Rijksinspectie Digitale Infrastructuur (RDI)

Why does the Cyberbeveiligingswet mostly not apply to licensed financial institutions?

Because DORA is the more specific regime. The Dutch government states that DORA's provisions take precedence over both the Cyberbeveiligingswet and the Critical Entities Resilience Act for financial entities. In the Cyberbeveiligingswet's own table of sectors and supervisors, banking and credit sits with DNB and financial market infrastructure with the AFM, not the RDI.

A financial institution re-enters the RDI's scope only where it does something else as well: acting as a qualified trust service provider under eIDAS, or operating digital infrastructure such as DNS, cloud or a TLD registry. If a group contains such an entity, it registers and reports separately, under a different law, to a different supervisor.

When did the Dutch NIS2 law actually take effect?

15 August 2026, two days before this page was written, and roughly 22 months after the EU transposition deadline of 17 October 2024. The delay matters commercially: organisations that built compliance programmes to the EU deadline spent almost two years in a regime that had not yet started.

Registration is running behind. As at 13 August 2026, two days before entry into force, 2,942 organisations had registered with the NCSC, against an expected 8,000 to 10,000 in scope: under half.

What does the RDI publish, and how often?

Guidance and sector assessments, a NIS2 self-assessment tool, state-of-digital-infrastructure reporting and consultations. The volume is far lower than the financial supervisors': the RDI is an inspectorate, not a rule-writer, and its output clusters around implementation moments rather than a fixed calendar. The self-assessment tool is the most-used artefact, and the one most often cited by Dutch organisations working out whether they are in scope.

What does enforcement look like?

The Cyberbeveiligingswet gives supervisors instruction, binding-order and fining powers, with ceilings set in the act. We have not observed a published enforcement measure yet: the law is two days old. What can be said with confidence is what the supervisors have said themselves: the first phase is registration and duty-of-care compliance, and the registration gap above (2,942 against 8,000 to 10,000 expected) is the number to watch, because it defines where the first supervisory attention will go.

What changes for a mid-sized institution?

Probably nothing directly, and that is the useful answer. An institution holding a DNB or AFM licence has its cyber and ICT-risk obligations run through DORA, with incident reports going to its financial supervisor. Two exceptions are worth checking in a group structure: an entity that provides trust services under eIDAS, and an entity that provides cloud, DNS or data-centre services to third parties. Either pulls that entity, not the whole group, into the Cyberbeveiligingswet and into a separate registration with the NCSC.