Enterprise Software in the Netherlands: GDPR and the EU AI Act

Scope of this guide

Organizations in the Netherlands buy software under EU rules. This guide names the Dutch data protection regulator and sets out the EU AI Act's published application dates, so you can ask suppliers the right questions. Every rule quoted below was checked against the regulator's own page on 2 October 2026; check the current version before you rely on it. This is general information, not legal advice.

Your regulator

The Autoriteit Persoonsgegevens is the Dutch data protection authority and the Netherlands' member of the European Data Protection Board. It is the first place to look for guidance on how data protection rules apply to software you buy.

The EU AI Act timeline

One published summary of the AI Act's timeline (last updated 31 August 2026, and not the official EU text) lists these dates:

• 1 August 2024: the AI Act entered into force.
• 2 February 2025: prohibitions on certain AI systems and AI literacy requirements began to apply.
• 2 August 2025: obligations for general-purpose AI models began to apply.
• 2 December 2027: requirements for high-risk AI systems listed in Annex III apply.
• 2 August 2028: high-risk requirements extend to systems covered by Annex I.

Check the official text and the Dutch authorities' guidance before relying on any date.

Questions to ask a software supplier

• Does the product use AI, and if so, which of its functions might fall under the AI Act's categories?
• Where is personal data stored and processed, and by which sub-processors?
• What happens if the supplier is outside the EU: which transfer arrangement covers it?
• How will the supplier tell you about regulatory changes that affect the product?
• Who is responsible for documentation if you are asked to demonstrate compliance?

Where Zunkiree Labs fits

Zunkiree Labs builds custom AI systems (including RAG pipelines, LLM integration and intelligent automation), data systems, custom software, and web and mobile applications, and is based in Nepal. The full list is on the services page. Because Zunkiree Labs is based outside the EU, a Dutch customer would need to settle how personal data transfers outside the EU are covered before sharing any personal data. Orca is Zunkiree Labs' intelligence and orchestration layer: it sits above the CRM, email and marketing tools an organization already uses and coordinates agent workflows across them, rather than replacing those tools.

Sources

• European Data Protection Board: members
• AI Act implementation timeline (page updated 31 August 2026; not the official EU text)