NIS2 Netherlands: Cyberbeveiligingswet, Deadlines & Authorities
The Dutch Cyberbeveiligingswet (Cbw) transposes NIS2 and has applied since 15 August 2026. More than 8,000 organisations are in scope. Registration, the duty of care and incident reporting all started on day one — but the board-competence requirement runs on a two-year clock to 15 August 2028, and the ten digital entity types that feed the ENISA register had until 15 September 2026 to file, with a rolling one-month clock for any organisation that later becomes one of them.
Introduction: NIS2 Directive & the Dutch context
The Netherlands has transposed NIS2 through the Cyberbeveiligingswet (Cbw), published as Staatsblad 2026, 187. It applies from 15 August 2026, together with the Cyberbeveiligingsbesluit (Staatsblad 2026, 189), the decree that fills in the detail. The Wet weerbaarheid kritieke entiteiten (Wwke), which implements the CER Directive, starts the same day.
The Cbw replaces the Wbni (2018) and covers more than 8,000 organisations, many of which had no cybersecurity obligations before. The Netherlands missed the 17 October 2024 transposition deadline, and on 8 July 2026, one day after the Senate approved the bill, the European Commission referred it to the Court of Justice of the EU along with Ireland, Spain and France. The Act took effect five weeks later.
What you must do in the Netherlands
Five obligations, in the order they hit you. Four applied from 15 August 2026; the fifth runs on a two-year clock.
- Work out whether you are in scope, and whether you are an essential or an important entity. The Cbw applies automatically; nobody sends you a letter.
- Register on MijnNCSC. You need eHerkenning at level EH2+, linked to your KvK number, plus an authorisation to act for the organisation. Government bodies use SSOnRijk. The duty applied from 15 August 2026 and NCSC treats in-scope organisations as required to be registered from that date. The ten digital entity types also had to file for the ENISA register by 15 September 2026, and one that qualifies later has one month from qualifying. See Registration.
- Meet the duty of care from day one. The risk-management measures had to be in place on 15 August 2026. The Cyberbeveiligingsbesluit works them out in Articles 6 to 18, except for the ten digital entity types and trust service providers, for whom Implementing Regulation (EU) 2024/2690 applies instead (Besluit, Article 4). Your ministry's regulation adds sector detail.
- Be able to report an incident within 24 hours. The clock is short and it starts when you become aware. See Incident reporting.
- Get your management body trained, and keep the certificate. The board approves the measures (Article 24(1)) and each executive board member must hold a certificate evidencing training (Article 24(5)); NCTV confirms that non-executive and supervisory directors are not covered. For a municipality the board is the college of burgemeester en wethouders (Article 24(12)). This one has a runway: Article 24(3) gives each member two years — so 15 August 2028, or two years from appointment for anyone appointed later.
NIS2 implementation in the Netherlands
The Netherlands implements NIS2 through the Cyberbeveiligingswet (Cbw). The Act:
- replaces the Wbni (2018),
- extends the scope to more than 8,000 organisations,
- adds obligations for governance, risk management and supply-chain security,
- strengthens the supervisory powers of the Dutch regulators,
- sets binding deadlines for reporting cybersecurity incidents.
Status
In force since 15 August 2026. Approved by the Tweede Kamer on 15 April 2026 and by the Eerste Kamer on 7 July 2026, published as Staatsblad 2026, 187 with the Cyberbeveiligingsbesluit as Staatsblad 2026, 189. Commencement is set by Article 35 of the Besluit, which brought the whole Act into force on one date — the power in Article 107 to commence articles separately was not used. Neither the Act nor the Besluit has been amended since; the consolidated texts on wetten.overheid.nl still show the 15 August 2026 versions.
Official law
Cyberbeveiligingswet — Staatsblad 2026, 187 and the Cyberbeveiligingsbesluit — Staatsblad 2026, 189. The Cbw replaces the Wbni (2018).
Key change
NIS2 brings a much larger scope of essential and important entities, including digital infrastructure, healthcare providers, manufacturing, waste management, postal services, cloud & MSPs.
