Over AI, GDPR and NIS2: What in-house counsel need to know

IN ENGLISH

Artificial intelligence is increasingly becoming part of day-to-day business operations, bringing new legal and contractual considerations. At the same time, the implementation of NIS2 through the Dutch Cybersecurity Act introduces new obligations relating to governance, risk management and incident reporting.

During this event, we will discuss these developments through two practical sessions.

Session 1:
AI Procurement? Then you contract twice: the intersection of the AI Act and GDPR in commercial contracts

The EU AI Act and the GDPR increasingly overlap when organisations procure, deploy and contract for AI systems. Standard data processing agreements are often no longer sufficient.

During this session, we will discuss:

• How the EU AI Act and GDPR interact in practice
• How to identify and allocate roles and responsibilities under both frameworks
• Which AI-specific provisions should be included in supplier contracts and data processing agreements
• How to address risks such as bias, hallucinations, automated decision-making, transparency and human oversight
• What liability, audit, subcontracting and exit provisions should look like in practice
• How case studies, model clauses and procurement red flags can help translate regulatory requirements into workable contracts

Session 2:
The Dutch Cybersecurity Act is here: Is your organisation ready?

The implementation of NIS2 through the Dutch Cybersecurity Act imposes far-reaching obligations on organisations and their management.

During this session, we will explore:

• Which organisations fall within scope
• What the new governance obligations mean in practice
• Key risk management and incident reporting requirements
• The implications of increased regulatory scrutiny
• How boards and legal teams can prepare for the new framework

Speakers:
- Judith Vieberink (Eversheds Sutherland)
- Emile Leffring (Eversheds Sutherland)
- Robbert Santifort (Eversheds Sutherland)