The AI Act: the EU representative and the company behind your product
The European AI law asks providers from the United States, the United Kingdom, Israel, India or Asia for a named representative in the EU. For general-purpose models that duty applies now. For high-risk systems it applies from 2 December 2027, after the 2026 amendment. A Dutch company can be that representative, your EU contracting entity and your data protection representative at the same time.
Ask about your situationThe EU regulation on artificial intelligence, the AI Act, came into force on 1 August 2024. On 27 July 2026 the amendment known as the Digital Omnibus on AI came into force and moved the dates for high-risk systems. The rules now apply in steps: banned practices since 2 February 2025, duties for general-purpose AI models since 2 August 2025, transparency duties since 2 August 2026, high-risk systems listed in the law from 2 December 2027, and AI built into regulated products such as machines and medical devices from 2 August 2028. A provider established outside the EU must appoint an authorised representative established in the EU before it places a high-risk system or a general-purpose model on the EU market. Holdwise sets up the Dutch company that can take that role and works with AI compliance specialists for the documentation.
On this page: the dates as they stand in September 2026, what the representative does, why the same company is useful for contracts and data protection, and the steps to a European base.
The dates, as they stand in September 2026
| Date | What applies |
|---|---|
| 2 February 2025 | Banned AI practices, such as social scoring and manipulative systems, and the duty to train staff in AI literacy. |
| 2 August 2025 | Duties for providers of general-purpose AI models: documentation, copyright policy, training data summary. Providers outside the EU appoint an authorised representative. |
| 2 August 2026 | Transparency duties: telling people they talk to an AI, labelling deepfakes and AI-generated content. Systems already on the market have until 2 December 2026 for the technical marking of generated content. |
| 2 December 2026 | Two new banned practices added by the 2026 amendment: AI that creates non-consensual intimate images and AI that creates child sexual abuse material. |
| 2 December 2027 | High-risk systems listed in Annex III of the law: recruitment and HR tools, credit scoring, education, essential services, law enforcement, migration and justice. Full obligations, including the authorised representative for providers outside the EU. |
| 2 August 2028 | High-risk AI built into products that already have CE marking under other laws: machinery, medical devices, vehicles, toys, lifts. |
The amendment is Regulation (EU) 2026/1744. It replaced the original date of 2 August 2026 for high-risk systems with fixed calendar dates, because the technical standards and the national supervisors were behind schedule. The dates above are binding law.
What the authorised representative does
A provider established outside the EU appoints, by written mandate, an authorised representative established in the EU before it places a high-risk AI system on the EU market or puts it into service. The representative checks that the EU declaration of conformity and the technical documentation exist, keeps them for the authorities for ten years, cooperates with the authorities, and registers the system in the EU database. Its name appears in the documentation. The same duty applies to providers of general-purpose AI models outside the EU, since 2 August 2025.
The representative is a role, not a licence. It can be a service company, a law firm or a company in your own group. Importers and distributors in the EU have their own, lighter duties: they check that the provider has a representative, that the conformity assessment was done and that the documentation exists.
Why one Dutch company covers three duties
A software or AI company that sells to European customers needs three things in the EU that fit in one company. First, the authorised representative under the AI Act. Second, a representative under the General Data Protection Regulation (GDPR): a company outside the EU that processes data of people in the EU must appoint one under Article 27 of that regulation, and it can be the same Dutch company. Third, a contracting entity: European enterprise customers, hospitals, banks and public bodies prefer a contract, an invoice and a data processing agreement with an EU company, under EU law, with a European VAT number.
Your own Dutch company does all three. It signs the contracts, invoices in euros, employs your European sales and support staff, holds the representative mandates and answers the supervisors. The AI Act compliance work, the risk management and the technical documentation stay with your engineering team and a compliance specialist. The responsibility and the value are in your group.
The Netherlands as a base for an AI company
Amsterdam has the AMS-IX internet exchange, one of the largest in the world, and the data centre clusters around it. The University of Amsterdam, Delft, Eindhoven and Utrecht supply engineers, and 95% of the population speaks English. The Dutch supervision of the AI Act is led by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) together with the sector supervisors and the digital infrastructure inspectorate.
On the tax side, a Dutch company pays 19% corporate tax on the first €200,000 of profit and 25.8% above that. Profit from your own software patents and qualifying research can fall in the innovation box at 9%. Engineers you bring to the Netherlands can use the 30% ruling, which makes part of their salary tax free. Dividends to a parent company in a treaty country usually go out without Dutch dividend tax. Read more on setting up a subsidiary in Europe and the innovation box.
Based on Regulation (EU) 2024/1689 (AI Act) as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force 27 July 2026) and Regulation (EU) 2016/679 (GDPR), as applied in September 2026. Compliance files are prepared by specialised partners; Holdwise coordinates.
Who does what
Holdwise sets up and runs the Dutch company and stays your single point of contact. Specialist partners do the licence and product work. You keep one contact, one file and one invoice.
Your company
- Own the model, the system and the training data
- Run the risk management, the testing and the technical documentation
- Decide the countries, the customers and the pricing
- Sign the power of attorney and the representative mandate
The Dutch base
- Sets up the Dutch company (a BV), by power of attorney, with the notary
- Registered office, KVK number, tax number and VAT number
- Bank account, bookkeeping, VAT returns, annual accounts and corporate tax
- Payroll and the 30% ruling applications for staff you bring over
- Single point of contact for the compliance and legal partners
Licences and product rules
- AI Act classification: is the system high-risk, and which annex applies
- The representative mandate, the technical documentation review and the EU database entry
- GDPR representative duties, data processing agreements, privacy documentation
- Contracts with EU customers under Dutch law, in English
- Conformity assessment and standards, where a notified body is required
The route, step by step
What happens from your first question to the day your first product is on the European market.
- One question. You tell us what the product does, who uses it, whether it is a general-purpose model or a system in one of the high-risk areas, and where your customers are. We answer in writing with the structure that fits and one written proposal.
- The Dutch company. The notary sets up the BV by power of attorney with the parent as shareholder. You receive the KVK number, the tax number and the VAT number. The bank file starts on day one.
- The roles. Your Dutch company becomes your authorised representative under the AI Act and your representative under the GDPR. The partner drafts both mandates.
- The documentation. The compliance partner reviews your technical documentation against the law and the standards, and registers the system in the EU database where required.
- The contracts. Your EU customers sign with the Dutch company: terms, data processing agreement, invoicing in euros.
- Operations. Sales and support staff on Dutch payroll, bookkeeping and VAT done, one monthly overview, one point of contact.
Related guides
The other parts of the route to Europe, on the same site.
Common questions
Ask about your own situation
Tell us what you make or sell, where your company is and which countries you want to sell in. You get a written answer. Where a Dutch company fits, we write down what it would look like and what it costs.
Ask a question