The AI Act: the EU representative and the company behind your product
Under the EU law on artificial intelligence, the AI Act, providers from the United States, the United Kingdom, Israel, India or Asia must name a representative in the EU. Providers of general-purpose models have been bound by that duty since 2 August 2025, and providers of high-risk systems must comply from 2 December 2027 (systems listed in Annex III of the law) or 2 August 2028 (AI built into regulated products), dates set by an amendment in 2026. A single Dutch company can act as that representative, as your EU contracting entity and as your representative under the EU data protection rules (GDPR). We set up the company and work with AI compliance specialists on the documents.
Ask about your situationThe EU regulation on artificial intelligence, the AI Act, came into force on 1 August 2024, and on 27 July 2026 an amendment known as the Digital Omnibus on AI came into force and changed the dates for high-risk systems. Banned practices have been prohibited since 2 February 2025, the duties for general-purpose AI models have applied since 2 August 2025 and the transparency duties since 2 August 2026. High-risk systems listed in Annex III of the law must comply from 2 December 2027, and AI built into regulated products such as medical devices, toys and lifts from 2 August 2028.
A provider established outside the EU must appoint an authorised representative established in the EU before it places a high-risk system or a general-purpose model on the EU market. We set up the Dutch company that can take that role, and work with AI compliance specialists on the documentation.
Tell us what you make or sell, where your company is and what you plan in Europe. Our team looks at it and replies with the steps and the dates that apply to you.
Who does what
We set up and manage the Dutch company. Specialist partners do the licence and product work. We are your only contact, with one file for all the work.
Your company
- Own the model, the system and the training data
- Handle the risk management, the testing and the technical documentation
- Decide the countries, the customers and the pricing
- Sign the power of attorney and the representative mandate
The Dutch company
- Set up the Dutch company (a BV), by power of attorney, with the notary
- Registration with the Dutch Chamber of Commerce (KVK), tax number and VAT number
- Bank account, bookkeeping, VAT returns, annual accounts and corporate tax
- Payroll and the 30% ruling applications for staff you bring over
- Single point of contact for the compliance and legal partners
Licences and product rules
- Classification under the AI Act, to establish whether the system is high-risk and which annex applies
- The representative mandate, the technical documentation review and the EU database entry
- GDPR representative duties, data processing agreements, privacy documentation
- Contracts with EU customers under Dutch law, in English
- Conformity assessment and standards, where a notified body is required
The steps to the European market
What happens from your first question to the day your first product is on the European market.
- You describe your product, who uses it, where your customers are and whether it is a general-purpose model or a system in one of the high-risk areas, and we propose a suitable structure.
- The notary sets up the BV by power of attorney, with the parent company as shareholder, after which you receive the KVK number, the tax number and the VAT number while we prepare the bank application.
- Your Dutch company becomes your authorised representative under the AI Act and your representative under the GDPR, and the partner drafts both mandates.
- The compliance partner reviews your technical documentation against the law and the standards, and registers the system in the EU database where required.
- Your EU customers sign the terms and the data processing agreement with the Dutch company, which invoices them in euros.
- Your sales and support staff join the Dutch payroll, we keep the books and file the VAT returns, and you receive one monthly overview from one contact person.
