The Netherlands

Nevertheless, the use of AI in Dutch legal services is regulated by a combination of binding legislation, supervisory enforcement and guidance, professional standards, human rights principles, and guidance provided by courts. Together, these instruments seek to ensure that AI is deployed in a lawful, ethical, transparent, and accountable manner. There is currently no general legal obligation under Dutch law or the EU AI Act requiring judges, lawyers, or litigants to disclose the use of AI in court. However, certain transparency obligations may arise in specific contexts, particularly in relation to high-risk AI systems or automated decision-making, and professional or judicial guidance increasingly emphasises transparency and accountability in the use of AI.

The most significant legislative framework in this context is the EU AI Act. The EU AI Act entered into force on 1 August 2024 and constitutes the first comprehensive EU-wide regulation that sets standards for the development and use of AI, including its use in the administration of justice. Its provisions are being implemented in phases and will become fully applicable in the Netherlands by 2 August 2027.

The Digital Omnibus VII (discussed below) on AI will push the date for high-risk applications under the AI Act Annex III. Following political agreement in May 2026, it deferred high-risk AI obligations to December 2027 (stand-alone systems) and August 2028 (embedded systems).

AI regulation

EU AI Act (Regulation (EU) 2024/1689)

The EU AI Act is a key part of the legal framework regulating the use of AI across the EU. It entered into force on 1 August 2024, and sets out a comprehensive legal framework aiming to ‘guarantee safety, fundamental rights and human-centric AI’. The EU AI Act is being phased between 2025 and 2030. The Netherlands is obliged to implement and comply with the provisions of the Act, which set out a harmonised legal framework for ‘the development, the placing on the market, the putting into service, and the use’ of AI systems across the EU.

The EU AI Act introduces a risk-based approach, categorising AI systems into four levels of risk, banning ‘unacceptable-risk’ systems, and imposing strict obligations on high-risk systems. The rules on prohibited uses have applied since 2 February 2025, the rules on general-purpose AI models and the designation of competent national authorities have applied since 2 August 2025 while obligations related to the use of high-risk AI systems, are being introduced later.

The EU AI Act includes explicit references to AI systems related to the administration of justice, and to criminal proceedings. These are mainly classified as high-risk given ‘their potentially significant impact on . . . the rule of law, individual freedoms . . . the right to an effective remedy and to a fair trial’ as well as the right to defence and the presumption of innocence, particularly if ‘such AI systems are not sufficiently transparent, explainable [or] documented’. The Act highlights the potential ‘difficulty in obtaining meaningful information on the functioning of those systems and the resulting difficulty in challenging their results in court, in particular by natural persons under investigation’.

Articles 51-56 of the EU AI Act establish a specific regime for ‘general-purpose AI models’, defined in article 3(63) as models trained on large datasets capable of performing a wide range of tasks. They typically include large language models (LLMs) that can be integrated into legal research platforms, drafting tools or judicial support systems. Providers of such models must:

• maintain technical documentation;
• provide information to downstream integrators;
• comply with EU copyright law; and
• publish a summary of training data.

Under articles 55-56, additional obligations apply to general-purpose AI models presenting systemic risk, including risk assessment, mitigation measures and incident reporting. The framework is particularly relevant to the judicial sector given that courts and prosecutors may rely on external LLM-based tools rather than developing their own systems.

In terms of governance and enforcement of the EU AI Act, the Act adopts a two-pronged approach. At the EU-level, according to Articles 64-69 of the AI Act, the AI Office of the European Commission and an AI Board (Article 65) are the main actors. The AI Office enjoys enforcement powers with respect to obligations of general-purpose AI models (Article 88 et seqq.). The AI Board assists the European Commission and the member States in facilitating coherent applications of the AI Act, and therefore contributes to the coordination among national authorities (Article 66(a)).

