The full register — every obligation, by law

If the property operates any AI system — a booking chatbot, dynamic pricing, a CV screener, guest sentiment analytics — it must take measures to ensure a sufficient level of AI literacy among staff and others dealing with the system on its behalf, taking into account their technical knowledge, experience and training, and the context the system is used in. This is a duty on DEPLOYERS, not only on the company that built the tool.

Placing on the market, putting into service or using AI systems to infer the emotions of a natural person in the workplace is PROHIBITED, save where the system is intended for medical or safety reasons. This is a prohibition, not a requirement to manage — there is no compliance path that makes it permissible for staff-monitoring or performance purposes.

AI systems intended to be used for the recruitment or selection of natural persons — placing targeted job adverts, analysing and filtering applications, or evaluating candidates — are high-risk under Annex III. A property using such a system is a DEPLOYER and must, among other duties, use it in accordance with the provider's instructions, assign human oversight to people with the competence, training and authority to exercise it, monitor operation, and keep the automatically generated logs it controls.

Before putting a high-risk AI system into service or use at the workplace, a deployer that is an employer must inform workers' representatives and the affected workers that they will be subject to its use. This is a duty owed to staff, and it sits alongside — not instead of — any information duty owed to candidates or guests.

Annex III is not limited to hiring. An AI system used to allocate tasks based on individual behaviour or personal traits, to monitor or evaluate the performance and behaviour of staff, or to inform decisions on promotion or termination, is high-risk in its own right. Rota optimisation that scores individuals, and performance dashboards that rank them, are squarely within this limb — and it catches far more hotels than CV screening does.

An AI system intended to interact directly with people must be designed so those people are informed they are interacting with an AI — unless it is obvious to a reasonably well-informed, observant and circumspect person in the context. For a booking chatbot or concierge assistant, assume it is not obvious and disclose.

A deployer of an emotion recognition system or a biometric categorisation system must inform the people exposed to it that it is operating, and must process the personal data in accordance with the GDPR. Unlike Art. 50(1), this duty sits with the DEPLOYER — it is yours, not your vendor's.

A "provider" is anyone who develops an AI system — OR HAS ONE DEVELOPED — and puts it into service under their own name or trademark. Buy an off-the-shelf chatbot and use it, and you are a deployer. Commission one, or have a vendor build a bespoke assistant you run as your own, and you are the PROVIDER of that system. Every duty this register describes as "your vendor's" then belongs to you: the Art. 50(1) disclosure design, the Art. 50(2) marking of generated content, and, if the system is ever high-risk, the whole Chapter III conformity apparatus.

Providers of AI systems generating synthetic audio, image, video or text must ensure the output is marked in a machine-readable format and detectable as artificially generated or manipulated. This duty is the PROVIDER's. Use a third-party tool to produce marketing copy or imagery and the marking duty is that tool vendor's, not yours. What is yours is the consequence of publishing unmarked synthetic content, and the Art. 50(4) disclosure duty where that content is a deep fake. The action here is procurement, not engineering.

A deployer who generates or manipulates image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. A deep fake is content resembling existing persons, objects, places, entities or events that would falsely appear to a person to be authentic. A fully generated room, or a composite showing a view the room does not have, is squarely within it. Unlike Art. 50(1) and 50(2), this duty is the DEPLOYER's — it is yours, and it does not move to the tool vendor.

Every disclosure required by Art. 50(1), 50(3) and 50(4) must be given to the person concerned clearly and distinguishably, at the latest at the time of the first interaction or exposure, and must meet the applicable accessibility requirements. A disclosure buried in a privacy policy, or shown after the guest has already typed a message to the chatbot, does not discharge the duty.

A deployer of a high-risk AI system must use it in accordance with the instructions for use; assign human oversight to named people with the competence, training, authority and support to exercise it; ensure input data it controls is relevant and sufficiently representative; monitor operation and suspend use and inform the provider where the system presents a risk; and keep the logs the system generates automatically for at least six months. Where a decision affects a person, that person must be told a high-risk system is being used on them.