NIS2 Netherlands: what you need to know about compliance & supervision
The Netherlands follows the NIS2 essential/important entity model. The Cbw sets the duties; the Cyberbeveiligingsbesluit works the duty of care out into ten measures across Articles 6 to 18, and the thresholds that make an incident "significant" are set per sector by ministerial regulation.
Scope criteria
- Organisations operating in sectors listed in Annex I or II of NIS2.
- Medium-sized and large organisations: at least 50 staff, or annual turnover and balance sheet total both above €10 million. Large organisations in Annex 1 sectors are essential; medium-sized ones, and Annex 2 organisations, are important.
- Covered whatever their size: qualified trust service providers, TLD name registries and DNS service providers (essential), and smaller public electronic communications providers and trust service providers (important). Cloud, data centre and managed service providers are not size-exempt.
- Government: ministries, central-government ZBOs, provinces, municipalities, water boards and joint arrangements are essential entities by law, with no size test (Article 8(1)(g) and (h)).
- Critical entities designated under the Wwke are essential entities (Article 8(1)(i)).
- Out of scope under Article 5: Defence, the intelligence and security services, the Public Prosecution Service, the police and the safety regions.
Core obligations
- Risk management & security policies (IT/OT)
- Incident detection, reporting & response
- Business continuity and crisis procedures
- Supply-chain & vendor security controls
- Encryption, access control, patching, vulnerability management
- Board-level accountability & training
Standards & certification
No certificate is required, and NCTV states that a certificate or label has no independent legal status for compliance. Some sectors do have binding yardsticks: the ministerial regulations require government bodies and water boards to run an ISO/IEC 27001:2023 management system and use the ISO/IEC 27002:2022 controls and BIO2, and require health-care measures to demonstrably meet NEN 7510, or ISO/IEC 27001 and 27002, or an equivalent level. Elsewhere ISO 27001 is the natural framework. What is assessed is the measures, not the certificate.
Registration: who, where, by when
Registration is a legal duty, not an invitation. It opens and becomes mandatory on the same day the law starts.
Where
Mijn.NCSC.nl, the national entity register run by the NCSC.
Login
eHerkenning at level EH2+, tied to your KvK number, plus an authorisation to act for the organisation. That is NCSC's requirement as operator of the register; RDI's guidance says level 3, and a higher level works for either. Connected central-government bodies use SSOnRijk, which has to be enabled once by your department.
When
Mandatory since 15 August 2026, and NCSC treats in-scope organisations as required to be registered from that date. Article 44 sets no separate deadline; Article 47 sets one for the digital entity types — see below. Changes go in within 14 days.
What the register asks for:
- Organisation name and address, and your KvK number — pulled automatically from the login
- Whether you are registering as an essential entity, an important entity or a domain name registration service provider (Besluit, Article 27)
- The sector and type of entity under Annex 1 or 2
- The EU member states where you provide your services
- Current contact details for cybersecurity matters
- Public IP addresses and ranges, domain names and AS numbers
Two registers, and only one of them has a deadline
This is the distinction most guidance misses, and it decides whether you were already late.
- The national register (Article 43-44). Every essential entity, important entity and domain name registration service provider files here. The Act sets no explicit date — the duty simply applies. The register itself had to exist within a month of commencement (Article 98).
- The ENISA register (Article 47). Ten entity types also feed the European register: DNS service providers, TLD name registries, cloud computing providers, data centre providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, online search engines and social networking platforms — plus domain name registration service providers under Article 47(2). Article 47(4) gives them one month from the date those provisions took effect. The Besluit commenced the Act on 15 August 2026, so that deadline was 15 September 2026. The same paragraph keeps the clock running: an entity that qualifies as one of these types later has one month from qualifying. Neither NCSC nor RDI publishes the date; it follows from Article 47(4) read with Article 35 of the Besluit. Changes to this data run on a three-month clock, not the 14 days that applies to the national register.
Incident reporting in the Netherlands
A significant incident is one that seriously disrupts your services, causes financial loss, or can cause substantial harm to other organisations. The thresholds are set per sector in six ministerial regulations, one for each ministry's sectors, and for the ten digital entity types and trust service providers in Implementing Regulation (EU) 2024/2690, so check your own. You file once, at the central reporting point on MijnNCSC: that single submission reaches your sectoral CSIRT and your supervisor, and you do not notify them separately.
