Cybersecurity Policy Report, Dutch DPA Calls for Improvements in AI and Algorithm Registration, (Jul 14, 2025)

By Tony Foley

Governments and organizations have failed to make adequate progress in registering the algorithms and artificial intelligence systems they use, according to the Dutch data protection authority, Autoriteit Persoonsgegevens (AP).

In a Friday news release, AP said a complete algorithm register formed the basis for transparency, protection of fundamental rights, explainability, and verifiability in the use of these systems. Accordingly, in its role as coordinating supervisor of algorithms and AI, AP has called for algorithm registration to be made mandatory for government organizations and encourages other branches and sectors to work more intensively on setting up algorithm registers. To assist in this endeavor, the agency has published Getting started with algorithm registration: tools for organizations, a document containing eight specific guidelines related to the establishment of a register.

AP noted that 1,000 algorithms had been included in the Dutch government’s register, with the municipality of Amsterdam and the Customs Administration leading the way. However, most government organizations remain missing, with more than half of municipalities and three-quarters of independent administrative bodies failing to submit any registrations. In addition, most algorithmic registrations lack a fundamental rights assessment, with only 5% having conducted one.

In a variety of nongovernment sectors like housing, transportation, health care, education, and financial services, AP said there was little insight into algorithm registration, leading to a lack of clarity about where and how such organizations use algorithms. AP stressed that, as the use of algorithms and AI increases, the risk of discrimination, violations of privacy, and cybersecurity concerns also increase. Registering algorithms limits these risks, providing active insight and enabling both internal and external control.

When registering, AP said it was important to describe not only the purpose of the system but elements like the training data used, the operation of the algorithm, controls used, and the persons responsible for such controls. The agency concluded by noting that the purposes of algorithm registers differ from that of the European Union’s database for high-risk AI systems required by the EU AI Act and that both need to be maintained, given that not all impactful algorithms qualify as high-risk AI systems.

News: InternationalLegislation AINews DataPrivacy DataSecurity