Deep dives
A deep dive examines one obligation reporting an incident, registering, getting authorised across whichever regulations impose it.
Who files an EUDR due diligence statement, and what goes in it?
The operator that first places covered products on the EU market or exports them, from 30 December 2026; micro and small firms from 30 June 2027, except for timber already under the old Timber Regulation. The statement carries the geolocation of every plot of production. Since the December 2025 amendment, downstream operators and traders no longer file one.
NextEUDR applies to large and medium-sized operators and traders, and to EU Timber Regulation products of micro and small operatorsWhen must you report a cyber incident under the Cyberbeveiligingswet, and to whom?
When it seriously disrupts your services, causes you financial loss, or causes others considerable damage. Send an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within one month, through the NCSC's meldpunt on mijn.ncsc.nl, which forwards mandatory reports to your supervisor.
No dates aheadWhat goes in the DORA register of information, and when is it due?
Every contract for ICT services, at entity and group level, in the 15 templates of Implementing Regulation (EU) 2024/2956, with each provider identified by LEI or EUID. Dutch firms file it once a year: in 2026 by 20 March with DNB or 31 March with the AFM, as xBRL-CSV. No 2027 window has been announced.
No dates ahead