While the ink on the AI Act transparency obligation is still fresh, Dutch organisations are already facing their next compliance date: on 15 August the Cybersecurity Act comes into force. At the same time, the sovereign language model GPT-NL is scaling up from five to ten pilots. Two developments that converge for professionals who want to deploy AI responsibly.
Cybersecurity Act: AI falls squarely within scope
On 15 August 2026, the Dutch implementation of the European NIS2 Directive takes effect. The Cybersecurity Act affects well over 8,000 organisations across eighteen sectors, including energy, drinking water, healthcare, government and transport. The core of the law consists of four obligations:
- Registration in the NCSC's entity register.
- Duty of care: demonstrable measures to manage risks in network and information systems.
- Reporting duty: report significant incidents to the CSIRT and the competent authority within 24 hours.
- Management accountability: boards are ultimately responsible and must demonstrably have sufficient knowledge.
The direct link with AI: every AI system running on your network or information systems falls under the duty of care. That means you need to treat access control, logging and incident detection for AI applications just as seriously as for any other business-critical system. Organisations that have already drawn up their AI Act inventory can now extend it with the requirements of the Cybersecurity Act. Two birds with one stone.
Sectors already in the spotlight: healthcare, logistics and government/customer service. For these sectors, both the high-risk AI category (though only enforceable later) and the Cybersecurity Act apply from 15 August.
GPT-NL expands pilots: 20 billion tokens of news data added
Elsewhere in the AI landscape, GPT-NL, the sovereign Dutch language model from TNO, SURF and the Netherlands Forensic Institute, is approaching a new milestone. The model went live with five organisations in February 2026; the next five pilots will follow shortly, according to tech-insider.org.
Notably, the training data expansion: ANP and affiliated Dutch publishers made more than 20 billion tokens of licensed news texts available. This doubles the training dataset, and GPT-NL is the first major AI initiative to have concluded upfront licensing agreements with all major publishers within a single language market.
For professionals, this matters for two reasons:
- Sovereignty: GPT-NL is trained and hosted on Dutch infrastructure. That reduces the transfer risks that arise with models from outside the EU, an advantage that our security page also highlights for other models.
- Language accuracy: a model trained on Dutch sources is in principle better for legal, medical and journalistic applications in Dutch than an English-language model fed on translations.
Broad commercial availability is not yet here. The first pilot partners are government bodies, media companies and research institutions. The consortium's plan provides for full publication of training data and model weights via Hugging Face.
Combine your compliance agenda
The two deadlines overlap in one piece of advice: create now an AI system inventory that serves both the AI Act (which systems communicate with users?) and the Cybersecurity Act (which systems run on critical network and information infrastructure?). Whoever makes that combination has covered most of the urgent compliance pressure for this year.
For a model-by-model comparison on GDPR criteria, see the safety page. You'll find sector-specific professional tools under /voor/, broken down by sector.
Sources: Dutch government – Cybersecurity Act · NCSC – Cybersecurity Act · Tech insider – GPT-NL · CFO.nl – AI Act