Skip to main content
Regulation

Cyberbeveiligingswet (Dutch NIS2)

The Cyberbeveiligingswet is the Dutch implementation of NIS2, Directive (EU) 2022/2555. It entered into force on 15 August 2026 and covers more than 8,000 organisations. Registration, the duty of care and the 24-hour and 72-hour reporting duties applied from day one. Banks are largely displaced to DORA by Articles 22 and 31, but their IT suppliers are not.

Checked by Remmert
7 min read

When did the Cyberbeveiligingswet enter into force?

15 August 2026. The Act was signed on 8 July 2026, published as Staatsblad 2026, 187 on 10 July, and brought into force by Article 35 of the Cyberbeveiligingsbesluit. It implements NIS2, Directive (EU) 2022/2555, covers more than 8,000 Dutch organisations across the sectors listed in Bijlage 1 and Bijlage 2 to the Act, and imposed registration, a duty of care and 24-hour and 72-hour incident reporting from day one.

There is no general transitional period. The only express grace window is two years for board training.

This is a page about who the law catches and what it displaces. See the other regulations we track, including DORA.

Last updated: 17 August 2026, two days after entry into force. Checked against the Staatsblad text and the Cyberbeveiligingsbesluit.

At a glance

Official title

Wet van 8 juli 2026, houdende regels ter implementatie van Richtlijn (EU) 2022/2555 (Cyberbeveiligingswet)

Staatsblad

Stb. 2026, 187, consolidated text BWBR0052872

Implementing decree

Cyberbeveiligingsbesluit, Stb. 2026, 189, BWBR0052875

EU parent

Directive (EU) 2022/2555 (NIS2), CELEX 32022L2555

Kamerstukken

36764 (Cbw), 36765 (Wwke)

In force

15 August 2026

CER twin

Wet weerbaarheid kritieke entiteiten, Stb. 2026, 188, same date

CSIRT

NCSC for all sectors; Z-CERT for healthcare, SURFcert for research and education

Supervisors

Eight, by sector. DNB for banking, AFM for financial market infrastructure, RDI for digital infrastructure and ICT service management

Fines

Essential entities: €10m or 2% of worldwide turnover. Important entities: €7m or 1.4%. Whichever is higher.

In scope

"Ruim 8.000 organisaties" (NCTV). The sectors are listed in Bijlage 1 and Bijlage 2 to the Act

Does a Dutch bank fall under the Cyberbeveiligingswet or under DORA?

Under DORA for substance, but not fully out of the Cbw. This is the point most commentary gets wrong, and the Dutch legislator handled it with two separate provisions, not one.

  • Article 22 Cbw disapplies the duty of care (Article 21) where a sector-specific EU act imposes at least equivalent cybersecurity risk-management obligations.
  • Article 31 Cbw disapplies the notification duty (Articles 25 to 30) on the same equivalence test.

DORA is that act. Article 4 and recital 28 of NIS2 name it, and the memorie van toelichting to the Cbw states that DORA's ICT risk-management provisions apply to a large part of the financial sector in place of the NIS2 provisions.

A DORA-covered financial entity is out from under Article 21 Cbw, the duty of care, and with it Articles 5 to 18 of the Cyberbeveiligingsbesluit, and out from under Articles 25 to 30 Cbw, the entire notification chain: 24-hour early warning, 72-hour notification, progress report, final report, and user notification.

It is not out from under the rest of the Act.

What is a DORA-covered bank still in for?

Five things the equivalence test does not touch.

  • Art. 44 Cbw

    Registration

    Essential entities, important entities and domain-name registration service providers must supply data for the national register. A bank remains an essential entity; only the substantive obligations are displaced. Registration goes through MijnNCSC.

  • Art. 47 Cbw

    ENISA register data

    Data for the ENISA register, where applicable.

  • Art. 42 Cbw

    EU representative

    Appointment of an EU representative, for non-EU-established providers in the relevant categories.

  • Wwke

    Critical-entity designation

    The Wwke is entirely unaffected. DORA is lex specialis to NIS2 only, not to the CER Directive, and banking and financial market infrastructure are express Wwke sectors. A designated critical entity gets 9 months for a risk assessment, 10 months for resilience measures, and a 24-hour disruption report.

  • DNB / AFM

    Supervision

    Supervision stays with the financial supervisors for Cbw purposes: DNB for banking, AFM for financial market infrastructure, with the Ministry of Finance as competent authority.

Our IT supplier serves a bank. Are we out too?

No. The lex specialis attaches to the entity, not to the supply chain.