With respect to domestic enforcement, it is the responsibility of the national supervisory authorities under the EU AI Act to clarify how the prohibitions laid down in the Regulation will be interpreted and enforced in practice. In preparation for this task, the Dutch Data Protection Authority has issued several public calls inviting stakeholders to share their needs, information, and insights. The responses received may be taken into account in the further interpretation and guidance concerning the prohibited practices. In October 2025, the Data Protection Authority published a second guide, ‘Building AI Literacy’, a follow-up to its first guide on ‘Get Started with AI Literacy’. The Data Protection Authority gained insights for this second guide through the public calls for input and a seminar on ‘Working Together on AI Literacy’ in June 2025.

Since 2 February 2025, AI systems involving unacceptable risk have been prohibited in the Netherlands. For example, the Crime Anticipation System (CAS), a well-known AI-driven algorithm in the Netherlands, developed by the police to predict the likelihood of crime, has been phased out since 1 December 2025. The System assessed a given area based on: (i) the number of incidents of a particular type of crime that occurred in or around the area, and (ii) the number of known suspects associated with that type of crime residing in the area. This information was understood in the context of criminological research which shows that most burglars operate in their own familiar surroundings, often within walking distance of their own homes. Following an evaluation which revealed, inter alia, the presence of bias in the system, the decision was made to phase the system out.

Several non-binding guidelines have already been published by the European Commission to provide further directions when implementing the AI Act:

• Guidelines on prohibited artificial intelligence (AI) practices (published on 04 February 2025) provide legal explanations and practical examples of AI practices that are deemed unacceptable and hence prohibited by Article 5 of the AI Act, due to their potential risks to European values and fundamental rights. The guidelines specifically address practices such as harmful manipulation, social scoring, and real-time remote biometric identification, among others.
• Guidelines on AI system definition (published on 06 February 2025) explain the practical application of the legal concept of AI to assist providers and other relevant persons in determining whether a software system constitutes an AI system. The guidelines elaborate on each of the seven elements of the definition of an AI system provided by Article 3(1) AI Act : (1) machine-based system, (2) autonomy, (3) adaptiveness, (4) AI system objectives, (5) inferencing how to generate outputs using AI techniques, (6) outputs that can influence physical or virtual environments, (7) interaction with the environment.
• Other guidelines are currently being developed by the European Commission. For instance, the Commission has issued Draft guidelines on the classification of high-risk AI systems, setting out the Commission’s interpretation of certain concepts that are relevant for classification purposes, and contain practical examples of AI systems that should or should not be classified as high-risk. High-risk uses of AI systems may include, for example, tools for the assessment of an individual’s risk of offending or reoffending, generating risk scores, profiling identified persons, or otherwise supporting operational law-enforcement decision-making. The Guidelines emphasise that classification depends on the system’s intended purpose and practical use, rather than solely on how it is labelled by the provider.

Other European Regulations and Guidelines

At the European level, the AI Act coexists with additional regulations and guidelines.

Guidelines for practitioners

Dutch Register of Court Experts, Guideline for the Use of AI Applications by Judicial Experts (2025)

The Dutch Register of Court Experts (Nederlands Register Gerechtelijk Deskundigen) serves as a forensic quality assurance body for the judiciary in the Netherlands. On 7 April 2025, the Register of Court Experts established Guidelines for the Use of AI Applications by Judicial Experts. These Guidelines provide, inter alia, that:

1. Judicial experts who use AI tools must have sufficient understanding of the system concerned, including how it works, and how to identify risks.
2. Judicial experts must comply with the terms of use and license conditions of the AI application used.
3. Judicial experts must respect the confidentiality of the data they work with by only using AI applications that offer sufficient confidentiality of data, or by not using confidential data in the AI application.
4. Judicial experts are at all times ultimately responsible for the content of the report.
5. Judicial experts must review every result, including the sources cited therein, that is generated by means of an AI application against their own knowledge.
6. Judicial experts must ensure transparency about the use of AI applications in the execution of the investigation by adequately stating its use.
7. Judicial experts must periodically evaluate the AI application used with regard to its suitability for the expert investigation.

