Rules
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
The Algorithm Register is the public website where Dutch public bodies describe the algorithms they use. The IAMA is a questionnaire through which a team identifies an algorithm's human rights implications beforehand. Neither is currently required by legislation. The AI Act's fundamental rights impact assessment will become mandatory from December 2027.
This is the position on 13 October 2026, insofar as we could check it against government sources and the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority. This article explains each instrument, what is required and what a public organisation arranges when staff start using AI chatbots. It is an explanation, not legal advice.
The Algorithm Register is the Dutch government's central register. Public organisations publish descriptions of their algorithms so citizens, journalists and supervisory authorities can see where and how they are used. The first version launched in December 2022. The Ministry of the Interior and Kingdom Relations (BZK) manages it.
On 13 October 2026, the register's dashboard listed 1,590 published descriptions, compared with 1,225 in November 2025. The register is therefore growing, but says itself that it is not yet complete.
The register uses a broad definition of an algorithm: a set of rules and instructions a computer follows. Not everything needs to be included. The register's frequently asked questions explain which algorithms you should at least register.
There may be reasons not to publish everything, for example in criminal investigations. The register then asks you to publish the part that can be made public.
A description follows the register's publication standard. It includes the algorithm's purpose, the organisation using it, data sources and assessments carried out beforehand, such as a DPIA or IAMA. The register says the standard's fields are not yet mandatory, so descriptions vary in completeness.
No, not under legislation. The page About the Algorithm Register says supplying information is not yet mandatory for public organisations, but that this obligation is coming. On its AI regulation page, the AP says public bodies can already voluntarily register their algorithmic systems.
How soon the obligation will arrive is uncertain. In a 2025 parliamentary letter (document 26643, no. 1394), the State Secretary for BZK said a statutory obligation for the Algorithm Register was not appropriate at that time. The letter chose another route: developing the Algorithm Framework into a framework an auditor can assess against, and requiring public organisations to account for their approach. The register's FAQ says the need for additional legislation is being examined. We found no newer decision on 13 October 2026. Check the parliamentary dossier before basing a timetable on this.
Not being legally mandatory does not mean being optional in practice. The same parliamentary letter says departments committed to registering their high-risk AI systems before the end of 2025, and several departments sent Parliament a timetable for other impactful algorithms. Progress is reported in the central government's annual operational management report. Those commitments do not apply directly to municipalities, provinces or water authorities. They decide for themselves whether and what to publish.
The AI Act has its own registration. Article 49 says public authorities intending to use an Annex III high-risk system register themselves and that use in the European database. For critical infrastructure, registration takes place nationally; for law enforcement, migration and border control, in a restricted section. Article 26 says a public body may not use a system not listed in the database.
This is a statutory obligation, separate from the Dutch register. The AP's page gives 2 August 2026 as the date when public bodies must register their use of high-risk systems in the European database. In summer 2026, the other requirements for high-risk systems were postponed to 2 December 2027. We could not verify from a source how these dates fit together in practice. Ask your supervisory authority or lawyer if you use such a system.
IAMA stands for Impact Assessment Mensenrechten en Algoritmes, a human rights and algorithms impact assessment. Utrecht University developed it in 2021 on behalf of BZK. It is not a form one person completes, but an instrument for discussion: a team works through the questions together and records its considerations.
On 16 February 2026, the ministry published an updated IAMA. The new version is shorter, has a separate explanatory document and has been aligned with Article 27 of the AI regulation. Related questions are marked. The explanatory document says IAMAs completed using the first version do not need revision.
The explanatory document recommends completing the IAMA as a team. It names, among others, a project manager, data scientist, lawyer (possibly a privacy officer or data protection officer), someone with domain knowledge and the commissioning party. It says a lawyer able to investigate fundamental rights is indispensable, and at least two participants should understand the technology. Who holds which responsibility in such a process is explored in our article about AI governance.
We found no statutory obligation to conduct an IAMA. There is political pressure, however. A research report presented to the Dutch House of Representatives in 2026 says Parliament passed a motion in 2022 asking the government to make IAMAs mandatory before algorithms are used to evaluate or make decisions about people. A 2023 motion followed, calling for all high-risk algorithms within central government to be included in the Algorithm Register and subjected to the IAMA. A motion is a request to the government, not legislation.
The explanatory document also makes a point that matters more in practice. If an application is not high risk, the obligation under Article 27 of the AI regulation does not apply, but working through an IAMA may still be sensible where there is a reasonable chance of affecting fundamental rights. An organisation can therefore incorporate it into its own process without a statutory obligation. Check your organisation's policy for its agreements.
Article 27 of the AI Act requires a fundamental rights impact assessment, or FRIA. The obligation applies to bodies governed by public law and private organisations providing public services before they use an Annex III high-risk system. Critical infrastructure is excluded. It also applies to those using AI to assess creditworthiness or determine risks and premiums for life and health insurance.
The assessment describes six things: the processes using the system, how long and how often, which groups are affected, their risks, the arrangements for human oversight and what you do when things go wrong. You notify the market surveillance authority of the outcome. In its announcement The FRIA for AI systems is coming, the AP says the obligation applies from December 2027 and recommends practising now.
