Netherlands NIS2 Cybersecurity Act: 8,000 Firms Now Affected

The Netherlands' NIS2 Cybersecurity Act, known in Dutch as the Cyberbeveiligingswet, takes effect on Saturday 15 August 2026, directly imposing stricter digital security duties on about 8,000 organisations across 18 critical sectors. Hospitals, drinking water companies, municipalities, telecom providers and public transport operators must now map cyber risks, take concrete protective measures and report serious incidents within 24 hours. The law is the Dutch transposition of the European Union's NIS2 directive and replaces the older Network and Information Systems Security Act (Wbni).

What is the Dutch NIS2 Cybersecurity Act?

The Cyberbeveiligingswet (Cbw) brings the EU's NIS2 directive, formally Directive (EU) 2022/2555, into national law. According to the Dutch National Cyber Security Centre (NCSC), the act entered into force on 15 August 2026, after the Senate adopted the bill on 7 July 2026. Member states were supposed to transpose NIS2 by 17 October 2024, but delays in the Netherlands prompted the European Commission to open infringement proceedings. The EU cybersecurity directive compliance push has exposed uneven implementation across the bloc, with only 23 member states fully applying the measures by 2026.

Compared with the earlier NIS1 rules, which covered only a few hundred entities, NIS2 expands obligations to roughly 8,000 organisations in 18 critical sectors.

Three key duties: care, reporting and board responsibility

Cybersecurity expert Lisa de Wilde says the legislation introduces three major changes for affected organisations.

• Duty of care (zorgplicht): Organisations must map their cyber risks and take proportionate technical, operational and organisational measures to protect network and information systems.
• 24-hour reporting duty (meldplicht): Serious incidents must be reported to the relevant CSIRT and supervisor within 24 hours, with a fuller notification within 72 hours.
• Board-level accountability: Management must approve security measures and oversee implementation as part of integrated risk management.

On board liability, De Wilde warned: 'The board is held responsible for ensuring that organisational security remains in order. If they fail to do so and an incident occurs, they can be held personally liable.'

Supply chain ripple effect beyond the 8,000

Although the law directly targets 8,000 large and critical organisations, its impact will be felt across the whole Dutch business community. Companies must now assess the security of their entire supply chain. 'It may be that they supply a service to a critical organisation that is so relevant that requirements are also imposed on that organisation,' De Wilde explained. 'So those 8,000 organisations also look at their chain. That means the law actually impacts far more than those 8,000 organisations.' This mirrors broader critical infrastructure cybersecurity rules across Europe.

Personal data leaks also fall under the risks requiring protective measures and must be reported under the new law, alongside existing obligations under the EU General Data Protection Regulation (GDPR).

Costs, enforcement and delayed implementation

Dutch business groups have criticised the administrative burden and compliance costs. De Wilde partially pushed back: 'I actually think organisations should have already been working on this. True, it costs money, but a cyberattack that takes place, or the impact when one occurs, is enormous—not only financially.'

For organisations that were already well prepared, little will change, she said, but for late starters the new rules represent a significant expense. How strictly the law bites will depend on supervision. 'The question is ultimately: will it be enforced, and what will the consequences be for those organisations?' De Wilde said. Businesses can review their obligations through the Dutch cybersecurity compliance checklist published by the national government.

Frequently Asked Questions

When does the Dutch NIS2 Cybersecurity Act take effect?

The Cyberbeveiligingswet came into force on 15 August 2026.

How many organisations does the law directly affect?

About 8,000 organisations in 18 critical sectors are directly covered.

What is the incident reporting deadline?

Serious incidents must be reported within 24 hours, with follow-up details within 72 hours.

Can directors be held personally liable?

Yes, boards can be held liable if they fail to ensure adequate security and an incident occurs.

Does the law affect small suppliers?

Indirectly, yes: critical organisations must assess their supply chain, so requirements can cascade to their suppliers.