Cloud computing service providers, data centre operators, content delivery networks, managed service providers and managed security service providers are Cbw entities in their own right: digital infrastructure and ICT service management, supervised by the RDI, as soon as they meet the size threshold. A supplier to a bank therefore typically faces two overlapping regimes at once. DORA obligations cascaded contractually from its bank client, plus its own direct duty of care, registration duty and 24-hour and 72-hour reporting duty.

Conversely, a bank's own supply-chain security obligation is a DORA obligation, not Article 21(3) Cbw.

Who is in scope?

The baseline is the size cap. An entity of a type in Annex I or II is caught if it is medium-sized or larger.

SizeThresholdEffect

Large

250 or more staff, or turnover above €50m, or balance sheet above €43m

Annex I becomes essential. Annex II becomes important

Medium

50 to 249 staff, or turnover €10 to 50m, or balance sheet €10 to 43m

Annex I or II becomes important

Small / micro

Under 50 staff and €10m or less

Out, unless an exception applies

Where size does not matter at all: central and decentralised government bodies, qualified trust service providers, TLD name registries, DNS service providers, providers of public electronic communications networks or services, and domain-name registration service providers. Also caught regardless of size: sole providers in the Netherlands of a service essential to critical societal or economic activity, entities whose disruption could significantly affect public safety, security or health, entities that could induce significant systemic risk particularly cross-border, and entities critical at national or regional level.

Essential versus important changes the supervision, not the obligations. Essential entities face proactive, ex ante supervision: compliance is actively checked even with no incident. Important entities face ex post supervision, mainly triggered by signals of non-compliance. The substantive duties are identical.

What does it require?

Six obligation families. Scope decides whether the other five ever reach you.

  • Annex I & II

    Financial institution scope

    Only banks and financial market infrastructure appear in the annexes. Payment institutions, e-money institutions, insurers and investment firms are not caught at all, and DORA only displaces part of what applies to the banks that are.

  • 43 to 47 Cbw + Art. 27 Besluit

    Registration

    Classification, KvK number, entity type, domain names, through MijnNCSC with eHerkenning. Changes notified within two weeks. Mandatory since 15 August 2026.

  • 21 Cbw + Arts. 6 to 18 Besluit

    Duty of care (zorgplicht)

    Ten measure categories: risk analysis and security policy, incident handling, continuity and crisis management, supply chain security, secure acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, HR security and access control, multi-factor authentication and secured communications.

  • 25 to 30 Cbw

    Notification duty (meldplicht)

    Early warning within 24 hours, notification with initial assessment within 72 hours, a progress report on request, and a final report within one month.

  • 24 Cbw

    Board accountability

    The board approves the measures and supervises implementation; members need demonstrable knowledge, evidenced by a certificate of participation.

  • 33 to 34 Cbw

    Voluntary vulnerability reporting

    Open to anyone, including entities outside scope; anonymous reporting permitted.

Who supervises which sector?

The official mapping is the NCTV's Doorverwijsboom Cyberbeveiligingswet.

SectorSupervisor

Banking

DNB

Financial market infrastructure

AFM

Digital infrastructure, ICT service management, digital providers, energy, space, post and courier, manufacturing, all government layers

RDI

Transport, water, drinking water, wastewater, waste, chemicals, meteorology

ILT

Healthcare

IGJ

Food

NVWA

Nuclear

ANVS

How fast must you report an incident?

Reports go to both the CSIRT (NCSC) and the sectoral supervisor.

StepDeadlineArticle

Early warning (vroegtijdige waarschuwing)

Without delay, or within 24 hours of becoming aware of the significant incident

26 Cbw

Notification with initial assessment

Without delay, or within 72 hours

27 Cbw

Progress report

On request of the CSIRT or competent authority

28 Cbw

Final report

Within one month of the notification

29 Cbw

Notification to service users

Without undue delay, where service delivery is affected

30 Cbw

The dates

2024

  1. 17 October 2024Passed

    NIS2 transposition deadline, missed

  2. 7 November 2024Passed

    Implementing Regulation (EU) 2024/2690 becomes applicable, directly binding on digital providers

2026

  1. 8 July 2026Passed

    Act signed; Commission refers the Netherlands to the CJEU the same week

  2. 15 August 2026Passed

    Cyberbeveiligingswet, Cyberbeveiligingsbesluit and Wwke enter into force. Registration, duty of care and notification duty apply, and Wwke designations begin. No general transitional period

2027

  1. 17 October 2027Upcoming

    Article 40 NIS2 review of sectors, size criteria and entity types; every 36 months thereafter

2028

  1. 15 August 2028Upcoming

    Board training and knowledge deadline (Art. 24 Cbw, two years)

Differences by country

Member StateInstrumentIn force

Belgium

Law of 26 April 2024

18 October 2024, the earliest in the EU. Supervisor: CCB. Uses the CyberFundamentals framework. Expressly excludes banking and financial market infrastructure as DORA-covered