Two things come back to you. Your CSIRT responds to the early warning without delay and, where possible, within 24 hours (Article 36(1)) — NCSC commits to 24 hours in any case — with initial feedback and, on request, guidance or operational advice. Your supervisor receives the same report and uses it for supervision. If the incident looks criminal, the CSIRT explains how to take it to law enforcement; if it has cross-border effects, the single point of contact informs the other member states and ENISA.
Two exceptions are worth knowing. A voluntary report — a near miss, or a smaller incident — goes only to the CSIRT and not to your supervisor. And if you are covered by a European sector regime with its own reporting rules, such as DORA or the electricity network code on cybersecurity, you may report through that route instead of the Cbw, on deadlines that can be shorter. If you are unsure which applies, ask your supervisor.
Reporting to the authorities is not the whole duty. Article 30 also requires you to tell the recipients of your services, without delay, about a significant incident that is likely to affect the service, and about the measures they can take against a significant cyber threat.
NIS2 timeline & key dates (Netherlands)
Sector-specific requirements (Netherlands)
- Energy: electricity, district heating and cooling, oil, gas and hydrogen. Supervised by RDI, not by ACM — a common mix-up, because ACM is the energy market regulator but has no NIS2 supervisory role.
- Healthcare: hospitals, laboratories, R&D of medicines, manufacture of medical devices and IVDs. Supervised by IGJ, with Z-CERT as the CSIRT since 6 October 2026. The Cyberbeveiligingsregeling voor de zorg requires your measures to demonstrably meet NEN 7510, or ISO/IEC 27001 and 27002, or an equivalent level, and treats an incident as significant if, among other things, a critical process is down for more than four hours.
- Transport and water: air, rail, water and road, plus drinking water, waste water and waste management. Supervised by ILT, except packaged drinking water, which the NVWA supervises; the water authorities have their own CSIRT, CERT-WM.
- Food: production, processing and distribution, supervised by NVWA.
- Digital infrastructure: data centres, DNS, IXPs, TLD registries, cloud hosting, CDNs, MSPs and MSSPs. Supervised by RDI, and the group most likely to fall under the Article 47 ENISA-register deadline.
- Public sector: ministries and ZBOs, provinces, municipalities and joint arrangements are all essential entities by law, supervised by RDI, with NCSC as their CSIRT. Their ministerial regulation makes an ISO/IEC 27001:2023 management system, the ISO/IEC 27002:2022 controls and BIO2 mandatory.
- Finance: banking answers to DNB and financial market infrastructure to AFM, with DORA taking precedence where it applies.
How the Dutch law differs from the NIS2 Directive
The Cbw follows NIS2 closely. Seven choices are worth knowing about because they change what you actually have to do.
| Area | What the Netherlands does |
|---|---|
| Almost no transition period | Registration, the duty of care and incident reporting all applied from 15 August 2026, where several member states phased theirs in. The exceptions are narrow but real: board competence runs to 15 August 2028 under Article 24(3), and higher education institutions designated under Articles 11 or 13 get 36 months from designation under Article 97. |
| Decentralised supervision | There is no single NIS2 regulator. The Act names a minister per sector as the competent authority (Article 15) and the inspectorate below does the supervising, so two organisations in different sectors answer to different bodies under the same Act. |
| One report, two recipients | Significant incidents must reach both the CSIRT and the supervisor, but the Netherlands built a single reporting point to do it. One submission on MijnNCSC discharges both; you do not file twice. |
| A certificate for the board | Article 24(5) does not merely require directors to be competent — it requires each of them to hold a certificate evidencing participation in training covering the Article 24(2) topics, and the Cyberbeveiligingsbesluit (Articles 20 to 22) fixes the training's content and what the certificate must show — the director's name, the dates, the topics and the provider — in Dutch or English. It sets no duration or level. |
| Local government is essential by law | Provinces, municipalities, water boards and joint arrangements are essential entities by operation of law, with no size test (Article 8(1)(h)). The Directive leaves local public administration to member states. |
| Personal fines for directors | A board member who does not meet the competence and certificate requirements can personally be fined up to €25,000 or given an order subject to a penalty payment (Articles 92 and 93). |
| A power to exclude suppliers | Under Article 21a the competent minister can require an essential or important entity to stop using products or services from a named state, entity or person in designated parts of its systems, on national-security grounds, and sets a period for replacing what is already in use. Public electronic communications providers are outside this article. |
Operating in more than one EU country?
