Netherlands Cybersecurity Act implementation

The Dutch Cybersecurity Act (Cbw), which implements the European NIS2 directive, officially entered into force on August 15, 2026. The legislation imposes new digital security and reporting obligations on approximately 8,000 organizations across the Netherlands.

Under the new framework, affected entities—including those in the transport and healthcare sectors—must manage network and information system risks and report significant incidents within legal timeframes. The law applies to organizations with more than 50 employees or those exceeding 10 million euros in annual turnover and balance sheet.

A significant feature of the act is the emphasis on accountability; board members and executives are held personally liable for the cybersecurity posture of their organizations and their supply chains. Enforcement will be managed through inspections and interviews, with the Human Environment and Transport Inspectorate (ILT) overseeing roughly 1,800 organizations in the transport sector. Experts note that compliance requires active oversight of third-party vendors and continuous risk management rather than static certifications.