NIS2 and the Dutch Cybersecurity Act: scope, duties and deadlines

The Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw), which implements the NIS2 Directive, entered into force on 15 August 2026. It applies to medium-sized and large organisations in eighteen designated sectors, and to a number of critical providers regardless of size; the government estimates that it covers around 8,000 organisations in the Netherlands, many of which were not subject to any cybersecurity regulation before.

Three obligations sit at its core. An organisation within scope must take appropriate and proportionate measures to manage the risks to its network and information systems, including its supply chain (the duty of care, zorgplicht). It must report a significant incident in three steps: an early warning within 24 hours, a notification within 72 hours and a final report within one month. And it must register with the National Cyber Security Centre (NCSC).

For many boards the key change is where responsibility sits. Under Article 20 of the directive, management must approve the risk management measures, supervise their implementation and follow training, and can be held accountable if the obligations are not met. That responsibility cannot be delegated to an IT department or an external provider.

What is NIS2?

NIS2 is Directive (EU) 2022/2555, the second European directive on network and information security. It replaced the first directive (NIS1) from 18 October 2024 and brings a much broader scope and stricter supervision and enforcement.

Where NIS1 distinguished between operators of essential services and digital service providers, NIS2 distinguishes between essential entities (essentiële entiteiten) and important entities (belangrijke entiteiten). That distinction determines how intensive supervision is and how high fines can be.

Which organisations fall under NIS2?

NIS2 applies to organisations active in eighteen designated sectors that are at least medium-sized, plus certain providers whatever their size. You must assess this yourself; no supervisor will tell you.

Which sectors are covered?

The eighteen sectors are divided into sectors of high criticality (Annex I of the directive) and other critical sectors (Annex II).

• Sectors of high criticality: energy, transport, banking, financial market infrastructure, health care, drinking water, waste water, digital infrastructure, ICT service management for business users, public administration and space.
• Other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers, and research organisations.

Within each sector, the directive specifies which types of organisation are covered. In manufacturing, for example, it concerns producers of medical devices, computers and electronics, electrical equipment, machinery and vehicles, not all manufacturers.

What is the size threshold?

An organisation in a designated sector falls under NIS2 if it is at least a medium-sized enterprise under Recommendation 2003/361/EC. In practice this means 50 or more employees, or an annual turnover and an annual balance sheet total that both exceed €10 million.

Under the European definition, staff numbers and financial figures of partner and linked enterprises must in principle be included. A subsidiary with 30 employees can therefore fall within scope if it belongs to a larger group.

Certain organisations fall within scope regardless of size, because their services are regarded as particularly critical. These include:

• providers of public electronic communications networks and services;
• trust service providers;
• domain name registration service providers, top-level domain name registries and DNS service providers;
• public administration bodies, which in the Netherlands include ministries, provinces, municipalities and their joint arrangements.

Around 8,000 organisations are covered, far more than under the previous Network and Information Systems Security Act (Wet beveiliging netwerk- en informatiesystemen, Wbni). Medium-sized manufacturers, food producers, research institutions and digital service providers may be caught. The government offers a step-by-step self-assessment tool through the NCTV and NCSC websites.

What does the duty of care require?

Essential and important entities must take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems. The measures must cover at least the subjects listed in Article 21 of the directive:

• risk analysis and information security policy;
• incident handling;
• business continuity, backup management and disaster recovery;
• supply chain security;
• security in the acquisition, development and maintenance of systems, including vulnerability handling;
• cyber hygiene and staff training;
• multi-factor authentication and secured communications;
• cryptography and, where appropriate, encryption;
• human resources security, access control and asset management;
• periodic assessment of the effectiveness of the measures.

The measures must be proportionate to the size of the organisation and its actual risks, so a smaller important entity does not need the same measures as a large essential entity. You must still be able to show the supervisor which risks you identified, which measures you took and why they are appropriate.

How does supply chain security work in practice?

You assess the cybersecurity of your direct suppliers and service providers and make agreements with them. Many incidents start at a supplier rather than within the organisation itself.

In practice, this means reviewing your contracts. Useful clauses cover minimum security requirements, a duty for the supplier to report incidents to you promptly, audit rights, subcontracting, and cooperation during an incident.

What must you do after an incident?

After a significant incident you must report in three phases: an early warning within 24 hours, a notification within 72 hours, and a final report within one month. The deadlines run from the moment you become aware of the incident.

An incident is significant if it has caused or can cause severe operational disruption or financial loss for the organisation, or considerable material or non-material damage to others. Under Article 23 of the directive:

• within 24 hours: an early warning to the competent computer security incident response team (CSIRT) or authority, stating whether the incident may have been caused by unlawful or malicious acts and whether it may have a cross-border impact;
• within 72 hours: a notification that updates the early warning and gives an initial assessment of the severity and impact, and where available the indicators of compromise;
• within one month at the latest: a final report describing the incident, its likely root cause, the measures taken and any cross-border effects.

