Dutch DPA Submits Multi-Year Funding Estimate for AI Act Supervision to Parliament

Key Takeaways

• The Dutch Data Protection Authority (DPA) has shared an implementation and enforceability test on the AI Regulation Implementation Act with Parliament, outlining a multi-year funding estimate (2027–2031) needed to adequately supervise AI under the EU AI Act.
• Compliance teams operating in the Netherlands should note the DPA's expanded role as a market surveillance authority for AI, with supervisory capacity expected to scale alongside rapid AI adoption and increasing system complexity.

Deep Dive

This letter signals the Dutch DPA's formal push to secure adequate long-term funding and capacity to supervise AI systems under the forthcoming AI Regulation Implementation Act, which designates the DPA as a market surveillance authority across several AI Act domains. For compliance teams, this is an early indicator that Dutch AI oversight will intensify over the coming years, with dedicated budgets growing from an estimated EUR 9.7 Million in 2027 to EUR 28.2 Million by 2031, covering both market surveillance and data protection supervisory functions.

Key points include the DPA's acknowledgment that AI adoption among large Dutch companies rose from 35% in 2023 to 52% in 2025, while global AI incident reports have more than tripled since 2022—particularly involving manipulative techniques, deepfakes, and biometric surveillance. Legislation on prohibited AI practices and transparency obligations (e.g., deepfake labeling) has already entered into force, meaning organizations deploying AI in the Netherlands should already be assessing compliance with these prohibitions and disclosure requirements.

Notably, the current funding estimates are based on a "conservative scenario" and explicitly exclude emerging risks from agentic AI and the final AI Omnibus legislation, which the DPA plans to address in a separate assessment this autumn. This suggests further regulatory developments and potentially stricter supervisory expectations are forthcoming, and compliance teams should monitor this additional report closely once published.

Recommended actions for compliance professionals include: (1) reviewing current AI deployments against already-effective prohibited practices and transparency rules under the AI Act; (2) tracking the Dutch Implementation Act's progress through Parliament, as it will formalize the DPA's supervisory powers and scope; (3) anticipating increased regulatory scrutiny and enforcement capacity as DPA funding and staffing grow through 2031; and (4) preparing for additional guidance expected this autumn on agentic AI and the AI Omnibus.

From a risk perspective, this update underscores the trajectory toward more robust, well-resourced AI supervision in the Netherlands, raising the likelihood of enforcement actions, audits, and transparency requirements for firms using AI—particularly those affecting vulnerable groups or involving biometric and manipulative technologies. Financial institutions using AI in customer-facing or decision-making processes should treat this as a signal to strengthen AI governance frameworks now, ahead of fuller implementation.

Source: Netherlands Data Protection Authority