Dutch Bar Association, Recommendations on AI in the Legal Profession (2025)

The Dutch Bar Association has published Recommendations on AI in the Legal Profession, applying broadly to the use of AI across legal practice in general, regardless of the type of matter involved. The Recommendations provide a wide range of practical guidance and advice that largely aligns with the practices already common in other European countries. However, the Bar Association Recommendations, unlike other guidelines to practitioners, advise lawyers to obtain prior consent from their clients before using AI in the handling of a case. The Recommendations are structured around the core professional values of the legal profession.

In addition, the Dutch Bar Association provides a list of basic concepts and frequently asked questions to help lawyers get started with AI, and explicitly refers to the Guide on the Use of Generative AI by Lawyers of the Council of Bars and Law Societies of Europe, which outlines the opportunities risks, and professional obligations associated with generative AI from a European perspective.

Regional guidelines on judiciary’s use of AI

Moreover, there are several European-level guidelines that address the judiciary’s use of AI, most notably the European Ethical Charter on the use of AI in judicial systems and their environment adopted by the European Commission for the Efficiency of Justice (CEPEJ) of the Council of Europe (discussed above).

Other non-binding initiatives have given rise to guidelines for justice system professionals and for lawyers, or may serve as useful benchmarks and standards to be upheld in professional practice:

UNESCO Guidelines for the Use of AI Systems in Courts and Tribunals (2025)

As at June 2026, the Netherlands has not formally adopted the UNESCO Guidelines for the Use of AI Systems in Courts and Tribunals (2025), nor has it engaged with them in a published way in terms of government adoption, court pilot programmes, or explicit statements from the judicial body. However, UNESCO is providing support to the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur), as well as to members of Dutch and European working groups focused on AI supervision, potentially including AI applications within criminal law.

The Netherlands previously completed a National AI Readiness Assessment Report based on UNESCO’s Recommendation on the Ethics of Artificial Intelligence. In that assessment, the Netherlands performed relatively well compared to other UNESCO Member States, particularly regarding transparency and the ethical use of AI.

Criminal procedure rules

As at June 2026, the Dutch Code of Criminal Procedure contains no specific or explicit provisions that regulate the use of AI in criminal proceedings as such. As a result, the police and the Public Prosecution Service must operate within the existing framework of investigative powers. Based on the broad wording of Article 339 of the Code of Criminal Procedure, almost any type of evidence is admissible in Dutch courts. The provision lists the following types of evidence, which are admissible in court: (i) what the judge perceives on their own; (ii) statements by suspect; (iii) statements by witnesses; (iv) statements by an expert; and (v) written documents.

Data protection legislation

The use of AI in criminal proceedings may further be constrained by existing data protection frameworks, in particular EU Regulations. In addition to the EU AI Act, EU data protection regulations must be observed with regard to the use of AI in criminal proceedings. The EU AI Act does not seek to affect existing EU law governing the processing of personal data (according to Article 2 No. 7 AI Act and Recital 10). Data protection law governing the use of personal data may be relevant with regard to various stages of the AI lifecycle. Personal data can be relevant during AI development (e.g., collection and use of data for training) and AI use (e.g., personal data as input data).

On 25 January 2012, the European Commission presented the Data Protection Reform package, proposing a directive (LED) and a regulation (GDPR). On 27 April 2016, the European Parliament and the Council adopted:

• The Law Enforcement Directive (Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data) (‘LED’)
• The General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the European Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (‘GDPR’).

The GDPR remains the primary regulation for ‘general’ processing of data, but the LED is the lex specialis for criminal matters, since it governs processing ‘for the purposes of the prevention, investigation, detection, or prosecution of criminal offences or the execution of criminal penalties’. These regulations have distinct scopes of application that are intended to be complementary.

In both regulations, ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 3 (1) LED and Article 4 (1) GDPR). As at June 2026, this term also includes pseudonymised data as indicated by Article 4 (5) GDPR. Recital 26 sentence 2 points out that identifiability should (still) be recognised in view of pseudonymised personal data that could be assigned to a natural person based on additional information.

In the Netherlands, the Dutch Implementation Act of the GDPR supplements the General Data Protection Regulation at national level, whilst the Police Data Act 2008 (Wet politiegegevens) implements the Law Enforcement Directive.