This is where organisations most often get it wrong, and the Dutch register makes the distinction explicit.
Register once
DNS providers, TLD registries, domain name registration service providers, cloud computing providers, data centre providers, CDNs, managed service and managed security service providers, online marketplaces, online search engines and social networking platforms register only in the member state where their main establishment sits, and are supervised there (Article 4(3) and (4)).
Register in each country
Every other type of entity falls under the law of each member state where it is established, so a company established in the Netherlands and Belgium registers in both. Public electronic communications providers register where they provide their services, and public bodies in their own country. A significant incident has to be reported in each member state concerned.
Rules that are the same everywhere
For the digital and ICT entity types above and for trust service providers, Implementing Regulation (EU) 2024/2690 sets the technical requirements directly, and in the Netherlands it replaces Articles 6 to 18 of the Besluit for them (Besluit, Article 4). It is not transposed, so it reads identically in all 27 member states.
Penalties for non-compliance
The Netherlands applies the NIS2 ceilings, but only to breaches of the duty of care, the supplier-exclusion duty and the reporting chain (Articles 21, 21a and 25 to 30). Every other breach, failing to register included, is capped at €1 million. A fine comes together with or after a warning or another enforcement measure, and it does not take effect until the decision is final (Articles 80 and 87). Supervisors can also use an order subject to a penalty payment (last onder dwangsom).
- Essential entities: up to €10 million or 2% of the total worldwide annual turnover of the undertaking the entity belongs to, whichever is higher, for breaches of Articles 21, 21a and 25 to 30; up to €1 million for any other breach (Article 80).
- Important entities: up to €7 million or 1.4% of that turnover, whichever is higher, for the same breaches; up to €1 million otherwise (Article 87).
- Domain name registration service providers: up to €1 million (Article 91).
- Board members personally: up to €25,000, or an order subject to a penalty payment, for not meeting the competence and certificate requirements (Articles 92 and 93).
- Binding instructions and orders, audits by an independent expert at the entity's own cost, and for essential entities a monitoring officer the entity pays for (Articles 70, 72, 74, 83 and 85).
- For an essential entity that misses a final deadline: a request to suspend a certification or licence, and a court-ordered suspension of board members, entered in the Handelsregister. Government bodies are exempt from these (Articles 76 to 79).
Important entities are supervised after the event: these powers apply to them where the authority has evidence or an indication of a breach (Article 81).
How to prepare for NIS2 in the Netherlands
- Determine scope: identify whether you qualify as an essential or important entity.
- Register on MijnNCSC if you have not: the duty has applied since 15 August 2026.
- Perform a NIS2 gap assessment: compare existing controls to NIS2 requirements.
- Strengthen governance: ensure board accountability and assign security responsibilities.
- Update risk management: implement robust IT/OT security measures and monitoring.
- Review supply chain: update contracts to include supplier cybersecurity obligations.
- Prepare for reporting: set up incident detection and escalation procedures.
- Train staff & management: run awareness programs and tabletop exercises, and have every executive board member complete certified training before 15 August 2028.
- Document everything: evidence policies, procedures, controls and improvements.
Official links & resources
FAQ: NIS2 in the Netherlands
Has the Netherlands implemented NIS2?
What law replaced the Wbni?
Who supervises NIS2 in the Netherlands?
Which entities are in scope?
Does the Cbw require ISO 27001 certification?
Is there a grace period after 15 August 2026?
We operate in several EU countries. Do we register in each one?
Was there a registration deadline?
Do we have to report an incident twice, once to the CSIRT and once to the supervisor?
