If your business is also active outside the Netherlands, or uses software or equipment developed by a supplier in another EU country, here is the shortest reassurance: the AI Regulation is a regulation and not a directive. This means that the text applies directly in all EU member states without each country having to first transpose the rules into its own legislation. The obligations, definitions and risk categories are therefore the same starting point everywhere in the EU.
What can differ by country is not in the regulation itself but in its implementation. Each member state appoints its own supervisory authorities, determines how complaints are handled and implements the penalty framework that the regulation prescribes in its own way within the limits set by the regulation. For a business operating in multiple countries, this is the point to pay attention to: not the content of the rules, but the way they are locally monitored and enforced.
What is the same throughout the EU
The classification into risk categories, the obligations associated with them for providers and users of AI systems, and the definitions of concepts such as 'provider' and 'user responsibility' are laid down in the regulation itself and apply to each EU country in the same way. An AI system that is classified as high-risk in the Netherlands falls under the same category in Germany, France or Poland. This is precisely the purpose of a regulation: one regulatory framework for the entire internal market, so that businesses do not have to work out anew for each country under which category their system falls.
What can differ by country
The first place where countries diverge is supervision. Each member state appoints its own market supervisor or supervisors for the AI Regulation, and in some countries this task is shared among multiple authorities at the same time, depending on the sector. For the Netherlands, the picture is still evolving; which supervisory authority gets which part of the supervision is determined by the national government and is not something already laid down in the regulation itself.
A second difference lies in language. Information that must be provided to users or consumers about an AI system must be comprehensible to the person using it. In practice, this means that documentation, instructions for use or notifications about AI use often must be provided in the language of the country where the system is deployed. A business using the same software in multiple countries is therefore well advised to check whether the supplier actually provides those translations.
A third difference lies in the way penalties are determined. The regulation provides ranges for fines, but the precise implementation and the manner of enforcement can differ from country to country, just as it already does with the GDPR. Supervisory authorities in different countries may assess the same violation in a different way, although there is still little practical experience on this at present.
What this means for a business with offices in multiple countries
For an SME that, for example, carries out installation work in the Netherlands and Belgium, or has staff in multiple countries, the practical consequence is mainly this: the question of whether an AI system falls under the regulation and in which risk category it belongs only needs to be answered once. The question of who you need to contact if something goes wrong, and in which language your documentation needs to be ready, does differ by country where you are active.
It is therefore useful to keep these two questions separate. The substantive assessment of an AI system you can have tested in a few questions, regardless of which EU country you are active in. The question of which supervisory authority is competent in a specific country and how it handles this concretely remains a matter for inquiry with that supervisory authority or a legal advisor in that country; this is not a question that can be answered in general information.
For companies that, in addition to the AI Regulation, also have to deal with the digital product passport, there is a similar distinction between what is the same everywhere and what varies by country. You can read more about this in the knowledge base by topic, where country-specific points of attention are indicated separately.
Because the national implementation of supervision is still very much in development, it is advisable to periodically check whether anything has changed in a country where you are active. You can read about how we maintain that information and where the data comes from on the page about our working method.
Would you like to know where your company currently stands in relation to the AI Regulation, regardless of which EU countries you are active in? Take the free quick-scan or browse through the topics in frequently asked questions to see which question comes closest to your situation.