EU Directive 2016/680, Law Enforcement Directive (LED) (2016)

The directive governs the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties.

The rights of data subjects are recognised but may be limited in order to ensure the proper conduct of investigations, prevention, and the prosecution of offenses. These rights include the right to information, the right of access (often exercised indirectly through the supervisory authority), and the right to rectification or erasure. As such, the directive imposes obligations on data controllers that are comparable to those of the GDPR, but creates additional obligations that are specific to the criminal context:

1. There must be a clear distinction among categories of data subjects: those suspected of committing or planning a criminal offense, those who have been convicted, victims of crimes, and individuals who may be at risk of becoming victims. It also includes third parties connected to a crime, such as potential witnesses, people who can provide information, and contacts or associates of the individuals mentioned above, as set out in Article 6.
2. The processing of special categories of personal data is strictly regulated under Article 9(2) of the GDPR and requires the data subject's consent, which shall be freely given and well-informed, or for a legitimate purpose. But the LED establishes a specific exception for criminal matters: Article 10 permits the processing of sensitive data without consent when it is strictly necessary, provided that appropriate safeguards are implemented.
3. The LED also addresses automated individual decision-making. A decision ‘based solely on automated processing, including profiling, which produces an adverse legal effect concerning the data subject or significantly affects him or her’, is prohibited unless authorised by Union or Member State law to which the controller is subject and which provides appropriate safeguards for the data subject´s rights and freedoms of, at least the right to obtain human intervention on the part of the controller (Article 11 (1)). The EU legislator specifies that this right to intervention comprises the right to express his or her point of view, to obtain an explanation of the decision reached after such assessment or to challenge the decision (Recital 38). Furthermore, such decisions shall not be based on special category data, such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union memberships, as well as genetic data, biometric data, data concerning health or a natural person’s sex life or sexual orientation, unless suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place (Article 11 (2)). The LED further prohibits profiling resulting in discrimination against natural persons on the basis of special category data (Article 11 (3)).
4. In order to protect individuals’ rights during criminal investigations, Articles 13 and 14 provide for information and access rights, while allowing limitations where their exercise could undermine ongoing investigations or prosecutions.
5. Article 16 complements these safeguards by providing the right to request the rectification of inaccurate data and the erasure of data, and in case of refusal, the possibility of lodging a complaint with a supervisory authority or seeking judicial remedy.
6. Finally, Articles 27 and 29 impose obligations relating to risk assessment and data security, requiring competent authorities to assess the impact of high-risk processing operations and to implement appropriate technical and organisational measures throughout the criminal procedure.

Regulation (EU) 2016/679, General Data Protection Regulation (GDPR)

The GDPR protects fundamental rights in the digital landscape by imposing obligations on data controllers and processors upon all processing of personal data. Hence, in the area of criminal justice, the GDPR is relevant for (i) the processing of personal data collected by competent authorities for the purposes set out above but intended to be further processed for other purposes, (ii) processing by public bodies for other purposes from the outset (this includes, e.g., archiving conducted by criminal justice authorities), and (iii) any processing by natural persons or private entities (Article 9 (1) and (2) LED, Article 2 (1) GDPR, Recital 19 to GDPR).

Obligations placed on data controllers include: lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability; transparency and information duties; security obligations; data protection impact assessments. The GDPR also grants basic rights to data subjects such as access, rectification and erasure of personal data.

Compared to the LED, the GDPR establishes a higher level of protection regarding the lawfulness of processing. Several aspects of criminal proceedings are subject to the following provisions of the GDPR:

1. Article 10 requires the processing of personal data relating to criminal convictions and offences to be carried out ‘only under the control of official authority’, and to provide for ‘appropriate safeguards for the rights and freedoms of data subjects.
2. Paragraph 1 of Article 22 prohibits any decision that produces legal or similar effects if it is based exclusively on automated data processing. This serves as a key safeguard against ‘algorithmic judges’ or fully automated sanctions.
3. Paragraph 1 of Article 35 provides that the controller must carry out a data protection impact assessment prior to any processing likely to pose a high risk to the rights and freedoms of individuals, particularly when new technologies are involved. A single assessment may cover multiple similar processing operations presenting comparable risks.