The DPIA comes from Article 35 GDPR and examines the risks of personal data processing. The AP describes the difference as follows: a DPIA focuses on privacy risks, while a FRIA considers all fundamental rights more broadly. Since the 2026 amendment, Article 27 allows reference to a DPIA for elements already covered there. The IAMA follows this approach: if it becomes clear that a DPIA is needed, leave the IAMA, carry out the DPIA and bring its outcome back. How to prepare a DPIA for an AI application is covered in our article on the DPIA for AI tools.
| Instrument | What it is | Mandatory or not | For whom |
|---|---|---|---|
| Algorithm Register | Public description of an algorithm on the government website | Not under legislation; departments have made commitments to the Dutch House of Representatives | Dutch public organisations |
| European database for high-risk AI | Registration of the use of a high-risk system | Yes, under the AI Act | Public authorities using an Annex III system |
| IAMA | Questionnaire and team discussion about human rights implications | No statutory obligation found; motions and internal policy do exist | Public organisations |
| Fundamental rights impact assessment (FRIA) | Prior assessment, with notification to the supervisory authority | Yes, from 2 December 2027 | Public bodies, organisations providing public services and users of AI for credit and certain insurance |
| DPIA | Assessment of personal data processing risks | Yes, where processing is likely to result in a high risk | Every controller, public and private |
| Algorithm Framework | Overview of algorithm requirements and measures to address them | No, it is an aid | Public organisations |
As at 13 October 2026. The obligation column is a summary. The legislation and your organisation's own policy take precedence.
That depends on what you do with it. A chatbot helping a policy officer rewrite a note makes no decisions about citizens and is not a high-risk system. Under the register's criteria, it does not automatically have to be included. This changes when the output contributes to a decision about a person, for example a summary of an objection file used as a case officer's starting point. The direct-impact criterion then comes into view. If in doubt, publish: the register exists to provide explanations.
Regardless of any register, the simplest question remains the most important: what does an employee paste into the window? A social services file contains names, BSNs (Dutch citizen service numbers) and often health data. That does not belong in a chatbot on a personal account. What happens when you upload is covered on our page about AI chatbots and the GDPR. A register makes your actions visible. It does not remedy an arrangement that was wrong in the first place.
PrivaSearch makes documents searchable after personal data has been replaced with pseudonyms and a colleague has checked this. It searches and quotes; it does not assess people or make decisions. The page about the GDPR and the AI Act says this supports classification outside the high-risk categories, depending on intended use and working practices. You assess whether your use belongs in the Algorithm Register and whether an IAMA or fundamental rights impact assessment is necessary.
For documentation, your environment provides three starter documents based on your own configuration: an AI policy, a DPIA starter document and an entry for your record of processing activities. They are starter documents, not legal advice. PrivaSearch does not create an IAMA or an Algorithm Register description for you. The documents do provide the facts you need for those: which data, which measures and which retention period.
Three elements built into usage fit the questions an IAMA asks. Human review is mandatory. Answers refer to a document and page. Actions are logged. Processing takes place on European infrastructure; what this means is explained on the page about EU hosting. Pseudonymised data remains personal data for your organisation.
Read how the steps follow each other on How PrivaSearch works. To see it in action, request a demo.
As at 13 October 2026, publishing in the Algorithm Register is not required by legislation. The register itself says an obligation is coming. In a 2025 parliamentary letter, the State Secretary for BZK considered a statutory obligation inappropriate at that time. Departments did commit to the Dutch House of Representatives to register their high-risk AI systems. For municipalities, provinces and water authorities, publishing is their own choice.
IAMA stands for Impact Assessment Mensenrechten en Algoritmes, a human rights and algorithms impact assessment. It is an instrument through which a public organisation discusses beforehand, as a team, an algorithm's possible human rights implications and how to limit them. It has four parts: why, what, how and human rights. Utrecht University developed it in 2021 for the Ministry of BZK, and it was updated in February 2026.
A DPIA comes from the GDPR and assesses personal data processing risks. It is required where that processing is likely to result in a high risk. An IAMA looks more broadly at all human rights, including algorithms that process no personal data. The two complement each other: answers from one can be used in the other, and you often need both.
FRIA stands for fundamental rights impact assessment. It is an obligation under Article 27 of the AI Act for public bodies and organisations providing public services that will use an Annex III high-risk system, and for users of AI for credit assessment and certain insurance. The obligation applies from 2 December 2027. You notify the supervisory authority of the outcome.
No. The Algorithm Register is a Dutch initiative for transparency about all impactful government algorithms, including non-AI algorithms. The European database comes from the AI Act and concerns only high-risk AI systems. Public authorities using such a system must register that use there. They are two registrations with their own purpose and legal basis.
Not in every case. The register asks at least for high-risk AI systems and algorithms directly affecting people. A chatbot helping with writing or summarising usually does not fall within these categories. If the output contributes to a decision about a citizen, that changes. Publishing is always permitted, and explaining is the safest choice when in doubt.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
When you must conduct a DPIA for an AI chatbot or AI search feature, what it needs to contain and how to approach the assessment in seven steps.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →