NIS 2 Status in the Netherlands
The Netherlands transposed the EU NIS 2 Directive through the Cyberbeveiligingswet (Cbw). The law came late and has applied since 15 August 2026, with no transition period.
Overview
The legal foundation is the EU NIS 2 Directive (2022/2555). It sets the floor for cybersecurity obligations across every member state. The Netherlands wrote that floor into national law through the Cyberbeveiligingswet (Cbw), which replaced the older Wbni (Wet beveiliging netwerk- en informatiesystemen) that implemented NIS 1.
The 17 October 2024 EU transposition deadline was missed by the Netherlands and by most member states, including Germany. The Dutch bill went through public consultation in 2024, was submitted to the Tweede Kamer in June 2025, and was adopted as the Law of 8 July 2026 (Staatsblad 2026, 187). The Commission referred the Netherlands to the Court of Justice of the EU on 8 July 2026, one month before the Cbw took effect on 15 August 2026.
The Cbw and its implementing decree, the Cyberbeveiligingsbesluit (Staatsblad 2026, 189), entered into force on 15 August 2026 with no transition period, mirroring how Germany handled BSIG. The adopted Cbw, together with the EU directive, is now the reference when scoping work.
EU Directive
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2).
Sets risk management obligations (Art. 21), incident reporting (Art. 23), management body accountability (Art. 20), and registration of entities (Art. 3(4)). Member states must transpose into national law but cannot go below the floor.
EU Implementing Regulation
Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 (CIR).
Specifies in detail what Art. 21 measures look like for DNS providers, TLD registries, cloud, data centre and CDN providers, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers. Directly applicable in the Netherlands without further national act.
Dutch Transposition
Cyberbeveiligingswet (Cbw), Law of 8 July 2026 (Staatsblad 2026, 187), in force since 15 August 2026; it replaced the Wbni.
Cbw assigns supervision and CSIRT roles, defines essential and important entities for the Netherlands, and adds national specifics such as fees, designation procedures and sector handovers. Its implementing decree, the Cyberbeveiligingsbesluit (Staatsblad 2026, 189), entered into force with it on 15 August 2026.
Cyberbeveiligingswet (Cbw)
Transposes NIS 2 into Dutch law and has applied since 15 August 2026. Defines essential (essentiële) and important (belangrijke) entities, sets supervisory powers, fines and incident reporting procedures, and integrates the EU CIR by reference.
RDI, sector regulators, NCSC-NL
Supervision is split by sector: the Rijksinspectie Digitale Infrastructuur (RDI) for digital infrastructure, digital providers, ICT service management, energy and government; ILT for transport, water and chemicals; DNB for banking; AFM for financial market infrastructure; NVWA for food. NCSC is the CSIRT for most sectors.
EU deadline missed, registration via the Dutch portal
The 17 October 2024 EU deadline passed without Dutch transposition. Since 15 August 2026, entities in scope must register in the national entity register on MijnNCSC (mijn.ncsc.nl), logging in with eHerkenning, and report changes without delay and within two weeks. Significant incidents go to both the CSIRT and the supervisor within 24 hours (early warning) and 72 hours (full notification), in line with Art. 23 NIS 2.
National law follows where you are established
An entity falls under the country where it is established. Only some digital providers (cloud, data centres, managed service providers, online marketplaces and similar) fall under the country of their main EU establishment, and telecoms providers fall under each country where they provide services (Art. 26(1) NIS 2).
The directive is the floor, never the ceiling
The Cbw cannot fall below NIS 2. It can be stricter on national specifics (designation procedures, fees, sector lists). For risk management measures and incident reporting, the EU text and CIR set the substance; the Dutch act adds the procedural wrapping.
Rijksinspectie Digitale Infrastructuur (RDI)
The supervisor for digital infrastructure, digital providers, ICT service management, energy, space, post, manufacturing and government. The competent authority in law is the responsible minister. Successor to Agentschap Telecom; sits under the Ministry of Economic Affairs.
NCSC-NL (Nationaal Cyber Security Centrum)
National CSIRT under the Ministry of Justice and Security. Receives incident notifications under Art. 23, runs sector advisories, and coordinates with ENISA and other national CSIRTs. Since 1 January 2026 the Digital Trust Center has been part of NCSC, which is now the single contact point for digital resilience and the CSIRT for most Cbw sectors. It runs the entity register on MijnNCSC.
ENISA
Issues EU-level guidance and technical implementation reports. Not a regulator of Dutch entities. Its Technical Implementation Guidance on the CIR (with crosswalks to ISO 27001) is written for the digital providers the CIR covers; other entities can use it as a reference.
Dutch NIS 2 mirrors the German BSIG one to one.
Both transpose the same directive, but the texts differ. The Netherlands keeps a stronger sector-regulator model and uses RDI as a horizontal supervisor; Germany channels almost everything through BSI. Penalty levels, registration mechanics, and management training duties are written differently. Read Cbw on its own terms, not as a translation of BSIG.
There is no Dutch registration obligation yet, so we can wait.
Art. 3(4) NIS 2 requires every member state to maintain a register and entities to provide their data. Registration has been mandatory in the Netherlands since 15 August 2026, with no grace period: entities in scope register in the national entity register on MijnNCSC, which the Minister of Justice and Security keeps (Art. 43 Cbw). Changes are due without delay and in any event within two weeks of the date of the change (Art. 44(2) Cbw).
My sector regulator handles everything, RDI is not relevant.
Supervision under the Cbw is split by sector: DNB for banking, AFM for financial market infrastructure, ILT for transport, water and chemicals, NVWA for food, and RDI for digital infrastructure, energy, government and several other sectors. For DORA-covered financial entities, DORA acts as lex specialis on cybersecurity, but NIS 2 registration under Art. 3(4) still applies.
Most Dutch entities in scope already knew they would be in scope. The Cbw has applied since 15 August 2026 with no transition period, so two things matter now: registration in the entity register on MijnNCSC, and any communication from the supervisor for your sector that settles scoping.
Operationally, four constant duties apply under the Cbw, which transposes these EU articles: govern security with management accountability (Art. 20), run risk management measures (Art. 21), report significant incidents on the 24 hour and 72 hour clock (Art. 23), and register and keep the registration current (Art. 3(4)).
- Directive (EU) 2022/2555 (NIS 2): EUR-Lex, OJ L 333, 27 December 2022
- Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024
- Cyberbeveiligingswet (Cbw), Law of 8 July 2026, Staatsblad 2026, 187; Cyberbeveiligingsbesluit, Staatsblad 2026, 189
- Wbni: Wet beveiliging netwerk- en informatiesystemen (NIS 1 transposition, replaced by the Cbw on 15 August 2026)
- Rijksinspectie Digitale Infrastructuur (RDI), rdi.nl, NIS 2 supervisory information
- NCSC-NL, ncsc.nl, incident notification and CSIRT guidance
- ENISA, NIS 2 Technical Implementation Guidance, version 1.0, June 2025 (mapping table version 1.2, September 2025)
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