On 6 and 25 May 2018 respectively, the GDPR and the LED were implemented across all EU Member States.

EU AI Act (Regulation (EU) 2024/1689)

Acknowledging both existing data privacy regulations and the relevance of personal data in the AI context, the EU AI Act contains several provisions addressing the use of such data in the course of complying with broader obligations under the AI Act:

1. The EU AI Act provides a (narrow) legal basis for the processing of special category personal data in the context of training or testing a high-risk AI system. Where such processing is strictly necessary for the purpose of ensuring bias detection and correction in relation to a high-risk system, the providers of such systems may exceptionally process special category data, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons. Exceptional circumstances exist where (in addition to the requirements for such processing set out in the LED or the GDPR) certain cumulative conditions are met, including where there are technical limitations and state-of-the-art security measures, including pseudonymisation, as well as strict security safeguards (cf. Article 10 No. 5 sentence 2 AI Act, (6)).
2. The data sets for training, validation, and testing of AI systems shall be subject to appropriate data governance and management practices that, in the case of personal data, shall also concern the original purpose of the data collection (Article 10 No. 2 (b) AI Act).
3. Where applicable, deployers of high-risk AI systems shall use the information provided for such systems under their transparency obligation (cf. Article 13 AI Act) for conducting a data protection impact assessment under the LED or the GDPR (Article 26 No. 9 AI Act).

Judicial and Criminal Data Act 2004

The Judicial and Criminal Data Act 2004 (Wet justitiële en strafvorderlijke gegevens) regulates the processing of judicial data and criminal records by judicial authorities and other competent bodies, such as the Public Prosecution Service (Openbaar Ministerie). The Act distinguishes between: (1) ‘judicial data’, defined as personal data or data relating to a legal person concerning the application of criminal law or criminal procedure that are processed in a data file, and (2) ‘criminal procedural data’, defined as personal data or data relating to a legal person obtained in the context of a criminal investigation and processed by the Public Prosecution Service in a criminal file or by automated means in a data system. It establishes requirements relating to lawful processing, purpose limitation, data accuracy, retention periods, access controls, and the exchange of judicial data with other authorities. Moreover, it provides the data subjects with various rights, such as the right to information.

Cybersecurity laws

Although the Netherlands does not have a specific national cybersecurity law that specifically restricts the use of AI tools in criminal proceedings, relevant obligations arise under EU legislation.

EU AI Act (Regulation (EU) 2024/1689)

For high-risk AI systems, the EU AI Act requires resilience against attempts by unauthorised third parties to alter their use, outputs, or performance by exploiting system vulnerabilities (Article 15 (5)), which is confirmed by the underlying Recital 76, emphasising the crucial role of cybersecurity.

EU Cybersecurity Act (2019) and EU Cyber Resilience Act (2024)

As regards the demonstration of compliance with the AI Act’s cybersecurity requirements for high-risk AI systems, two other European regulations may be relevant:

EU NIS2 Directive (2016) and Implementing Legislation

At the domestic level, Dutch cybersecurity law is primarily based on the implementation of the EU NIS2 Directive (Directive (EU) 2022/2555) (implemented via The Cybersecurity Act (Cyberbeveiligingswet)), which imposes strict risk management, incident notification, and security obligations on critical entities and public bodies, under the supervision of the National Cybersecurity Agency. The Tweede Kamer approved the law on 15 April 2026, followed by the Eerste Kamer on 7 July 2026. The Cybersecurity Act is expected to enter into force on 15 August 2026, at which point new cybersecurity obligations will apply to over 8,000 organisations in the Netherlands.

In particular, EU NIS2 Directive establishes a high common level of cybersecurity across the EU, requiring entities subject to the framework to implement comprehensive cybersecurity risk management measures, covering access control, supply chain security, physical security of network systems, and human resources security, while management bodies are personally accountable for approving and overseeing such measures. On incident reporting, the Directive introduces a tiered architecture requiring an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and further reports as the situation develops. At governance level, Member States must establish national cybersecurity strategies, designate competent authorities, and set up Computer Security Incident Response Teams.

