Dutch financial supervision splits between De Nederlandsche Bank, for soundness and integrity, and the AFM, for conduct and fair treatment of customers. Both expect firms using AI to have people who understand it, and DNB has said so explicitly in its principles for AI. Staff overseeing agents in the Netherlands need skills they can demonstrate.
What do DNB and the AFM expect?
De Nederlandsche Bank supervises banks, insurers, pension funds and payment institutions on prudential soundness and on integrity, including anti-money laundering. It has published principles for the responsible use of AI in financial services. In substance they cover soundness, accountability, fairness, ethics, transparency and skills. The skills principle is the one that matters here: people at every level, from the board to the operational teams, should understand the AI they use well enough to manage its risks.
The AFM supervises conduct: how firms treat customers, sell products and give advice. Its focus is whether the customer's interest is served and whether outcomes are fair and explainable. When an agent drafts advice, assesses a customer or handles a complaint, the AFM will want to know who checked it and whether that person could tell a good outcome from a bad one.
The EU layer applies across both. The EU AI Act requires AI literacy under Article 4 and, for high-risk uses such as credit scoring of individuals and life and health insurance pricing, human oversight under Article 14 and deployer duties under Article 26. DORA covers ICT risk management, incidents, testing, third-party risk and training. The GDPR covers the data.
Who does it reach?
Every financial firm supervised in the Netherlands: banks, insurers, pension funds, payment and e-money institutions, investment firms and financial service providers that advise or sell. Significant banks are directly supervised through ECB banking supervision, with DNB taking part. Pension funds deserve a mention: DNB supervises them directly, and an agent preparing member communications or processing value transfers is as much in scope as one in a bank.
Within firms, the people who need oversight skills:
- Board members, whom DNB expects to understand AI well enough to set direction and challenge;
- Reviewers who approve or decline held actions;
- Advisers who send agent-drafted recommendations to customers;
- Integrity and AML staff who review agent-prepared alerts;
- Risk, compliance and audit.
Dutch employers also need works council consent for systems that can monitor staff performance, and a workspace that records every review decision by name is such a system. Agree how review data will be used before training begins.
What skills does overseeing an agent require?
The skills principle becomes concrete when the agent acts. A governed agent works at one certified depth, and each action needs its own: read at 1, draft at 2, execute routine work within bounds at 3, move money or take hard-to-undo actions at 4. Every action passes a minimum chain of five bounds, and the verdict names which bound decided it: allowed, held for a named person, refused as outside bounds, or withheld at the platform floor.
An overseer needs to be able to:
- Tell which depth applies to the action in front of them, and what review that depth calls for.
- Read the facts behind the action and their provenance, from sealed records down to external claims, which cannot authorise a payment.
- Decide a held action with a recorded reason, and decline without hesitation when the facts do not support it.
- Treat a refusal as information, not an obstacle, and route it.
- Plan for the agent's certificate lapsing after 90 days, and for a run that clears no depth dropping it to depth 1 the same day.
A skills matrix for an AI agent team maps these abilities to named people and shows where a capability depends on one person.
How do you meet DNB and AFM expectations?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Skills at all levels (DNB principle) | Role-based training from board to reviewer, with assessment | Training and assessment records by role |
| Accountability | Each agent capability owned by a named manager | Responsibility map approved by the board |
| Fair, explainable customer outcomes (AFM) | Advisers trained to check and explain agent drafts before sending | Reviewed drafts with edits and reasons |
| Human oversight for high-risk uses (AI Act) | Approval of credit and insurance pricing decisions limited to certified staff | Approvals matched to current credentials |
| Integrity and AML | Analysts trained to form their own view on agent-prepared alerts | Alert dispositions with reasons |
| ICT training (DORA) | Drills on agent incidents and drops to depth 1 | Drill reports, timings, follow-up actions |
Assessment is the part most firms underinvest in. A good assessment uses questions drawn from the firm's own cases and refreshed as the agent changes; what a question bank is explains how to build one. Credentials should expire for the same reason, as argued in why certificates for AI agent skills should expire.
What will DNB or the AFM ask?
DNB will ask about the board's understanding, the accountability for each agent, and how skills are assessed and kept current. It will sample integrity decisions the agent prepared. The AFM will ask how customer outcomes are checked, who reviews advice before it is sent, and how a customer complaint involving agent output was handled. Both will want to see that people decline the agent's work when they should, and that the record shows it.
For comparison, the same supervisory questions in Spain are covered in Banco de España and AEPD expectations, and in Italy in Banca d'Italia and IVASS expectations.
What do these expectations not cover?
DNB's principles are guidance about supervisory expectations, not a statute, and they do not prescribe hours, content or credentials. Neither supervisor decides what depth an agent may hold. Data protection sits with the data protection authority, not DNB or the AFM. And the expectations cover supervised financial firms; a Dutch retailer using an agent faces the AI Act and the GDPR but not these supervisors. The levels of literacy by role are set out in AI literacy and certification for people who work with agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy maps onto DNB's skills principle level by level: Foundations for board members and anyone who needs the concepts, Operator for reviewers and team leads, Builder for those who design and certify agents, and Architect for people leading regulated multi-agent deployments. Each track is the key to the next, and professional certificates expire, so skills are refreshed as agents change.
Questions people ask
Does DNB require board members to be trained on AI?
DNB expects board members to understand the AI their firm uses well enough to oversee it. That usually means structured literacy training, not technical skills, with evidence that it took place.
Does the AFM look at agents that never talk to customers?
Its focus is conduct, so agents that shape advice, sales or complaint outcomes matter most. An internal agent that affects customer outcomes indirectly, such as one prioritising complaints, can still be relevant.
How do pension funds apply this?
The same way, scaled to their operations. A pension fund using an agent for member letters needs reviewers who check accuracy, and its board must understand what the agent does.