Two practical compliance developments that Dutch professionals will feel directly: the government now offers a free digital tool for DPIAs and IAMAs, and the European Commission has officially designated ChatGPT as a very large online service under the Digital Services Act. The facts are below.
Dutch government launches DPIA/IAMA filling-in tool (beta)
As of 29 July 2026, invulhulpen.rijksapp.nl is publicly available, a beta web tool from the Ministry of the Interior (BZK) that lets organisations fill in a DPIA and IAMA step by step and export them as a PDF. The tool works entirely in the browser, requires no account for basic use, and also supports the newer FRIA (Fundamental Rights Impact Assessment) required for high-risk AI systems under the EU AI Act.
What is useful in everyday practice:
- Pre-scan: a short questionnaire determines whether you need a full DPIA or IAMA
- Flow-through: answers from the pre-scan automatically carry over into the full assessment
- Collaboration: after logging in, you can add colleagues to an ongoing assessment and save progress
- Open source: the source code is on GitHub (MinBZK/par-dpia-form) under the EUPL-1.2 licence
The tool is intended for both government organisations and private parties. Think of a law firm wanting to deploy an AI tool for contract analysis, or an HR department using AI for CV screening, these are exactly the situations where a DPIA is mandatory and an IAMA is strongly recommended. See also our page on AI safety and GDPR for an overview of what applies per model and provider.
ChatGPT, Reddit and Roblox: officially 'very large online services' under the DSA
In September 2026, the European Commission formally designated OpenAI's ChatGPT as a Very Large Online Platform (VLOP) under the Digital Services Act, alongside Reddit and Roblox. The threshold is 45 million monthly EU users. OpenAI must comply with additional DSA obligations by January 2027 at the latest, including:
- Transparency regarding algorithmic recommendations
- External audits of systemic risks
- Crisis protocols for rapidly escalating disinformation or misuse
- Annual risk assessment
For organisations that deploy ChatGPT or recommend it to users, the practical consequence is limited, the new obligations rest with OpenAI as provider. What is relevant: the VLOP status underlines that ChatGPT use now falls under the same transparency requirements as large social networks. Combined with the advertising rollout for free accounts (which uses contextual targeting based on conversation topic), a data processing agreement for paid business subscriptions is more important than ever.
Claude Fable 5.1: cache discount also felt by smaller teams
Earlier this month, Anthropic cut the cache-read price for Claude Fable 5.1 by 75%, to $0.25 per million tokens. That was two weeks ago, but the effect has only recently become visible in practice reports: teams that resend the same system prompt several times for document analysis or long-running agentic tasks are seeing their monthly bill fall by 25–45% without any code changes. For smaller Dutch agencies managing a token budget, this is a good moment to review your cache strategy.
The API list prices ($10/1M input, $50/1M output) are unchanged. Fable 5.1 is available via AWS Bedrock and Google Cloud Vertex AI with EU data residency, which makes the model usable for GDPR-defensible workloads that must not send data outside the EU.
What you can do now
| Action | Priority |
|---|---|
| Complete the DPIA/IAMA pre-scan via invulhulpen.rijksapp.nl | If you use AI with personal data |
| Replace free ChatGPT accounts for business use with a paid plan and a data processing agreement | High |
| Evaluate the Fable 5.1 cache strategy | If you consume more than 1B tokens per month |
Keep an eye on the AI safety page for the EU AI Act deadlines; the overview is updated as new enforcement steps become known.
Sources: Digitale Overheid – DPIA/IAMA invulhulpen (29 Jul 2026) · ICTRecht – Updates Sep 2026 · VentureBeat – Claude Fable 5.1 · GitHub – MinBZK/par-dpia-form