Human rights

The use of AI in criminal proceedings is limited by a framework of both procedural and substantive fundamental rights. Procedural rights, such as the right to a fair trial and access to an effective judicial remedy, ensure that substantive rights, such as privacy and non-discrimination, can be effectively realised. At the same time, they embody intrinsic values such as fairness, transparency, balance, and objectivity. These rules exist at the constitutional, European and international level.

At national level, initiatives such as human rights impact assessments, including the Fundamental Rights and Algorithms Impact Assessment, and the public algorithm register contribute to the responsible use of AI by authorities. The algorithm register provides an opportunity to publish the outcomes of such human rights assessments.

Constitution of the Kingdom of the Netherlands

Under the Constitution of the Kingdom of the Netherlands, key protections include the right to privacy (Article 10), the right to equality and non-discrimination (Article 1), and judicial independence (Article 17). These rights play a central role in shaping the permissible use of AI within the criminal justice system.

Regional and international human rights guarantees

The human rights framework in the Netherlands is also framed by the European Convention on Human Rights (‘ECHR’), the Charter of Fundamental Rights of the European Union (‘CFR’), the International Covenant on Civil and Political Rights (‘ICCPR’), and the Convention on the Rights of the Child (‘CRC’):

Moreover, the Council of Europe Framework Convention on AI and Human Rights, Democracy, and the Rule of Law deserves special mention as a multilateral initiative, being the first legally binding international treaty specifically designed to regulate AI. Opened for signature in September 2024, its primary objective is to ensure that as AI technologies evolve, they do not erode the fundamental pillars of modern society: human rights, democratic integrity, and the rule of law. As at June 2026, the Convention has not yet entered into force, as the minimum number of five ratifications has not been reached yet. Thus, the Convention currently has no binding effect in France. The Convention focuses on the lifecycle of AI systems, from design to decommissioning, and mandates adherence to seven fundamental principles: human dignity, transparency, accountability, equality, privacy, reliability, and safe innovation. It requires signatories to establish independent oversight bodies and provide clear legal remedies for individuals who suffer harm due to AI systems.

Outlook

As at June 2026, the Netherlands is progressing several forward-looking reforms addressing AI in criminal justice, including a modernised Code of Criminal Procedure adopting a technology-neutral approach to digital and algorithmic evidence-gathering, a dedicated AI strategy adopted by the Dutch judiciary structured around ten strategic objectives, and at the EU level, streamlining reforms to the GDPR and AI Act under the European Commission’s proposed Digital Omnibus Regulation.

New Code of Criminal Procedure (entry into force 1 April 2029)

As at June 2026, a key forthcoming reform in the Dutch criminal justice system is the modernisation of the Dutch Code of Criminal Procedure, with a new Code scheduled to enter into force on 1 April 2029. The central objective of this proposal is to adapt criminal procedure to a fully digital criminal justice system, enabling courts to facilitate digitally conducted proceedings.

The New Code of Criminal Procedure includes a provision allowing the public prosecutor to instruct companies or other institutions to analyse specified datasets and submit only the processed outcomes to law enforcement authorities (Article 2.7.20 of the New Code). According to the Explanatory Memorandum, private or non-investigative entities (such as Google, Apple or Facebook) may be required to analyse, compare, or combine data in order to generate ‘new data’ for investigative purposes. Although AI is not explicitly mentioned, the broad wording suggests that AI-driven data analysis techniques would likely fall within the scope of this provision.