The dates as of September 2026
| Date | What applies |
|---|---|
| 2 February 2025 | Banned AI practices, such as social scoring and manipulative systems, and the duty to train staff in AI literacy. That duty has been lighter since 27 July 2026 (new Article 4). |
| 2 August 2025 | Duties for providers of general-purpose AI models: documentation, copyright policy, training data summary. Providers outside the EU appoint an authorised representative. |
| 2 August 2026 | Transparency duties: telling people they talk to an AI, labelling deepfakes and AI-generated content. Systems already on the market have until 2 December 2026 for the technical marking of generated content. |
| 2 December 2026 | Two new banned practices added by the 2026 amendment: AI that creates non-consensual intimate images and AI that creates child sexual abuse material. |
| 2 December 2027 | High-risk systems listed in Annex III of the law: biometrics, critical infrastructure, recruitment and HR tools, credit scoring, education, essential services, law enforcement, migration and justice. Full obligations, including the authorised representative for providers outside the EU. |
| 2 August 2028 | High-risk AI built into products that already have the EU conformity mark (CE marking) under other laws, such as medical devices, toys, lifts and radio equipment. For machinery and vehicles, the AI rules apply through their own product laws. |
The amendment, Regulation (EU) 2026/1744, replaced the original dates for high-risk systems, 2 August 2026 for Annex III and 2 August 2027 for AI built into products, with fixed calendar dates, because the technical standards and the national supervisors were behind schedule. The new dates are binding law.
What the authorised representative does
Before it places a high-risk AI system on the EU market or puts it into service, a provider established outside the EU appoints an authorised representative established in the EU by written mandate. The representative checks that the EU declaration of conformity and the technical documentation exist, keeps them available to the authorities for ten years, cooperates with the authorities and registers the system in the EU database, and its name appears in the documentation. Providers of general-purpose AI models outside the EU have been under the same duty since 2 August 2025.
The role of representative is free of any licence requirement, so a service company, a law firm or a company in your own group can take it on. Importers and distributors in the EU have their own, lighter duties. An importer checks that the provider has a representative, that the conformity assessment was done and that the documentation exists (Article 23), while a distributor has lighter checks still (Article 24).
Tell us what you make or sell, where your company is and what you plan in Europe. Our team looks at it and replies with the steps and the dates that apply to you.
One Dutch company for the representative roles and your EU contracts
A software or AI company that sells to European customers needs an authorised representative under the AI Act, a representative under the General Data Protection Regulation (GDPR) and a contracting entity in the EU, and one company can provide all of them. Article 27 of the GDPR requires a company outside the EU that processes data of people in the EU to appoint a representative established in an EU country where those people are, and that representative can be the same Dutch company. European enterprise customers, hospitals, banks and public bodies also prefer a contract, an invoice and a data processing agreement from an EU company, under EU law and with a European VAT number.
Your own Dutch company signs the contracts, invoices in euros, employs your European sales and support staff, acts under the representative mandates and answers the supervisors. Your engineering team and a compliance specialist handle the AI Act compliance work, the risk management and the technical documentation, while your group keeps both the responsibility and the value.
The Netherlands as a base for an AI company
Amsterdam has one of the largest internet exchange points in the world, the Amsterdam Internet Exchange (AMS-IX), with clusters of data centres around it. The University of Amsterdam, Delft, Eindhoven and Utrecht supply engineers, and according to the Eurobarometer survey 90% of the population speaks English. In April 2026 the Dutch cabinet chose to have the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the national inspectorate for digital infrastructure (RDI) coordinate the supervision of the AI Act together, while sector supervisors check AI in their own fields; the Dutch law that arranges this has yet to enter into force.
A Dutch company pays 19% corporate tax on the first €200,000 of profit and 25.8% on the rest. Profit from software and research that the company develops itself can be taxed at 9% under the Dutch regime for income from innovation (innovation box), provided the company has a declaration for its research and development work from the Netherlands Enterprise Agency (S&O-verklaring from RVO); a patent of the parent company is excluded. Engineers you bring to the Netherlands can use the 30% ruling, which makes part of their salary tax-free, and dividends paid to a parent company in a treaty country are usually free of Dutch dividend tax. Our guides to setting up a subsidiary in Europe and the innovation box cover both subjects in more detail.
Based on Regulation (EU) 2024/1689 (AI Act) as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force 27 July 2026) and Regulation (EU) 2016/679 (GDPR), as applied in September 2026. Specialised partners prepare the compliance files, and we coordinate their work.
Common questions
Ask about your own situation
Tell us what you make or sell, where your company is and which countries you want to sell in. Our team replies with advice.
Related guides
More guides about selling in Europe.