Amsterdam Worked from Barcelona Built for AP scrutiny of automated decisions Same hour as us

Amsterdam AI studio.
Fintech and freight.

Dutch clients ask about explainability first and capability second, which is the opposite of most markets and, in our experience, the better order. The Autoriteit Persoonsgegevens has been unusually forward on algorithmic supervision, and the country has a recent and painful memory of automated decisions going wrong at scale. It shows in the questions we get asked in the first meeting.

Last reviewed 5 September 2026 · Engineering guidance, not legal advice.

WHAT IS ACTUALLY DIFFERENT HERE

A regulator that supervises algorithms, not only data

The Autoriteit Persoonsgegevens has taken on a coordinating role on algorithmic oversight in the Netherlands and publishes periodic reporting on algorithmic risk. That is a meaningfully different posture from a data protection authority that looks only at lawful basis and retention. The questions that follow are about how a system behaves: what it decides, on what inputs, how often it is wrong, in which direction it is wrong, and who noticed. Those are answerable, but only by a system built to answer them.

The automated decision question arrives early

In the Netherlands, a design that produces decisions about people gets scrutinised on that basis long before it gets scrutinised on accuracy. The GDPR's limits on solely automated decision-making with legal or similarly significant effects are the legal frame; the engineering consequence is that where a person is meant to review, that review has to be real — with the reasoning, the evidence and enough time to disagree — rather than a button that says approve on a queue of four hundred. We design the review surface as part of the system, because a nominal human in the loop is the failure mode everyone recognises here.

In-country compute exists, with an asterisk

Amsterdam sits beside one of the world's largest internet exchanges, and at the time of writing Microsoft and Google both operate regions physically in the Netherlands while the nearest AWS regions are in Ireland and Frankfurt. If Dutch residency is a genuine requirement rather than a preference, that difference decides your provider before it decides your architecture. Region footprints change; confirm against the provider's current documentation rather than against this page.

Consent is load-bearing for anything personalised

Adtech, media and commerce clients here run into the same wall: the interesting personalisation depends on data whose lawful basis is consent, and consent is refusable, revocable and audited. That is not a reason to abandon the feature. It is a reason to design it so it degrades honestly for the substantial share of users who decline, instead of silently depending on data you are not entitled to.

THE WORK THAT COMES OUT OF THIS CITY

Amsterdam's four big clusters send us four fairly different problems, though they converge on the same requirement to explain themselves.

Payments and fintech dominates. Transaction monitoring, sanctions screening and fraud detection all share an awkward property: the system produces enormous numbers of alerts, almost all of which are wrong, and each false positive is a decision about a real person whose money is not moving. Reducing the alert volume is easy and reducing it defensibly is not, because the burden is to show why a case was closed as well as why it was raised. That is the work described under fraud and AML, and the instrumentation it needs under observability.

Logistics around Schiphol brings air freight documentation, customs and handling data, with an emphasis on speed that port work does not have. The document work is similar in kind to a sea freight pipeline and different in tempo; the pattern is the same one described in our logistics pipeline.

Media and adtech arrive with personalisation, content operations and measurement, and with a lawful-basis constraint sitting under all three.

Agrifood and trading businesses bring forecasting against perishable inventory, where the cost of being wrong is asymmetric and rarely modelled as such.

Across all four, the AI Act classification question comes up on its own, usually from the client rather than from us. It is covered under the EU AI Act.

HOW AN AMSTERDAM PROJECT ACTUALLY RUNS

Discovery in person

Barcelona to Amsterdam is a direct flight of a couple of hours. We come for the first workshop, and we find Dutch discovery sessions unusually efficient — people say what they think the problem is, and say so when they think we are wrong. That saves a fortnight.

Then remote, with no offset at all

Same timezone, whole working day shared. No morning-only overlap window, no answer arriving after you have gone home.

And back for handover

In person, with the documentation your privacy officer will want to read written alongside the code rather than after it. The system then runs in your own accounts.

QUESTIONS

QUESTIONS — 5

No. We have one office and it is in Barcelona. We travel to Amsterdam for discovery, for handover and for anything that needs a room. We are a small senior team and we would rather be plain about that than dress up a virtual address.

By making the human review substantive and recording it. In practice that means the reviewer sees the evidence and the reasoning rather than a score, has the authority and the time to disagree, and their disagreements are visible in the data afterwards. If nobody ever overrides the system, that is itself the finding. We build the review interface and the audit record as part of the system; whether it satisfies your obligations is your privacy officer's call, not ours.

Often, though it depends on your provider. At the time of writing there are hyperscale regions physically in the Netherlands from some providers and not others, and open-weight models can be self-hosted wherever your infrastructure is. If Dutch residency is a hard requirement, tell us in the first conversation, because it constrains the platform choice more than it constrains the design.

Both, and the second is usually where the effort goes. Anyone can produce a score. Producing a system that can say which inputs drove a particular outcome, cite the record it relied on, and reproduce the same answer six months later on request is a different piece of engineering, and it is the part that survives contact with a supervisor.

The same ranges as anywhere else, published on the pricing page in euros and exclusive of VAT. We do not price by postcode. As an EU supplier invoicing a Dutch business the VAT position is normally straightforward; your finance team will know the mechanics better than we do.

Keep reading

30-minute technical call · no deck