The Explanatory Memorandum adopts a deliberately technology-neutral approach. Rather than regulating specific technologies (such as AI), the New Code of Criminal Procedure formulates general procedural rules designed to remain applicable to future technological developments. This creates regulatory space for the deployment of AI tools in criminal proceedings without requiring continuous legislative amendments. At the same time, the Memorandum explicitly acknowledges that AI is expected to play an increasingly significant role in criminal investigations and recognises the potential implications for fundamental rights. It emphasises that digitalisation and technological advances have created new opportunities for law enforcement. By seizing computers, servers and digital storage devices, or by obtaining remote access to them, investigative authorities are increasingly able to gather vast amounts of data. Technological developments, including the use of algorithms, whether self-learning or not, enable law enforcement to process these large datasets and to identify patterns and connections within them.

Dutch Judiciary, Strategy Adopted by the Dutch Judicial System for AI (2026)

In its Annual Plan 2026, the Dutch judiciary has announced a Strategy for AI, where it announced its intention to expand the use of AI within the judiciary. To this end, the judiciary is working on a dedicated AI programme structured around ten strategic objectives aimed at ensuring the responsible use of AI. These objectives include:

1. Developing a weighting framework for the purposes of protecting the judiciary as an independent third state power, the autonomy of the judge, fundamental rights (including Article 6 ECHR), core judicial values (including values relevant for AI, such as sovereignty and sustainability), ethics (for example by the use of the Fundamental Rights and Algorithms Impact Assessment);
2. Establishing independent supervision on the adequate use of that weighting framework, making sure not only the question ‘may we use it?’ is asked, but also ‘do we want to use it?’;
3. Developing, together with the law content department, visions, regulations, arrangements and anything that is needed to adequately deal with AI, in consultation with relevant stakeholders, such as the Dutch Bar Association and other chain partners;
4. Investing in information, development and training programmes to support the use of AI in judicial practice, including recognising, developing and ensuring the correct implementation of new AI applications;
5. Actively participating in public and collaborative initiatives, including cooperation with chain partners such as J&V Data Lab and the Dutch Forensic Institute, as well as European collaboration (European Networks of Councils for the Judiciary, Consultative Council of European Judges), social and scientific partnerships;
6. Continuing to conduct experiments with AI, both on the basis of initiatives taken by individual courts and ideas originating within the judiciary, with rapid scaling to national implementation where appropriate and systematic sharing of experiences;
7. Investing in a data and AI platform that enables experimentation and scalability, serving as a practical asset for courts and court users;
8. Continuously improving the quality and availability of judicial data, recognising its importance for AI use, and developing a framework for the responsible sharing of data, with due regard for privacy, availability, integrity and reliability;
9. Focusing primarily on low-risk applications of AI, adopting a learning-by-doing approach to identify requirements for higher-risk uses, while explicitly excluding the use of AI for judicial decision-making;
10. Ensuring adequate control and monitoring of AI projects and applications, compliance with the EU AI Act, transparency regarding AI use, inclusion of AI systems in a publicly accessible algorithm or AI register, and regular evaluation and updating the AI strategy in light of technological and societal developments.

European Commission’s Proposed Digital Omnibus Regulation (2025)

In November 2025, the European Commission published its Digital Omnibus Regulation Proposal, a reform package to simplify and streamline existing EU regulations concerning the digital space, including the GDPR and EU AI Act. Respective amendments to the LED are to follow.

Notably, the European Commission intends to amend the definition of the term ‘personal data’ in Article 4 (1) GDPR by stating that information is ‘not to be considered personal data for a given entity when it does not have means reasonably likely to be used to identify the natural person to whom the information relates.’ Accordingly, such an entity would not fall within the scope of the GDPR regarding the processing of such data. This approach is generally in line with recent CJEU case law establishing that existing additional information enabling an entity to identify the data subject does not as such mean that pseudonymised data are to be considered personal data in all cases and for every person. In other words, personal data can be pseudonymised for one entity and anonymised (and thus not identifiable) for another (CJEU, 4 September 2025, EDPS v SRB, C‑413/23 P). Such an amendment wording would, if implemented, significantly reshape the legal test to be conducted to assess applicability of the GDPR (i.e., the assessment of the existence of personal data) towards an entity-focussed approach and largely exclude pseudonymised data from the scope of the GDPR.

