AP launches TCA directorate for AI oversight

You must now document each AI system your organisation operates, record which supervisory body has competence over it, and establish what personal data and fundamental rights it touches. This obligation exists whether or not the Dutch Data Protection Authority's formal market surveillance powers have been formally established, because oversight pressure is mounting and the AP remains the supervisory authority for personal data processing by AI today.

The prompt is an analysis of 9 October 2026 of the Dutch Data Protection Authority's launch of its TCA directorate for AI oversight, which argues that the shift from preparatory coordination to a firmer organisational framework signals mounting oversight pressure before formal powers are definitively established. The Dutch Data Protection Authority announced the launch of the Supervision and Coordination of AI/Algorithms directorate (TCA), which continues coordinating AI oversight since 2023 and prepares market surveillance. In our assessment, this development means that directors, lawyers and security officers face a narrowing window to prepare documentation and governance structures before enforcement powers crystallise, and that the Dutch model remains multi-layered and still being built rather than a fully operational single-desk oversight.

What has actually changed in the Dutch oversight structure?

The AP has moved AI oversight from a coordinating directorate into a permanent, dedicated directorate. The TCA continues the coordinating oversight of AI and algorithms carried out since 2023, prepares AI market surveillance, and shapes the AI sandbox jointly with the Dutch Radiocommunications Agency (RDI). This represents a scaling up of capacity and organisational permanence, not a completed oversight structure. The AP remains the supervisory authority for personal data processing by algorithms and AI under existing law, which means enforcement risk already exists today for any AI system that touches personal data.

When will the AP actually have market surveillance powers?

The AP is the intended market surveillance authority under the European AI Regulation, but it has not yet been formally designated and does not yet have the associated enforcement powers. The definitive allocation of powers depends on adoption of the national AI Regulation Implementing Act and the relevant formal designations taking effect. Until that point, the AP's role is coordinating and preparatory. In our assessment, this gap between organisational readiness and formal authority creates a particular risk: organisations may assume they have time to prepare, when in fact the AP's existing powers over personal data processing by AI are already enforceable today.

What documentation must you establish now?

You should record evidence with which you can later demonstrate to a supervisory or coordinating body what each system does, who controls it, and which risks have been weighed. This is useful regardless of which supervisory authority ultimately becomes competent, because the AP takes on a coordinating role in the intended Dutch model and is proposed as market surveillance authority for certain oversight areas not yet assigned. The following controls should be demonstrable:

1. Record the model and its purpose — document which AI model each workflow uses, the lawful basis for the data it processes, and the business purpose it serves.
2. Map personal data and fundamental rights — identify which personal data the system touches and which fundamental rights are at stake before deployment.
3. Document human oversight and control — record who makes or reviews decisions the system informs, and how that human review is logged and escalated.
4. Establish incident and escalation logging — set up logging for AI system failures, unexpected outputs and escalation procedures now, so you are not left behind when the implementing act takes effect.
5. Assign an AI system owner — appoint a named individual responsible for recording, per AI system, which supervisory or coordinating role is relevant and maintaining the evidence file.

Which failure modes should your documentation address?

Your evidence file should address the following categories of risk and failure:

• Personal data leakage and memorisation — personal data reproduced or inferred from model outputs without lawful basis.
• Automated decisions without human intervention — decisions affecting individuals made without documented human review or appeal.
• Undocumented training data — inability to demonstrate the provenance and lawfulness of data used to train or fine-tune the model.
• Unweighed fundamental rights impacts — deployment of systems affecting fundamental rights without documented risk assessment or mitigation.
• Unlogged system changes — inability to demonstrate what version of a model was in use at a given time or what changes were made to it.

Should you participate in the AI sandbox?

The TCA shapes the AI sandbox jointly with the RDI. That sandbox may offer a route to test applications within a supervised oversight framework once its set-up and access have been established. Teams working on high-risk AI should now assess whether participating in that sandbox could accelerate their validation and documentation. The sandbox is not yet operational, but preparing to apply now means you will be ready when access opens.

Tooling can help you log system behaviour, track data lineage and version control, and generate audit trails. What tooling cannot do is weigh whether a particular use of personal data is lawful, whether human oversight is adequate for the decisions at stake, or whether the fundamental rights impacts are acceptable. Those judgements remain yours, and your documentation must show that you have made them deliberately and recorded your reasoning. The AP's emphasis on fundamental rights as the basis for oversight means that an evidence-focused approach makes that weighing demonstrable afterwards, and defensible if challenged.