The Cyber Security Act (Cyberbeveiligingswet), the Dutch implementation of the European NIS2 directive, has been in force since 15 August 2026. From that date, the duty of care, notification duty, registration duty and management responsibility apply to more than 8,000 organisations in the Netherlands.
Does your organisation fall within the target group, or do you supply to a company that does? Then read here what already applies and what you need to arrange in the short term.
What exactly has changed?
After a long parliamentary process, the House of Representatives adopted the bill on 15 April 2026, followed by the Senate on 7 July. Since 15 August, the Cyber Security Act and the Critical Entities Resilience Act are officially in force.
That means we are now in the enforcement phase. The designated supervisory authorities actively supervise through audits and inspections, and organisations that do not yet meet the requirements run a real risk of sanctions.
Who does the Cyber Security Act apply to?
The act affects organisations in 18 sectors, from energy and healthcare to digital services and government. In total, around 8,000 Dutch organisations will directly face the new obligations, classified as "essential" or "important".
Do you not fall directly under the act? You can still be confronted with it through your customers. Organisations that do fall under the Cyber Security Act are obliged to screen their suppliers on cybersecurity. As an SME, you can therefore still face audits or contractual requirements through supply chain responsibility, even if you are outside the direct target group.
What do you need to arrange now?
Four obligations are central:
Registration duty
Organisations that fall under the act must register in the entity register via MijnNCSC.
Duty of care
You map the risks for your network and information systems and take appropriate measures to manage them.
Notification duty
A significant incident is reported within 24 hours with an early warning, followed by a full notification within 72 hours.
Management responsibility
The board approves the measures and supervises their implementation.
Directors get a direct role — including a training obligation
One of the most concrete changes of the Cyber Security Act: cybersecurity is no longer just an IT matter, but explicitly a board task. The board must formally approve the security measures and supervise their implementation.
There is a hard deadline attached: directors must demonstrably have sufficient knowledge and skills to assess cybersecurity risks no later than two years after the act enters into force. This is done through training, after which the director receives a certificate. The government does not prescribe a fixed provider — the training can be taken externally or organised internally, as long as it meets the legal requirements.
For essential entities, a supervisor can, in case of serious and persistent shortcomings, go further than a fine on the organisation: a director can then also personally receive a direction or fine, and in the most extreme case be temporarily removed from a management position.
What can ICT Teamwork do for you?
The duty of care sounds abstract, but in practice it comes down to concrete measures: risk management, access security, incident response and awareness within your organisation. As an ISO 27001-certified IT partner we already have that foundation in place, and we help you set up the same structure for your organisation.
Whether you fall under the Cyber Security Act yourself, or are confronted with its requirements through your customers: we are happy to think with you about what is concretely needed.
Next step
Where does your organisation stand?
Contact us via the form for a no-obligation conversation about where your organisation stands.
Contact usFrequently asked questions
From when does the Cyber Security Act apply?
Since 15 August 2026 the registration duty, duty of care, notification duty and management responsibility apply to the organisations that fall under the act.
Does the act also apply to SMEs?
Directly, not every SME falls under the act. But through supply chain responsibility you can still be confronted with requirements if you supply an organisation that does fall under the Cyber Security Act.
What happens if I do not comply?
Supervisory authorities can impose directions and fines on the organisation. For essential entities, in case of serious and persistent shortcomings, this can also personally affect a director, up to and including a temporary suspension from a management position.
Do directors have to do something themselves?
Yes. Directors must approve the security measures, supervise their implementation, and complete a mandatory training course with a certificate as proof no later than two years after entry into force.
Where do I register my organisation?
Via the entity register of the NCSC (National Cyber Security Centre).
Can ICT Teamwork help with the duty of care?
Yes. As an ISO 27001-certified partner we help you with risk management, access security and the other measures required by the duty of care. Contact us for a no-obligation conversation.