Where you take a decision on the basis of output from an Annex III high-risk system, and that decision produces legal effects or similarly significantly affects the person adversely in their health, safety or fundamental rights, that person has the right to obtain from YOU — the deployer, not the vendor — clear and meaningful explanations of the role the AI system played in the decision procedure and the main elements of the decision taken. A rejected job applicant, or an employee refused a promotion where a scoring tool contributed, is exactly this person.

Before the guest is bound by a distance or off-premises booking, give the total price of the stay inclusive of all taxes, or — where the price genuinely cannot be calculated in advance — the method by which it will be calculated, together with any additional charges that will become payable. Drip-pricing a mandatory fee into a later step of the booking flow does not satisfy this.

If the rate presented to a particular guest was personalised on the basis of automated decision-making — dynamic pricing driven by profiling of that guest rather than by inventory and date alone — say so in the pre-contract information. This is an information duty, not a prohibition: personalised pricing remains lawful, undisclosed personalised pricing does not.

Accommodation provided for a specific date or period is exempt from the distance contract right of withdrawal. The operator sets its own cancellation policy — but that policy must be disclosed before booking, and it is what the guest is held to. Do not tell a guest they have a statutory 14-day right; do not tell them no consumer protection applies either, because the terms remain reviewable for fairness.

Where a city, tourist or overnight tax is payable by the guest, it forms part of what the guest must be told before being bound. State that the tax applies, and state the amount or the basis on which it is calculated, in the pre-contract information rather than at check-out.

Personal data collected from guests — booking records, identity documents, CCTV footage, electronic door-lock logs, Wi-Fi and captive-portal data, loyalty profiles — must be processed lawfully, fairly and transparently, limited to what is necessary, and the guest must be told at the point of collection who is processing it, why, on what basis, for how long and what rights they have. CCTV needs signage at the point of entry to the monitored area, and cameras must not cover rooms, bathrooms or changing areas.

Personal data may be kept in identifiable form only for as long as is necessary for the purpose it was collected for. Set and actually apply a retention period per category — booking records, CCTV, door-lock logs, marketing consents — and delete or anonymise on schedule. Where a guest asks for erasure and no other basis to keep the data applies, erase it. "We keep everything" is not a retention policy.

Matching a guest's face to their booking is the processing of biometric data for the purpose of uniquely identifying a natural person. Article 9(1) GDPR PROHIBITS that outright, and it becomes lawful only if one of the Article 9(2) exceptions applies. For a hotel the only realistic one is 9(2)(a) explicit consent. Consent is valid only if it is freely given, which means a guest who declines must be able to check in another way, just as quickly and without disadvantage. If facial check-in is the only route, or the alternative is a longer queue, the consent is not freely given and the processing has no lawful basis at all.

The property's e-commerce service — the booking website and mobile app, the path from search through to a concluded reservation, and the confirmation and support that go with it — must meet the accessibility requirements in Annex I of the European Accessibility Act, as transposed nationally. This is a requirement about SOFTWARE AND INFORMATION, not about the premises.

Nothing to do at EU level. This entry exists to close a gap rather than to impose a duty: step-free access, doorway widths, accessible rooms and bathrooms, lifts and signage are set by NATIONAL building regulation, and the European Accessibility Act does not require them. Look for the duty in this register's national layer for your country; where that layer is absent, this register does not answer the question and you must check the national building code yourself.

Do not state or imply a star rating, classification, award or facility the property does not have, and do not present true information in a way that is likely to deceive. Where a star rating comes from a national or regional classification scheme, only that scheme's award may be presented as a classification; a self-assigned or marketing "star" must not be presented as one. The same rule catches photographs, room descriptions, "sea view", scarcity claims and discounted-rate announcements.

If the property states or implies that the reviews it displays come from guests who actually stayed, it must take reasonable and proportionate steps to check that they did. Submitting, commissioning or incentivising false reviews, and misrepresenting reviews — including by publishing only the positive ones while implying the set is complete — are prohibited in all circumstances, with no need to prove that any consumer was actually harmed.

A building must have spaces that are sufficiently accessible to persons with a functional impairment. For the use functions listed in table 4.183 this is satisfied by complying with the designated rules on an accessibility sector (toegankelijkheidssector): its presence, its floor area, which specific rooms it must contain, how it must be reached, permitted height differences and lift dimensions. Thresholds turn on the use function and the gross floor area.

