AI governance for Dutch banks, insurers and financial institutions

The short answer

Dutch financial institutions have no AI rulebook of their own. DNB and the AFM supervise AI under the rules that already apply, which they describe as technology-neutral. What changes over 2026 and 2027 is the EU AI Act, which the draft Uitvoeringswet AI-verordening would have the AFM and DNB supervise for AI used by financial institutions.

What DNB and the AFM have said

On 9 April 2024 the two supervisors published a joint report, The impact of AI on the financial sector and supervision. Its main points still frame their approach.

• Use is established and growing. Institutions already use AI for fraud detection, anti-money laundering and counter-terrorist financing, cybercrime, creditworthiness assessment, identity verification and staff efficiency. Many were cautious about generative AI, with some starting to use it in support processes.
• The risks are known. Data quality, data protection, explainability, incorrect results, discrimination and exclusion, and dependence on a few large technology firms. Because these risks affect institutions and their customers, they sit within the AFM’s and DNB’s supervision.
• Existing rules apply in full. Institutions are expected to use AI responsibly, meet existing financial regulation and pay particular attention to the protection of fundamental rights.
• The AI Act adds a role. The report anticipated that the existing financial supervisors would also monitor the AI Act where AI is used for financial services, with coordination between AI supervisors given the risks to fundamental rights.

DNB’s SAFEST principles

In July 2019 DNB published General principles for the use of Artificial Intelligence in the financial sector as a discussion paper. Its six principles remain the most specific statement of what DNB means by responsible AI.

• Soundness. AI applications should be reliable and accurate, behave predictably and operate within the boundaries of applicable rules. DNB called this its primary concern from a prudential perspective, especially where many firms use similar AI solutions.
• Accountability. Firms are accountable for their AI, since applications may not work as intended and can cause damage to the firm, its customers and others.
• Fairness. Firms should be able to define their conception of fairness and show how they make sure their AI behaves accordingly, so that no group of customers is inadvertently disadvantaged.
• Ethics. Customers and other stakeholders should be able to trust that they are not mistreated or harmed because of the firm’s use of AI.
• Skills. From the work floor to the boardroom, people should understand the strengths and limitations of the AI-enabled systems they work with.
• Transparency. Firms should be able to explain how and why they use AI and, where reasonably appropriate, how the applications work.

DNB tied the principles to the existing requirement of controlled and sound business operations, applied in proportion to the scale, complexity and materiality of each application.

The AI Act for financial institutions

The AI Act’s prohibited practices and AI literacy duty have applied since February 2025, and its transparency duties for chatbots and generated content since 2 August 2026. For banks and insurers, the high-risk systems that matter most are in Annex III.

• Point 5(b). AI used to evaluate the creditworthiness of natural persons or establish their credit score, apart from fraud detection.
• Point 5(c). AI used for risk assessment and pricing in relation to natural persons in life and health insurance.

These duties apply from 2 December 2027. Deployers of these systems must carry out a fundamental rights impact assessment before use. The high-risk classification guide covers how to decide what is in scope. Systems outside the financial business, such as recruitment tools, are high-risk under other points of Annex III and may fall to a different Dutch supervisor.

Automated credit and insurance decisions also engage GDPR Article 22, supervised by the Autoriteit Persoonsgegevens. The Dutch exception in Article 40 of the GDPR Implementation Act does not cover decisions based on profiling, which most credit and pricing models are.

A working approach

1. Know what you run. Register every AI system and model, including generative AI tools staff use and AI inside vendor products, with the provider each depends on.
2. Classify credit and pricing models. Decide which systems fall under Annex III points 5(b) and 5(c), and plan their fundamental rights impact assessments.
3. Define fairness and test for it. SAFEST asks firms to state what fair means for each application and show the model meets it. The AI bias assessment guide sets out the method.
4. Manage third-party and model risk. Treat AI and model providers under your outsourcing and DORA third-party arrangements, given the supervisors’ concern about dependence on a few large firms. The vendor AI risk guide covers the steps.
5. Build skills and report upwards. Train staff and the board on the systems they use, and keep AI risk in front of the people accountable for it.

Aicura supports this work with its AI register, vendor management, risk, bias and impact assessments, oversight and monitoring. It assesses against the EU AI Act from the Essentials plan, and ISO/IEC 42001 and the NIST AI RMF from Pro. The decisions, and the dialogue with DNB, the AFM and the AP, stay with you.