---
title: "Bekostigde instelling voor hoger onderwijs"
description: "Which Dutch universities and hogescholen the draft Cyberbeveiligingsregeling hoger onderwijs covers: the 54 funded institutions in the WHW annex."
canonical: "https://gencompl.ai/glossary/bekostigde-instelling-voor-hoger-onderwijs"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:10:52.599Z"
modified: "2026-10-14T19:16:46.368Z"
---

# Bekostigde instelling voor hoger onderwijs

Bekostigde instelling, genoemd in de bijlage van de Wet op het hoger onderwijs en wetenschappelijk onderzoek, onder a tot en met i.

Also known as: Publicly funded higher education institution

**What does "bekostigde instelling voor hoger onderwijs" mean in the Cyberbeveiligingsregeling hoger onderwijs?**

Defined in: [Cyberbeveiligingswet](https://gencompl.ai/regulations/cyberbeveiligingswet) (BWBR0052872)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Bekostigde instelling voor hoger onderwijs

> bekostigde instelling, genoemd in de bijlage van de Wet op het hoger onderwijs en wetenschappelijk onderzoek, onder a tot en met i

## Defined in / by

- [Cyberbeveiligingsregeling hoger onderwijs (consultation draft)](https://gencompl.ai/regulations/cyberbeveiligingsregeling-hoger-onderwijs), Article 1.1

Last updated: 14 October 2026.

## Which institutions this covers

The definition points at a list, not a description. Parts a to i of the [annex to the Wet op het hoger onderwijs en wetenschappelijk onderzoek](https://wetten.overheid.nl/BWBR0005682/2026-08-01) (WHW) name the publicly funded institutions, as Article 1.8(1) WHW confirms. As at the WHW text of 1 August 2026, those parts hold 54 institutions, the same number the draft regulation's burden study works with. Article 2.1 of the [draft Cyberbeveiligingsregeling hoger onderwijs](https://gencompl.ai/regulations/cyberbeveiligingsregeling-hoger-onderwijs) designates every one of them as a [belangrijke entiteit](https://gencompl.ai/glossary/belangrijke-entiteit) under the Cyberbeveiligingswet.

Part j of the same annex lists the academic hospitals. Because the definition stops at part i, they fall outside it.

## Narrower than the Cbw allows

[Article 13 Cbw](https://wetten.overheid.nl/BWBR0052872/2026-08-15) lets the Minister of Education, Culture and Science designate an *instelling voor hoger onderwijs* as defined in Article 1.1, point g, WHW. That WHW definition covers both a funded institution in parts a to i of the annex and a *rechtspersoon voor hoger onderwijs*, which is not in the annex and receives no public funding. The draft regulation uses only the first half. Its explanatory notes say designating non-funded institutions would not be proportionate, given the weight NIS2 puts on critical research. Mbo institutions are out for a different reason: the notes say the Cbw gives no basis to designate them at all.

## Parts a to i of the WHW annex

As listed in the [WHW](https://wetten.overheid.nl/BWBR0005682/2026-08-01) text valid from 1 August 2026.

| Part | Institutions | Number |
| --- | --- | --- |
| a | Public universities (Leiden, Groningen, Amsterdam, Utrecht, Delft, Wageningen, Eindhoven, Enschede, Rotterdam, Maastricht) | 10 |
| b | Bijzondere universities, privately founded and publicly funded (Amsterdam, Nijmegen, Tilburg) | 3 |
| c to f | Vacant | 0 |
| g | Bijzondere hogescholen | 36 |
| h | Open Universiteit, Heerlen | 1 |
| i | Levensbeschouwelijke universiteiten | 4 |
| **Total** | All funded institutions in parts a to i | **54** |

> **What we could not establish: Check the current annex**
>
> This definition comes from a consultation draft; as at 14 October 2026 we found no adopted text. The annex it points to also changes: institutions merge, and under Article 1.8(3) WHW a change of statutory name takes effect when it is reported to the minister. To check whether a named institution is covered, read parts a to i of the current WHW annex rather than a list copied from elsewhere, this page included.

## Questions and answers

### Is a university medical centre a bekostigde instelling voor hoger onderwijs?

No. The academic hospitals are listed in part j of the WHW annex, and the definition in the draft Cyberbeveiligingsregeling hoger onderwijs covers parts a to i only. Whether a hospital falls under the Cyberbeveiligingswet in its own right is a question for the health sector of the Act, not for this regulation.

### Are private hogescholen covered?

No. Only the funded institutions in parts a to i of the WHW annex fall within the definition. A private institution that is not in the annex is not designated by the draft Cyberbeveiligingsregeling hoger onderwijs, and its explanatory notes say designating non-funded institutions would not be proportionate.

### Is the Open Universiteit covered?

Yes. The Open Universiteit in Heerlen is listed in part h of the WHW annex, which falls within parts a to i. The four levensbeschouwelijke universiteiten in part i are covered on the same basis.

## Sources

- [Cyberbeveiligingsregeling hoger onderwijs: consultation draft with explanatory notes (PDF)](https://www.internetconsultatie.nl/cyberbeveiliging/document/15765) (Internetconsultatie (OCW) · 12 June 2026)
- [Consultatie Cyberbeveiligingsregeling hoger onderwijs](https://www.internetconsultatie.nl/cyberbeveiliging/b1) (Internetconsultatie (OCW) · 12 June 2026)
- [Wet op het hoger onderwijs en wetenschappelijk onderzoek, consolidated text BWBR0005682](https://wetten.overheid.nl/BWBR0005682/2026-08-01) (wetten.overheid.nl · 1 August 2026)
- [Cyberbeveiligingswet, consolidated text BWBR0052872](https://wetten.overheid.nl/BWBR0052872/2026-08-15) (wetten.overheid.nl · 15 August 2026)

## Related content

### Regulation

- [Cyberbeveiligingsregeling hoger onderwijs](https://gencompl.ai/regulations/cyberbeveiligingsregeling-hoger-onderwijs): The Cyberbeveiligingsregeling hoger onderwijs is a draft OCW regulation that makes the 54 publicly funded Dutch universities and hogescholen important entities under the Cyberbeveiligingswet. Registration and incident reporting are expected from 1 April 2027; the duty of care follows 36 months after designation.
- [Cyberbeveiligingswet (Dutch NIS2)](https://gencompl.ai/regulations/cyberbeveiligingswet): The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.