Netherlands Cybersecurity Act takes effect August 15

The Dutch Cybersecurity Act (Cbw) takes effect on August 15, imposing new digital security obligations on approximately 8,000 organizations nationwide. This legislation serves as the Dutch implementation of the European NIS2 directive.

In the transport sector, the Human Environment and Transport Inspectorate (ILT) will oversee roughly 1,800 essential and important organizations, including those in road, inland waterway, rail, and aviation transport. Affected entities face mandatory registration, care, and reporting duties, requiring them to manage network and information system risks and report significant incidents within legal timeframes.

Experts warn that companies should view the law as an opportunity to strengthen their digital foundations rather than merely a compliance exercise to avoid fines. A critical aspect of the law is the personal liability of board members if security measures are found to be insufficient. The ILT intends to conduct active enforcement through inspections and online interviews. If deficiencies are identified, organizations must develop and implement concrete improvement plans.