MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
What does legally regulate AI usage entail? It is the body of agreements and documents by which a company brings the use of artificial intelligence into compliance with applicable legislation — specifically the AI Regulation (AI Act), the GDPR, liability law, and intellectual property law. Therefore, it is not about a single code of conduct for employees, but about the broader legal framework at the enterprise level: which AI systems are deployed, which risk class they fall into, who is liable if things go wrong, and who owns the output.
The short answer
- What: the legal embedding of AI use within the enterprise, based on the AI Act, GDPR, liability, and IP law.
- Core: risk classification of each AI system according to the AI Regulation (prohibited, high, limited, minimal risk).
- Why: the AI Act has been in effect since 2024 and carries fines of up to €35 million or 7% of global turnover.
- Scope: applies to providers and users (deployers) of AI systems, including SMEs.
- Form: an AI register, processor agreements, liability clauses, and agreements regarding ownership of output.
What exactly is the legal regulation of AI usage?
Legally regulating the use of AI means that, as a company, you systematically map out which AI systems you use or offer, and subsequently assess them against applicable law. The AI Regulation (Regulation (EU) 2024/1689) forms the backbone of this process, but does not stand alone. The GDPR, contract law, liability law, and copyright law play an equally important role.
Unlike an internal code of conduct for staff, this concerns the legal position of the company as a whole: towards regulators, suppliers, and customers. Anyone who deploys an AI chatbot for customer contact or trains a model on customer data assumes obligations that extend beyond a house rule.
The AI Act and risk classification
The AI Regulation classifies AI systems into four risk classes. The class determines which obligations apply to you:
- Unacceptable risk: prohibited systems, such as social scoring by governments or manipulative AI that exploits vulnerabilities. These prohibitions have been in effect since February 2025.
- High risk: AI in, for example, recruitment and selection, credit assessment, or medical applications. Strict requirements for risk management, data quality, documentation, and human oversight.
- Limited risk: chatbots and content-generating systems. Primarily a transparency obligation — the user must know that they are dealing with AI.
- Minimal risk: most everyday applications, such as spam filters. No specific obligations.
Most SMEs fall into the limited or minimal risk category. Nevertheless, the classification itself is a legal exercise: an incorrect assessment can mean missing high-risk obligations.
Liability in AI
Who is liable if an AI system causes damage? Under Dutch law, the company deploying the system remains, in principle, responsible for the consequences. An AI tool that generates incorrect advice on which a customer relies does not release you from your obligations under the agreement.
Therefore, in your contracts, you specify who bears which risk: the supplier of the AI system, your company, or the end customer. Consider limitations of liability towards customers and recourse agreements towards your supplier. The announced adjustment to product liability law at the EU level makes this even more important.
Intellectual property on AI output
Whose text, image, or code is it that an AI system produces? Under Dutch law, copyright arises only for work with human creative input. Output generated purely by AI falls outside of this in principle — it is therefore not protected by copyright. This has two sides:
- You may not be able to exclusively claim output that you have generated yourself against third parties.
- Training models on someone else's protected work can actually lead to infringement.
Add to this the fact that the terms of use of AI vendors often contain their own provisions regarding ownership and usage rights of output. Anyone who deploys AI on a structural basis must legally review these terms and, if necessary, make additional agreements.
GDPR and data protection
As soon as an AI system processes personal data, the GDPR applies in full. Practical points to consider:
- Basis: on what legal basis do you process data through AI?
- Transfer: many AI suppliers are located outside the EU — regulate transfer safeguards.
- Data Processing Agreement: enter into a data processing agreement with your AI supplier.
- Automated decision-making: Article 22 of the GDPR sets limits on decisions without human intervention.
- DPIA: a Data Protection Impact Assessment is mandatory for high-risk processing.
A brief example: an SME agency feeds applicants' CVs into an AI tool to make a pre-selection. This touches upon both the GDPR (special categories of personal data, automated decision-making) and potentially the high-risk rules of the AI Act. Without legal embedding, such an agency faces a real risk.
Honest recommendation
For most SMEs, the legal structuring of AI begins with an inventory: which systems do you use and which risk class do they fall into? You can often conduct this initial inventory yourself, and for minimal-risk applications (such as a simple spam filter), you do not need a lawyer. You also do not need a lawyer to simply read standard supplier terms and conditions.
Do involve a lawyer as soon as you deploy AI that processes personal data, makes decisions about people, or when you commercially exploit the output. In such cases, liability, GDPR, and IP come into play simultaneously, and a misjudgment can be costly. To learn more about drafting and outsourcing this: draft legal regulations for AI usage and have legal regulations for AI usage drafted. For the complete package: legal regulations for AI usage.
Frequently Asked Questions
Embedding the use of AI within the enterprise under applicable law: the AI Regulation (AI Act), the GDPR, liability law, and intellectual property law. The core is the risk classification of each AI system and the establishment of liability, data protection, and ownership of output.
The AI Regulation (Regulation (EU) 2024/1689) is the European law that classifies AI systems into four risk classes: unacceptable, high, limited, and minimal risk. Different obligations apply to each class. Fines can amount to up to €35 million or 7% of global annual turnover.
Yes. The AI Regulation applies to both providers and users (deployers) of AI systems, regardless of size. Most SME applications fall under limited or minimal risk, but as soon as you use AI for recruitment, for example, it quickly falls into a higher risk category.
Under Dutch law, the undertaking deploying the system remains, in principle, responsible for the consequences. Through contracts, the risk is distributed between the supplier, the undertaking, and the end customer. The adaptation of product liability law at the EU level reinforces this importance.
Purely AI-generated output usually does not carry copyright under Dutch law because human creative input is lacking. Consequently, you cannot claim exclusive rights to that output. Additionally, the supplier's terms of use often determine who holds which usage rights.
As soon as AI processes personal data, the GDPR applies. This requires a legal basis, a data processing agreement with the supplier, safeguards for transfers outside the EU, and attention to automated decision-making (Article 22). A DPIA is mandatory in high-risk situations.
Yes. A usage policy focuses on rules of conduct for employees. Legally regulating AI usage concerns the position of the entire enterprise: risk classification under the AI Act, liability, GDPR, and ownership of output towards regulators, suppliers, and customers.
