The Dutch authority publishes a self-assessment for generative AI

The Dutch data protection authority has released a self-assessment tool on generative AI systems: a path that takes an organisation through whether it has appropriate governance measures in place, how it picks a GDPR-compliant system, how it puts that system into service and how it supervises its use.

Why such a tool is needed now

The practical problem of these months is not prohibition: it is that generative AI enters organisations through the back door. Not with a project, but with a checkbox inside a business application the supplier has updated, or a subscription taken out by one department without passing by anyone. By the time the data protection officer notices, the processing has been running for months.

A self-assessment does not solve that, but it makes it discussable: it gives the DPO a document to put on the table that does not look like a personal objection, and gives the controller a sequence of questions to answer in writing.

The four decisions that have to be written down

The questions concentrate on four moments: whether there is any governance of the phenomenon before adopting a tool at all; on what criteria the supplier is chosen; on what conditions the system goes live; and who supervises its use over time. They are the same four points an inspection asks about — and the same four for which, usually, not a line has been written.

To be clear: the tool belongs to the Dutch authority and does not bind the others. It creates no presumption of compliance and does not replace the Article 35 impact assessment where one is due. But the questions are not Dutch: they are the ones a DPO would ask in Italy, in Portugal or in Norway.

What to actually do with it

The useful move is to treat it as an inventory, not an exam. A round of emails to clients with three questions — which generative AI tools are live, who authorised them, what data goes into them — almost always produces a surprise, and that surprise is the real starting point.

And keep the order right: first establish whether the processing is lawful and whether it needs an impact assessment, then choose the supplier. The reverse — system chosen, then an assessment written to justify it — is the fastest way to turn a legal duty into a fiction.