NIS2 in the Netherlands
Cyberbeveiligingswet
Law in force since
- Law
- Cbw
- Authority
- Dutch Authority for Digital Infrastructure (RDI)
- Classes
- essentiële entiteit (essential), belangrijke entiteit (important)
- Register
- MijnNCSC
- ISO 27001
- Helps, not enough alone
- Self-check
- RDI NIS2-Zelfevaluatie
Know when the Netherlands changes its NIS2 rules
- One email when the law, the deadlines or the portal change.
The law
The Cbw took effect on 2026-08-15. It covers a little over 8,000 organisations.
- Name
- CyberbeveiligingswetCybersecurity Act
- In force
- 2026-08-15
- Text
- Read the Cbw
Who is in scope
Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.
The Dutch law keeps the Directive's size and class rules.
Also note
- Each sector has its own supervisor. The RDI supervises digital infrastructure, digital providers and ICT service management.
Registration
Registration has been mandatory since 2026-08-15. If you are in scope and not registered, register now.
- Portal
- MijnNCSC
- Rule
- Fixed deadline
- Deadline
- 2026-08-15
- You need
- eHerkenning at level EH2+ linked to your KvK number, plus an authorisation to register for the organisation.
- Changes
- Report changes to your data within 14 days
Incident reporting
- 24 hEarly warning
- 72 hIncident notification
- 1 monthFinal reportafter the notification
Send the reports to your CSIRT and your supervisor.
Measures and proof
- Essential
- The supervisor can order an audit by an independent, qualified expert at your cost.
- Important
- Supervision after the fact. The supervisor can act when it has indications of a breach.
The date
- Duties apply and registration is mandatory
Fines
The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.
| Class | Ceiling | At EUR 20m | At EUR 500m | At EUR 2bn |
|---|---|---|---|---|
| Essential | EUR 10m or 2% | EUR 10m | EUR 10m | EUR 40m |
| Important | EUR 7m or 1.4% | EUR 7m | EUR 7m | EUR 28m |
Other breaches carry a ceiling of EUR 1,000,000.