Set up the procedure in advance: who decides whether an incident is notifiable, who notifies, and how the board is informed. If personal data are involved, a separate notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) may be required within 72 hours under Article 33 GDPR.

What responsibility rests with the board?

Under Article 20 of the directive, the management body must approve the cybersecurity risk management measures, oversee their implementation and can be held liable for infringements. Its members must also follow training.

Record board involvement in a way that can be shown: training undertaken, board decisions, approved policy, risk assessments and oversight of implementation. For directors of Dutch companies, this also matters for the standard of proper performance of duties under Article 2:9 of the Dutch Civil Code (BW).

How has the Netherlands implemented NIS2?

Through the Cybersecurity Act and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, Wwke), both in force since 15 August 2026. The transposition deadline of 17 October 2024 was not met.

The Senate (Eerste Kamer) approved both acts on 7 July 2026. One day later, on 8 July 2026, the European Commission decided to refer the Netherlands, together with Ireland, Spain and France, to the Court of Justice of the European Union for failing to notify transposition measures.

The Wwke implements the CER Directive (Directive (EU) 2022/2557) on the physical resilience of critical infrastructure; around 500 organisations are formally designated as critical entities by the responsible minister. On entry into force of the Cbw, the Wbni lapsed.

How do you register with the NCSC?

Essential and important entities must register in the national entity register through the Mijn.NCSC.nl portal. Registration is mandatory from 15 August 2026, and changes must be reported within two weeks.

Access requires eHerkenning at level 3 or higher; public sector bodies use SSOnRijk. A change such as a merger or new IP ranges must be reported within two weeks, and a supervisor can enforce registration with a fine or an order subject to a penalty payment. Once registered, you can use the services of your CSIRT, including support during an incident.

How are supervision and enforcement organised?

Essential entities are subject to proactive supervision; important entities to reactive supervision. Both categories must meet the same basic obligations.

In proactive supervision, the supervisor may check on its own initiative, for example by requesting information or making a site visit. In reactive supervision, it acts in response to an incident, a complaint or another concrete signal.

The Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) supervises nine sectors: energy, digital infrastructure, ICT service management, public administration, space, postal and courier services, manufacturing, digital providers and research. Other supervisors are designated for the other sectors. The toolkit includes security audits, binding instructions, orders subject to a penalty payment, publication of an infringement and fines; for essential entities also suspension of an authorisation or a temporary ban on a board member.

Under Article 34 of the directive, the maximum fine for essential entities is at least €10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities it is at least €7 million or 1.4%. The actual fine depends on the nature, gravity and duration of the infringement and the degree of culpability.

What should you check as an organisation in scope?

Start with a self-assessment and work from there to the measures, the notification process and board involvement. The obligations have applied since 15 August 2026, without a transition period.

• Establish whether you are active in a designated sector and meet the size threshold, taking group companies into account.
• Determine whether you are an essential or an important entity, and which supervisor is competent.
• Register with the NCSC through Mijn.NCSC.nl and report changes within two weeks.
• Test your measures against the ten subjects of Article 21 of the directive.
• Record who notifies and how the 24-hour, 72-hour and one-month deadlines are met.
• Document board decisions, training and oversight.

What should you check as a supplier to an organisation in scope?

Even if NIS2 does not cover you, your customers will often pass its requirements on to you by contract. Check what you are signing.

• Which minimum security requirements does the contract impose, and can you meet them?
• Within how many hours must you report an incident to your customer?
• How far do the customer’s audit rights go, and who pays for an audit?
• Are you allowed to subcontract, and on which conditions?
• Is your liability for a security incident capped?

What can we do for you with NIS2 and the Cybersecurity Act?

Our IT lawyers assist businesses, directors and compliance officers with the Cybersecurity Act.

• We determine with you whether your organisation is in scope and in which category.
• We review your duty-of-care documentation against Article 21 of the directive.
• We draft or review security, notification and audit clauses in supplier and customer contracts.
• We set up the incident notification procedure, including the link with GDPR data breach notification.
• We advise the board on its responsibility and on documenting decisions and training.

Summary

• The Dutch Cybersecurity Act implements NIS2 and has applied since 15 August 2026, to around 8,000 organisations in eighteen sectors.
• As a rule, medium-sized and large organisations in those sectors are covered; some providers are covered whatever their size. You must assess this yourself.
• The core obligations are the duty of care, the phased notification of significant incidents (24 hours, 72 hours, one month) and registration with the NCSC.
• The board must approve and oversee the measures, follow training and can be held accountable.
• Fines can reach at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important entities.

Frequently asked questions