Using a building for a lodging function generally requires a prior use notification (gebruiksmelding) to the competent authority, with drawings and particulars about escape routes, occupancy and fire-safety installations. The paragraph applies to a use function only in so far as table 6.6 designates it, and the trigger is stated as a number of persons present rather than a number of rooms.

Storing information on, or reading information from, a visitor's device is allowed only with that visitor's prior consent, given after clear and comprehensive information about the purposes. Strictly necessary storage — the session that carries a booking through checkout — is exempt. Analytics, advertising, remarketing pixels, chat widgets and A/B testing are not.

Where the Member State (nationally, regionally or locally) has established a registration procedure for the area the unit is in, the host must declare to the online platform whether the unit is subject to that procedure and, if it is, supply the registration number. The number must be obtained by declaration to the competent authority before the unit is offered.

Standard terms the guest did not individually negotiate are void if, contrary to good faith, they create a significant imbalance to the guest's detriment. The Annex names two patterns a hotel routinely writes: keeping the guest's deposit when the guest cancels without giving the guest an equivalent sum when the HOTEL cancels, and requiring a disproportionately high sum from a guest who fails to pay. Non-refundable rates are not automatically unfair — asymmetric ones are the exposure.

An electronic payment initiated by the payer through a remote channel must be authenticated with two independent elements from knowledge, possession and inherence, dynamically linked to the amount and the payee. In practice the operator's obligation is to route online card payments through a payment service provider that applies SCA, and to design the booking flow so authentication can complete rather than dropping the booking.

Selling accommodation together with at least one other travel service — airport transfer, car hire, excursion, event ticket sold as part of the stay — can make the sale a package or a linked travel arrangement. If it does, obligations attach that a hotel does not otherwise carry: prescribed pre-contract information, liability for performance of the whole package, and mandatory INSOLVENCY PROTECTION for the money taken. Decide deliberately whether your add-ons cross the line; do not discover it after the fact.

Managers of establishments providing accommodation must ensure that non-national guests personally complete and sign a registration form and confirm their identity with a valid identity document. Completed forms are kept for, or forwarded to, the competent authorities. Accompanying spouses, accompanying minors and members of travel groups are excepted.

No directly binding EU duty exists. Council Recommendation 86/666/EEC sets out principles for fire precautions in existing hotels — reduce the risk of a fire starting, prevent the spread of flame and smoke, ensure all occupants can be evacuated safely, enable the emergency services to act — and invites Member States to legislate. The enforceable requirements (detection, compartmentation, escape routes, occupancy limits, use notifications) are in NATIONAL building and fire regulation.

A food business operator — which includes a hotel kitchen, restaurant, bar, breakfast buffet or room service — must put in place, implement and maintain a permanent procedure based on HACCP principles: identify hazards, identify critical control points, set critical limits, monitor, correct, verify and keep records. A written plan that is not actually operated does not satisfy this.

Where food is offered to the final consumer without prepackaging — a buffet, a plated restaurant dish, a bar snack — the 14 substances listed in Annex II must be declared. This is MANDATORY for non-prepacked food; only the MEANS of providing it (menu, notice, verbal on request with a written back-up) is left to national measures. Being able to answer "does this contain celery?" correctly is the duty.

Authors hold the exclusive right to authorise communication of their works to the public. Transmitting a signal to television or radio sets in guest rooms, and playing recorded or broadcast music in a lobby, bar, restaurant, gym or spa, is such a communication and requires a licence from the relevant collecting societies — normally one for the authors' rights and a second for performers' and producers' related rights.

Member States must ensure a risk assessment of domestic distribution systems is carried out, and may focus Legionella monitoring on PRIORITY PREMISES — large non-household premises with many users, which is what a hotel is. Where a risk is found, remedial measures follow. The operator-facing duty (a written risk analysis, a control plan, temperature regimes, flushing of little-used outlets, sampling and a logbook) is created by the national transposition.