Do supervisory board members need the training certificate?
Sources & verification
Every date, figure, authority and article number on this page was read from the Staatsblad texts, the consolidated versions of the Act, the Besluit and the ministerial regulations on wetten.overheid.nl, or from NCSC, NCTV and RDI directly. The registration figures are NCSC's, as reported by Computable. Law-firm summaries and NIS2 trackers were used to decide what to check, never as authority.
| Source | Used for | Checked |
|---|---|---|
| Cyberbeveiligingswet, Staatsblad 2026, 187 | Scope (Articles 4, 5, 8 and 12), competent authorities (Article 15), supplier exclusion (Article 21a), governance and board training (Article 24), the reporting chain and customer notice (Articles 26 to 30, 36), the national and ENISA registers (Articles 43 to 47), enforcement and fines (Articles 69 to 93), evaluation (Article 94), higher education (Article 97), commencement power (Article 107); and the consolidated version, showing no amendment | 16 October 2026 |
| Cyberbeveiligingsbesluit, Staatsblad 2026, 189 | Commencement of the whole Act on 15 August 2026 (Article 35), CSIRT designation (Article 2), the additional register fields (Article 27), the ten duty-of-care measures (Articles 6 to 18) and their displacement for the digital entity types (Article 4), and the training and certificate requirements (Articles 20 to 22) | 16 October 2026 |
| NCSC — Cyberbeveiligingswet (NIS2), and its Registreren, Meldplicht and Toezicht pages | More than 8,000 organisations in scope; eHerkenning EH2+ and SSOnRijk; registration due from 15 August 2026 and the fields asked for; the cross-border registration rule; the single reporting point; the interim and progress reports; the trust-service and DORA exceptions; and the sector table of CSIRTs and supervisors (doorverwijsboom of 18 August 2026) | 16 October 2026 |
| NCSC — Informatiebrochure Cyberbeveiligingswet, February 2026 | Background on the sectoral CSIRTs, superseded on designation by the ministerial regulations below | 10 September 2026 |
| Ministerial regulations: Regeling cyberbeveiliging EZK, the KGG energy regulation, Cyberbeveiligingsregeling IenW, Regeling cyberbeveiliging LVVN, Cyberbeveiligingsregeling sector overheid, and Cyberbeveiligingsregeling voor de zorg (as amended from 6 October 2026) | Sector incident thresholds, binding standards for government, water boards and health care, the CERT-WM and Z-CERT designations, and IGJ as health-care supervisor | 16 October 2026 |
| Supervisor designation decisions under Article 68 (EZK, KGG, BZK sector overheid, IenW, LVVN) | RDI, ILT and NVWA as supervisors, including NVWA for packaged drinking water | 16 October 2026 |
| NCTV — veelgestelde vragen Cyberbeveiligingswet; RDI — registratieplicht | The training duty for executive directors only, the status of certificates and labels, enforcement of the registration duty, and RDI's eHerkenning level | 16 October 2026 |
| Computable, 14 August 2026 | NCSC's registration count on 13 August 2026 | 16 October 2026 |
| Wet weerbaarheid kritieke entiteiten commencement, Staatsblad 2026, 190, Article 19 | The Wwke entering into force on the same day as the Cbw | 10 September 2026 |
| Eerste Kamer, dossier 36764 | Tweede Kamer approval on 15 April 2026 and Eerste Kamer approval on 7 July 2026 | 10 September 2026 |
What this page deliberately does not state
- What became of the Court of Justice referral. The Commission referred the Netherlands on 8 July 2026 and the Act took effect on 15 August 2026. No withdrawal has been published as at the date above, so this page records the referral and the transposition and predicts nothing about the outcome.
- A general registration deadline. There is not one. Article 44 makes registration a standing duty that applied from 15 August 2026, and only the Article 47 cohort has a fixed date. Summaries that give a single national registration date for the Netherlands are describing a rule that does not exist.
- Any breakdown of the entities in scope. NCSC publishes "more than 8,000" and no split between essential and important entities, so neither do we, and no registration figure later than 13 August 2026.
- Any enforcement activity. None is documented as at the date above.