Germany

NIS2UmsuCG

December 2025. Estimated 25,000 to 30,000 entities in scope, up from around 2,000. Registration with the BSI

Netherlands

Cyberbeveiligingswet

15 August 2026

Ireland

National Cyber Security Bill 2024

Not enacted. Published 30 August 2024, still in committee

Twenty-three of twenty-seven Member States had transposed into primary law by mid-May 2026. The Netherlands, Ireland, Spain and France were the four that had not, and all four were referred to the Court of Justice on 8 July 2026. With the Netherlands now in force the practical count is twenty-four, leaving Ireland, Spain and France. Read carefully: the Commission distinguishes primary-law transposition from full transposition including secondary legislation, so official counts run lower than tracker counts.

The Netherlands therefore sits in the bottom four of the EU-27 on NIS2, roughly 22 months behind Belgium and 8 months behind Germany, and now ahead of three Member States that still have nothing.

What recently changed

15 August 2026: entry into force. Together with the Cyberbeveiligingsbesluit and the Wwke. The inwerkingtredingsbesluit was folded into the Cyberbeveiligingsbesluit itself rather than issued as a separate royal decree.

7 July 2026: the government announced the date. On scope, the figure to use is the NCTV's: "ruim 8.000 organisaties" fall under the Cyberbeveiligingswet. A figure of 10,000 circulates in trade-body material; 8,000 is the official estimate. We have not been able to confirm a per-sector breakdown of that 8,000, or an official count of designated critical entities under the Wwke, on any primary government page. The NCTV's page on who is covered gives no number and states only that sector ministers make the designations. We do not publish the figures that circulate for either.

7 July 2026: Eerste Kamer adoption, with only FVD against, following Tweede Kamer adoption on 15 April 2026. The bill had been submitted on 2 June 2025, after Raad van State advice of 19 February 2025 that criticised the national-security exception for government bodies, the articulation of the coordinating role, overlapping supervision between ministries and independent authorities, and the RDI's independence in supervising government entities including itself.

18 March 2026: the NCTV published the Doorverwijsboom, the official sector-to-ministry-to-CSIRT-to-supervisor mapping.

20 January 2026: the Commission proposed amending NIS2. COM(2026) 13 final targets simpler jurisdictional rules, faster collection of ransomware attack data and easier cross-border supervision with a stronger ENISA role. It complements the Digital Omnibus proposal for a single entry point for cybersecurity incident reporting across NIS2, GDPR, DORA and the Cyber Resilience Act. It is a proposal only, and does not affect Cbw obligations today.

What can GenCompl.ai do for you?

Our pipeline tracks the Cbw, the Cyberbeveiligingsbesluit, the sectoral Cyberbeveiligingsregelingen and their EU parents, and derives which regime actually applies to a given entity. That includes the Article 22 and Article 31 displacement to DORA, and the point at which a group's IT subsidiary picks up its own Cbw duties that its regulated parent does not have. Each conclusion carries the article, the source and the date it was last recalculated.

Book a working session

Questions and answers

Do I have to register, and where?

Yes, if you are an essential entity, an important entity or a domain-name registration service provider. Article 44 Cbw requires you to supply the data for the national register, and Article 27 of the Cyberbeveiligingsbesluit sets out what: whether you are registering as essential, important or as a domain-name registration service provider, your KvK number, your entity type and your domain names. Registration is through MijnNCSC using eHerkenning or SSO-nRijk, and has been mandatory since 15 August 2026. Changes such as a merger or an IP-range change must be notified within two weeks. Failure to register can trigger a fine or a last onder dwangsom.

Is my company in scope if it has fewer than 50 employees?

Usually not. The baseline is medium-sized, meaning at least 50 staff or more than €10 million turnover or balance sheet. But size is irrelevant for government bodies at every level, qualified trust service providers, TLD name registries, DNS service providers, providers of public electronic communications networks or services, and domain-name registration service providers. Size is also irrelevant where you are the sole provider in the Netherlands of a service essential to critical societal or economic activity, or where your disruption would significantly affect public safety, security or health, or create systemic risk.

Can a director be held personally liable?

Yes, in the administrative-law sense. Article 24 Cbw requires the board to approve the cybersecurity risk-management measures, supervise their implementation, and hold demonstrable knowledge evidenced by a training certificate. Section 15.5 of the Act, Articles 92 and 93, provides dedicated enforcement of Article 24, and individual board members can face a bestuurlijke boete or a last onder dwangsom personally. Article 32(5) NIS2 also allows a competent authority, as a last resort and for essential entities only, to temporarily prohibit a natural person from exercising managerial functions.

How high are the fines?

