A compliance lead at a software company with an office in Amsterdam gets a question from the board at the end of October. The Dutch data protection authority has just published its enforcement policy, and the CEO wants to know what happens if something goes wrong with AI. Someone pastes a customer file into a chatbot, it gets reported, the regulator looks into it. Does the company's name then appear on the regulator's website?
The short answer: if the Dutch DPA imposes a sanction, it has generally been published since 1 September 2026. A notification or an investigation is not a sanction. What an organisation does control is what its file looks like when the regulator starts asking questions.
#What the Dutch DPA has published since 1 September 2026
Since 1 September 2026, Article 21b of the Dutch GDPR Implementation Act (in Dutch, checked 31 October 2026) has required the Autoriteit Persoonsgegevens (AP) to publish any administrative sanction it imposes. The article was added by Staatsblad 2026, 154. The exception is information covered by the grounds for refusal in Article 5.1 of the Dutch Open Government Act. Publication is now the legal default.
The article also fixes the timing. The AP publishes no sooner than ten working days after the organisation receives the decision, or sooner if the organisation has already made it public or says it has no objection. If the organisation asks the interim relief judge for a provisional measure, publication waits until the judge has ruled or the request is withdrawn. The same rules cover a decision on objection that imposes a sanction.
Under the Dutch General Administrative Law Act (Article 5:2, in Dutch, checked 31 October 2026), an administrative sanction is an obligation imposed by a public body because of an infringement. A fine is the obvious example. An order subject to a penalty is another: the organisation has to end an infringement and pays if it does not.
#What the regulator can do besides a fine
A fine is only one of the tools. Under Article 58(2) of the GDPR (checked 31 October 2026), a supervisory authority can warn an organisation that planned processing is likely to infringe the GDPR, reprimand it after an infringement, order it to bring processing into line within a set period, order it to tell data subjects about a breach, limit or ban processing temporarily or for good, and impose a fine. The fine can come on top of those measures or instead of them.
For an AI incident, the order to inform data subjects is the one closest to home. An organisation that kept a high-risk breach from the people affected can be made to tell them after all, by a formal decision.
#How an AI incident reaches the regulator
There are three usual routes. The first is your own notification. In a 2024 warning (in Dutch, checked 31 October 2026), the AP said that staff using an AI chatbot against their employer's rules and entering personal data is a data breach. It mentioned two notifications it received: patients' medical data at a GP practice, and a file containing customer addresses, among other things, at a telecoms company. When such a breach must be reported is covered in an employee pasted personal data into ChatGPT.
The second route is a complaint from someone whose data was involved. The third is a tool that breaks the law itself. When the AP fined Clearview AI 30.5 million euros on 3 September 2024 (checked 31 October 2026) over a database of face photos and biometric codes, its chairman Aleid Wolfsen also warned the customers: using Clearview's services is illegal, and Dutch organisations that do so may expect hefty fines. Which AI tools your organisation allows is also a question about your own position in front of the regulator.
#What the regulator weighs when it sets a fine
Article 83 of the GDPR (checked 31 October 2026) lists the factors a supervisory authority takes into account. For an incident involving an AI tool, six stand out:
The ceilings are in the same article: up to 20 million euros or 4% of worldwide turnover for the basic principles and data subjects' rights, among others, and up to 10 million euros or 2% for other obligations. What the regulator imposes in a given case depends on the factors in the table.
Now that an imposed fine is generally published, this table affects the organisation's reputation as much as its budget. An organisation that can show it had a decision in place, helped its people and reported the breach itself is in a different position from one that learned about it through a complaint.
#What the new Dutch enforcement policy covers
On 30 October 2026 the AP published its enforcement policy (in Dutch, checked 31 October 2026). According to the AP, it sets out the principles it applies in the enforcement phase, how the enforcement procedure runs and how it works with other supervisory authorities. The AP says organisations had questions about what to expect during such a procedure. A draft appeared on 13 April 2026, it drew twelve responses, and a separate document explains how the AP handled them. The policy itself is a PDF attached to the announcement.
For a DPO, the policy is most useful as reading before an incident: it shows how a procedure runs before you are in one. The publication duty in Article 21b comes from the law, not from this policy.
#What to have on file before anything happens
The regulator looks back, but it looks at what was in place beforehand. Four things change your position in the table above.
A decision for each AI tool. Which tools are allowed, with which account and for which data, and which are not. Record it in an AI register, with the date and who decided. For a tool a regulator has already warned about, such as Clearview, the decision is quick.
Rules people actually meet. A rule about what never goes into a prompt only helps when staff come across it while they are writing one. How to keep that going is in how to enforce an AI policy.
A breach log with your reasoning. A breach you decide not to report still goes in, with the reason. That is exactly the part the regulator wants to see if it later asks why you did not report.
Reporting in time. Under Article 33 of the GDPR (checked 31 October 2026), without undue delay and, where feasible, within 72 hours of becoming aware of the breach when reporting is required. Anything you do not yet know can be added later. Article 83 names your own notification as a factor.
A file like that starts with knowing which AI tools are in use and where sensitive data is involved. See shows that in counts and data types, never what someone typed. The decision for each tool, with an owner and a history, is recorded in Decide. And when someone pastes text, sensitive data is highlighted in place, so they can mask or remove it before it leaves, or it is masked automatically if the organisation has set it up that way. For people who manage files like these, there is a dedicated page: AI governance for privacy officers.
