na may panganib at ang tungkulin sa literasiya sa AI.
- 2 Agosto 2025: Nagkabisa ang mga obligasyon para sa mga tagapagbigay ng mga pangkalahatang-gamit na modelo ng AI, kasama ang mga probisyon sa pamamahala at mga parusa.
- 2 Agosto 2026: the general date of application, including the Article 50 transparency duties: people must be told when they interact with an AI system, and AI-generated content must be marked.
Regulation (EU) 2026/1744, the AI part of the Commission’s digital omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It changes the timetable as follows:
- The high-risk regime for the stand-alone systems in Annex III, including employment, education, credit and essential services, applies from 2 December 2027.
- For AI that is a safety component of products covered by EU product legislation (Annex I), the date becomes 2 August 2028.
- Ang mga generative system na inilagay sa merkado bago ang ika-2 ng Agosto 2026 ay may hanggang ika-2 ng Disyembre 2026 upang matugunan ang tungkulin sa pagmamarka na nababasa ng makina ng Artikulo 50.
- The AI literacy duty is softened: providers and deployers must take measures to support a sufficient level of AI literacy, rather than ensure it.
That is a preparation window, not a reprieve. A recruitment or credit-scoring system you select now will still be running in December 2027, and the supplier contract you sign today decides whether documentation, logging and oversight features exist by then.
Ano ang dapat saklawin ng polisiya?
Start with the scope: which departments and which types of system the policy binds. Typically that means HR, marketing, customer service, finance and operations, and purchased AI software, AI features in existing platforms, in-house models, generative assistants, chatbots and scoring tools.
Two boundary questions need an explicit answer. May employees use public AI tools on their own account for work, and on what conditions? And what happens to AI features that appear in software you already use, without a purchase decision? Both are routes by which AI enters unnoticed, and under Article 26 AI Act the deployer carries the duties either way.
Paano mo binibigyang kahulugan ang AI at paano ito hinahati?
Use definitions that match the concept of an AI system in Article 3(1) AI Act, written with examples from each department. Then divide use into three categories:
- Ipinagbabawal na paggamit: the practices banned by Article 5, plus any application your organisation rules out for its own reasons.
- Kondisyon na paggamit: permitted subject to safeguards, such as a documented risk classification, a DPIA where Article 35 GDPR requires one and approval by a named role.
- Pinahihintulutang paggamit: mga aplikasyon na mababa ang panganib na hindi nangangailangan ng higit pa sa mga pangkalahatang tuntunin sa pagiging kumpidensyal at pagsuri ng output.
Sino ang may pananagutan?
Assign final responsibility for AI compliance at board level, and name the roles that approve new applications, keep the inventory and handle incidents. Where a system may become high-risk, the supplier contract should oblige the provider to deliver the technical documentation, instructions for use and logging capability required by Articles 11 to 13 AI Act.
Paano mo pinangangasiwaan ang data, privacy, seguridad, at transparency?
The policy must state which information may be entered into which system. Confidential business information, client files, special categories of personal data (Article 9 GDPR) and anything covered by professional secrecy generally do not belong in a public tool.
Set out where anonymisation or pseudonymisation is required, how long inputs and outputs are kept and how training data is separated from production data. Route AI incidents into your existing data breach procedure: under Article 33 GDPR a personal data breach must be reported to the Dutch Data Protection Authority (Autoriteit Personsgegevens, AP) without undue delay and, where feasible, within 72 hours.
Since 2 August 2026, Article 50 AI Act requires that people are told when they interact with an AI system, unless that is obvious. Synthetic audio, images, video and text must be marked in a machine-readable way. Translate this into instructions: what the chatbot says in its opening message, how AI-assisted content is labelled and what candidates are told about AI in a selection procedure.
Paano mo isasaayos ang pangangasiwa ng tao, pagsubok sa bias, at literasi sa AI?
For every system that affects a person, the policy must say when a human decides and what that person can actually do. Under Article 14 AI Act, the reviewer must understand the system’s limits and be able to disregard or override its output.
Under Article 22(3) GDPR, a person subject to an automated decision keeps the right to human intervention, to give their point of view and to contest the decision. A sign-off box in a workflow does not meet that standard.
Bakit kailangan pang subukan ang bias?
Systems used in recruitment, performance assessment and credit decisions should be tested periodically for differences in outcomes between groups, with the results recorded. That record supports your AI Act documentation and is your evidence if a rejected candidate alleges discrimination: under the Dutch Equal Treatment Act (Algemene wet gelijke behandeling, AWGB, Article 10) facts suggesting discrimination shift the burden of proof to the employer.
Ano ang kailangan sa AI literacy?
Article 4 AI Act obliges providers and deployers to take measures to support a sufficient level of AI literacy among staff who work with AI systems. In practice that means a basic module for everyone, deeper training for HR, IT, procurement and management, and a record of who was trained and when.
Sino ang nangangasiwa sa AI Act sa Netherlands?