Essential entities: up to €10 million or 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. Important entities: up to €7 million or 1.4%, whichever is higher. The full Dutch toolkit is wider than fines: a security scan, a security audit, a binding instruction, last onder bestuursdwang, last onder dwangsom, an administrative fine, and enforcement against individual board members. For essential entities only, and only where prior enforcement has failed, a competent authority may temporarily suspend a certification or authorisation, or temporarily ban a director from management functions. Neither of those last two applies to public administration entities.

Is there a transition period?

Broadly, no. The duty of care, the notification duty and the registration duty all applied from 15 August 2026. The one express transitional window is Article 24: board members have two years, until 15 August 2028, to acquire and evidence the required knowledge, and new appointees have two years from appointment. Under the Wwke, designated critical entities get 9 months from designation for the risk assessment and 10 months for protective measures.

How fast must I report an incident?

Four steps for a significant incident. An early warning within 24 hours of becoming aware (Art. 26), a full notification with initial assessment within 72 hours (Art. 27), a progress report on request (Art. 28), and a final report within one month of the notification (Art. 29). Reports go to both the CSIRT, the NCSC, and your sectoral supervisor. Separately, Article 30 may require you to inform affected service users. Anyone, in scope or not, can make a voluntary vulnerability report under Articles 33 and 34.

We are a DORA entity. Do we ignore the Cyberbeveiligingswet entirely?

No, and this is where most implementation plans go wrong. Articles 22 and 31 Cbw remove your duty of care and your notification duty, but they do not remove you from the Act. You remain an essential entity and must still supply data for the national register under Article 44. You may separately be designated a critical entity under the Wwke, which DORA does not displace and which brings its own 9-month and 10-month clocks and a 24-hour disruption report. In the other direction, DNB requires financial institutions within NIS2 scope to report DORA incidents to the NCSC as well.

Wasn't the Netherlands late? What were the consequences?

Yes, 667 days. The Commission sent a reasoned opinion on 7 May 2025, one of nineteen Member States to receive one, and referred the Netherlands to the Court of Justice on 8 July 2026, alongside Ireland, Spain and France. The Netherlands was separately referred over the CER Directive. During the gap the directive could have direct effect against the state in some circumstances and the Wbni continued to apply. That is now resolved prospectively. Whether the Commission withdraws the referral following entry into force had not been announced as at 17 August 2026.

Glossary

  • Incident (Cyberbeveiligingswet)

    Een gebeurtenis die de beschikbaarheid, authenticiteit, integriteit of vertrouwelijkheid van opgeslagen, verzonden of verwerkte gegevens of van de diensten die via netwerk- en informatiesystemen worden aangeboden of toegankelijk zijn, aantast. De Cyber Resilience Act hanteert een andere definitie.

  • ICT-dienst

    Een dienst die volledig of hoofdzakelijk bestaat in de verzending, opslag, opvraging of verwerking van gegevens door middel van netwerk- en informatiesystemen.

  • Hoofdvestiging

    De plaats waar de beslissingen in verband met de maatregelen voor het beheer van cyberbeveiligingsrisico’s hoofdzakelijk worden genomen binnen de Europese Unie.

  • Grootschalig cyberbeveiligingsincident

    Een incident dat een dermate grote verstoring veroorzaakt dat het de capaciteit van een lidstaat om erop te reageren te boven gaat, of dat aanzienlijke gevolgen heeft voor ten minste twee lidstaten.

  • Gekwalificeerde vertrouwensdienst

    Een vertrouwensdienst die voldoet aan de toepasselijke eisen zoals vastgelegd in Verordening (EU) nr. 910/2014.

  • Gekwalificeerde verlener van vertrouwensdiensten

    Een verlener van vertrouwensdiensten die een of meer gekwalificeerde vertrouwensdiensten verleent en aan wie door het toezichthoudend orgaan de gekwalificeerde status is toegekend zoals vastgelegd in Verordening (EU) nr. 910/2014.

  • Essentiële entiteit

    Een essentiële entiteit als bedoeld in artikel 3, eerste lid, van de NIS2-richtlijn en bedoeld in de artikelen 8 tot en met 11 van deze wet.

  • Entiteit die domeinnaamregistratiediensten verleent

    Een registrar of een agent die namens registrars optreedt, zoals een verlener van privacy- of proxyregistratiediensten of een wederverkoper.

  • Entiteit

    Een natuurlijke persoon of rechtspersoon die is opgericht en erkend krachtens het nationale recht van de plaats van vestiging, die onder eigen naam rechten kan uitoefenen en aan verplichtingen kan worden onderworpen.

  • Enisa

    Het Agentschap van de Europese Unie voor cyberbeveiliging, opgericht bij Verordening (EU) 2019/881.