The European Commission, through its Digital Omnibus Regulation, also intends to clarify that the processing of personal data in the context of AI development may be carried out for purposes of a legitimate interest where appropriate (Article 6 (1) (f) GDPR). Such an amendment would address an issue that has been widely adopted since the emergence of LLMs, and which has also been subject to a dedicated Opinion of the European Data Protection Board (Opinion 28/2024).

CASES

Right to privacy

On 5 February 2020, the District Court of the Hague considered the Dutch government’s use of the System Risk Indication system to detect social security fraud through data profiling and algorithmic risk assessment. The Court ruled that the System Risk Indication system violated the European Convention on Human Rights (Article 8), as its use lacked sufficient transparency, safeguards, and proportionality, posing an unacceptable risk to privacy and data protection (ECLI:NL:RBDHA:2020:865). The Court concluded that the System Risk Indication system legislation was unlawful and ordered its discontinuation for social welfare investigations. In its assessment, the Court weighed the objectives of the System Risk Indication system legislation, namely the prevention and detection of fraud in the interest of economic well-being, against the interference with individuals’ right to private life. It concluded that the legislation failed to strike the ‘fair balance’ required under the ECHR to justify such an interference. In particular, the framework governing the deployment of the System Risk Indication system was deemed insufficiently transparent and verifiable.

On 19 December 2025, the District Court of Zeeland-West-Brabant (ECLI:NL:RBZWB:2025:9184) addressed whether a vehicle stop following an Automatic Number Plate Recognition hit amounted to unlawful automated decision making. The defence argued that the inclusion of the vehicle in the Automatic Number Plate Recognition reference database and the subsequent stop were based solely on AI, and that this violated the defendant’s procedural and privacy rights, requiring exclusion of the evidence obtained. The Court rejected this argument. It found that the vehicle had been placed in the reference database with the authorisation of a public prosecutor and that there was no indication that this decision was taken solely on the basis of AI. The actual stop was carried out following a decision by police officers on site. The Court therefore concluded that the relevant decisions were taken by human authorities and that the use of Automated Number Plate Recognition did not constitute unlawful automated decision making.

Data protection

The Dutch Data Protection Authority has imposed a fine of EUR 30.5 million on the American company Clearview AI Inc for breaches of the GDPR. The company was accused of unlawfully building a database containing billions of facial images, including images of Dutch citizens. Clearview AI’s database reportedly consists of more than fifty billion photographs scraped from the internet. Its software enables the identification of individuals from images such as security camera footage, without the knowledge or consent of the individuals concerned. After a demonstration by Clearview in 2020, the option for temporary access for testing was granted to some law enforcement attendees. However, Dutch law enforcement did not make use of Clearview.

Facial recognition

In its judgment of 17 May 2019, the District Court of Zeeland-West-Brabant (ECLI:NL:RBZWB:2019:2191) considered the validity of evidence that was produced by the Central Automatic Technology for Recognition system (‘CATCH’). The Court held that a ‘hit’ identified in the CATCH system does not, by itself, provide sufficient grounds to determine that the suspect was the person who withdrew money from the ATM using a stolen bank card. Furthermore, the fact that two investigators observed numerous similarities and no meaningful differences was not regarded as persuasive enough to support reliance on the system’s result. The investigation conducted by the two experts was submitted by the Public Prosecution Service; the Court did not appoint expert witnesses. In the absence of additional evidence, the Court concluded that the identification alone was inadequate and that the defendant must therefore be acquitted.

AI evidence-management platforms

In its judgment of 19 April 2018, the District Court of Amsterdam (ECLI:NL:RBAMS:2018:2504) held that the use of Hansken, a digital platform designed to process and make searchable large volumes of seized evidence (discussed above), does not qualify as expert examination. Consequently, data obtained through Hansken was not regarded as expert evidence. The ruling demonstrates that the Court considered the data analysis performed with Hansken to be sufficiently reliable and therefore did not grant a request for a counter-expert examination of the system. According to the Court, the defence had been given adequate opportunity to conduct its own searches within the dataset using Hansken, which, in the Court’s view, contained all information relevant to the proceedings.