The Netherlands is organising supervision through existing regulators. The draft AI Regulation Implementation Act (Uitvoeringswet AI-verordening) was published for consultation on 20 April 2026 and has not yet been adopted.
Under the draft, the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) and the AP share a coordinating role, and sector supervisors keep their own domains. The fines come from Article 99 AI Act: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for most other infringements.
Paano ka makakarating mula sa isang unang imbentaryo patungo sa isang gumaganang patakaran sa AI?
Start with an inventory of what is actually in use, including AI features inside existing software and tools employees adopted themselves. Then work through these steps:
- Pag-uri-uriin each application: prohibited, high-risk under Annex III, subject to Article 50, or low-risk.
- Pagtatasa the risks, combining the AI Act classification with the GDPR analysis and, where staff are affected, the Article 27 WOR question.
- Burador the policy and align it with your privacy, information security, procurement and HR frameworks.
- Isakatuparan it where decisions are made: purchasing templates, the software intake process, the recruitment procedure and the training calendar.
- Pagsusuri it at least once a year, and when a significant new system arrives, the law changes or an incident occurs.
What should you check as the organisation using AI?
As deployer you carry your own duties under Article 26 AI Act, whoever built the system. Check these points:
- No system in use falls under the Article 5 bans, which have applied since 2 February 2025.
- Chatbots and content tools meet the Article 50 transparency duties that apply since 2 August 2026.
- A DPIA under Article 35 GDPR is done for AI that processes personal data with a high risk.
- The works council has consented under Article 27 WOR to AI that monitors or assesses staff.
- Contracts for future high-risk systems secure documentation and logging before 2 December 2027.
What should you check as the supplier of an AI system?
As provider of a high-risk system you carry the heaviest obligations, set out in Article 16 AI Act. Check these points:
- Whether your system falls under Annex III or Annex I, and which date applies to it.
- Whether your risk management, data governance and technical documentation meet Articles 9 to 11.
- Whether the system logs events and comes with instructions for use (Articles 12 and 13).
- Whether the conformity assessment (Article 43) and EU database registration (Article 49) are planned.
- Whether your generative output is marked in a machine-readable way under Article 50(2).
What can we do for you with your AI policy?
Ang aming Mga abogado sa IT advise on the AI Act together with the privacy and employment questions that come with it. Concretely:
- We review your AI inventory and classify each system under the AI Act.
- We draft or review your AI policy and align it with your privacy and HR rules.
- We review supplier and licence agreements for AI systems on documentation, logging and liability.
- We carry out or review the DPIA for AI applications that process personal data.
- We prepare the consent request to the works council under Article 27 WOR.
Buod
- Hindi hinihingi ng AI Act ang isang dokumentong tinatawag na patakaran sa AI, ngunit kung wala ito ay halos hindi mo maipapakita ang pagsunod sa AI Act, sa GDPR, at sa batas sa pagtatrabaho ng Netherlands.
- Ang mga pagbabawal, ang mga patakaran para sa mga pangkalahatang-gamit na modelo ng AI at ang mga tungkulin sa transparency sa Artikulo 50 ay nalalapat na.
- Ipinagpaliban ng Regulasyon (EU) 2026/1744 ang rehimeng may mataas na panganib sa Disyembre 2, 2027 (Annex III) at Agosto 2, 2028 (Annex I).
- Ang AI na nagmomonitor o nagtatasa ng mga kawani ay kadalasang mangangailangan ng pahintulot ng works council sa ilalim ng Article 27 WOR.
- Magsimula sa isang imbentaryo, pagkatapos ay uriin, tasahin, ibalangkas, ipatupad at repasuhin.
Mga madalas itanong
Mandatory ba ang isang patakaran sa AI sa ilalim ng EU AI Act?
Not as a separately named document. In practice you need one to show that you meet the duties under the AI Act and the GDPR, such as the Article 5 bans, the Article 50 transparency duties, human oversight and AI literacy. Without written rules and a record of decisions, that is hard to prove to a supervisor.
Does the AI Act apply if we only use off-the-shelf software?
Yes. If AI features are built into third-party software, your organisation is the deployer and has its own duties under Article 26 AI Act and the GDPR. Your contract should oblige the vendor to give you the information you need.
May AI systems make decisions about employees or customers on their own?
Only to a limited extent. Under Article 22 GDPR, a decision with legal or similarly significant effects may not be based solely on automated processing, except with explicit consent, for a contract or where the law allows it. Even then the person can ask for human intervention and contest the decision.
Maaari bang paghigpitan ng isang patakaran sa AI ang paggamit ng mga empleyado ng mga pampublikong tool sa AI?
Yes. As employer you can set rules on which tools may be used and what information may be entered, under your right to give instructions (Article 7:660 of the Dutch Civil Code). Rules that involve monitoring staff require the works council’s consent under Article 27 WOR.
Gaano kadalas dapat suriin ang isang patakaran sa AI?
At least once a year, and whenever a significant new system is introduced, an incident occurs or the law changes. The high-risk deadlines of 2 December 2027 and 2 August 2028 are natural review moments.