A taxable person must ensure an invoice is issued for supplies made to another taxable person or to a non-taxable legal person, and for payments on account received before such a supply. In accommodation that means corporate bookings, company-paid stays and prepaid deposits from business customers. The invoice must carry the particulars the Directive prescribes, and the issuing and storage rules are then set nationally.

Reporting platform operators must run due-diligence procedures on their sellers and report them annually to a Member State tax authority, which then exchanges the data automatically across the Union. The host's own position is consequential rather than procedural: identity, address, tax identification number, property address and the consideration credited each quarter are collected and reported, so income declared to the tax authority must match what the platform has already told it. Expect the platform's data requests and answer them accurately.

Where the operator is committed to, or required to use, an alternative dispute resolution entity, it must tell consumers which entity or entities those are and give the entity's website address, clearly and accessibly on its own website and in its terms and conditions. Where a complaint cannot be settled directly, the consumer must be told on paper or another durable medium whether the operator will use ADR to resolve it.

The Netherlands transposed Directive (EU) 2019/882 by amending the Warenwet, the Wet gelijke behandeling op grond van handicap of chronische ziekte, the Telecommunicatiewet, Book 6 of the Burgerlijk Wetboek and the Wet handhaving consumentenbescherming. The transitional article softens the landing for most services — pre-28 June 2025 service contracts may run to expiry, and existing products may keep being used — but article VIII(4) EXCLUDES e-commerce service providers from that relief. A Dutch hotel's booking website therefore had to be accessible from 28 June 2025 with no grace period.

Where the municipal council has designated a category of dwelling and an area in its huisvestingsverordening, it is prohibited to offer that dwelling for the form of tourist letting described in the ordinance without stating the dwelling's registration number in EVERY listing. The number is applied for by the person offering the dwelling. Publishing a listing without the number is separately prohibited.

Anyone whose business is providing overnight accommodation must, immediately on a guest's arrival, have a valid travel document or identity document produced, and must keep a CONTINUOUS register recording without delay the guest's name, place of residence and date of arrival, the nature of the document produced, and on departure the date of departure. Failing to do so is a criminal offence (overtreding), not an administrative one.

It is prohibited to act contrary to the specified articles of Regulation (EC) 852/2004 — including article 5, the HACCP obligation — and of Regulations 853/2004 and 854/2004 where relevant. In other words the EU hygiene rules are not merely directly applicable; the Warenwetbesluit makes breaching them a discrete enforceable prohibition under Dutch law, policed by the NVWA.

It is prohibited to operate a licensed-hospitality business (horecabedrijf) or an off-licence without a licence to that effect from the mayor. For a hotel this captures the bar, the restaurant, banqueting and in-room service of alcoholic drinks. The licence is tied to premises and to named managers, and it does not travel with a change of operator.

Performance or presentation of a work in public is a form of making the work public, which is reserved to the rightholder. Playing music in a lobby, bar, restaurant, gym or spa, and relaying a television or radio signal to guest rooms, therefore requires permission — in practice a licence from Buma/Stemra for authors' rights and from Sena for performers' and producers' related rights.

Chapter 4 of the Drinkwaterbesluit applies to the owner of a collective water supply or collective pipe network serving taps in, among others, a building with a lodging function (logiesfunctie), a dwelling function providing commercial overnight accommodation to more than five persons, and a bathing establishment. Those owners must carry out a legionella risk analysis, draw up and execute a control plan, keep a logbook, sample at the prescribed frequency, and inform the inspector and take measures when limits are exceeded.

Municipalities are empowered — not required — to levy a tourist tax in respect of overnight stays by persons not registered as residents at an address in that municipality. Where the tax is levied on the person PROVIDING the opportunity to stay, that person is entitled to pass it on to the guest whose stay gives rise to it. In practice the operator collects and remits, under a municipal ordinance.

An invoice must state the prescribed particulars: the date of issue, a sequential number from one or more series that uniquely identifies it, the VAT identification number under which the supply was made, the customer's VAT identification number where relevant, and the further items listed in the article. A periodic invoice may cover several supplies provided the period is no longer than one calendar month, and self-billing by the customer is permitted only where agreed in advance and subject to an acceptance procedure.