When does the Dutch Cybersecurity Act enter into force?

On 15 August 2026. The Senate adopted the act on 7 July 2026. From the entry into force, the registration, duty-of-care and incident-reporting obligations apply in full; no transition period has been announced.

What is the Critical Entities Resilience Act (Wwke)?

The Wwke is the Dutch implementation of the European CER directive and focuses on the physical resilience of around 500 critical entities, such as providers in energy, drinking water and transport. It enters into force together with the Cybersecurity Act on 15 August 2026.

How many organisations fall under the Cybersecurity Act?

More than 8,000 organisations across 18 sectors, including energy, drinking water, digital infrastructure, healthcare, government and transport. Through the supply-chain duty of care, the act also indirectly affects tens of thousands of suppliers to those organisations.

What should I have arranged before 15 August 2026?

Determine whether you fall under the act, register your organisation via the NCSC, set up your risk management and incident process, and make sure you can demonstrate your measures, including towards customers that question you as a supplier.

Does the entry into force make any specific tool mandatory?

No. The act requires appropriate and proportionate measures but does not prescribe any product. You decide how you meet the requirements; continuous monitoring is a demonstrable building block, not a legal obligation in itself.

Back to knowledge base

Dutch Cybersecurity Act final: NIS2 applies in the Netherlands from 15 August 2026

Published on July 7, 2026

It is final. On 7 July 2026 the Dutch Senate adopted the Cybersecurity Act (Cyberbeveiligingswet) and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten), and the government has set the entry into force at 15 August 2026. The era of target dates and caveats is over: NIS2 becomes enforceable law in the Netherlands, with a hard date just over five weeks away.

What exactly enters into force?

Two acts at the same time:

The Cybersecurity Act (Cbw) implements the European NIS2 directive and replaces the Network and Information Systems Security Act (Wbni). The act affects more than 8,000 organisations across 18 sectors, including energy, drinking water, digital infrastructure, healthcare, government and transport.
The Critical Entities Resilience Act (Wwke) implements the European CER directive and focuses on the physical resilience of around 500 critical entities.

For most organisations, and certainly for their suppliers, the Cybersecurity Act is the one that matters in practice.

Which obligations apply from 15 August?

From the entry into force, organisations under the Cybersecurity Act must comply with:

Registration obligation. Register in the entity register via the NCSC (mijn.ncsc.nl).
Duty of care. Appropriate and proportionate measures to manage security risks and prevent incidents, explicitly including supply-chain security.
Reporting obligation. Report significant incidents to the CSIRT and the competent authority, with an early notification within 24 hours.
Board accountability. The board approves the measures, oversees them and follows appropriate training.
Supervision and enforcement. Regulators can inspect from day one.

No transition period has been announced. The obligations apply in full as of 15 August 2026.

What does this mean for suppliers?

For many SMEs, this is the real news. The duty of care explicitly covers the supply chain: the 8,000 organisations under the act must be able to demonstrate that they manage the risks posed by their suppliers. That translates into supplier questionnaires, contract requirements and audits.

If you supply software, hosting, data or services to an organisation covered by the act, that request will land on your desk sooner or later, even if you formally fall outside the scope yourself. What is expected of you is covered in the NIS2 supply-chain duty of care: what is really required and, specifically for suppliers, in NIS2 supply-chain duty of care for suppliers. Already receiving questionnaires? Then answering a NIS2 supplier questionnaire helps.

What the act does not do

Even with a hard date, what we wrote earlier still holds: the act mandates no specific tool or SaaS whatsoever. Anyone using the entry into force to sell a product as "legally required" is selling urgency instead of facts. The act requires goals: know your risks, take measures, report incidents and be able to demonstrate all of it. How you meet those goals is up to you. Why even a good scan does not make you compliant is explained in scanning is not NIS2 compliance.

Five things to arrange before 15 August

Determine your position. Do you fall directly under the act (sector plus size), or indirectly via customers that do? The Dutch government offers a self-assessment tool; the NCSC publishes the list of sectors.
Register. If you fall under the act, register your organisation in the entity register via mijn.ncsc.nl. The government explicitly names this as the first priority.
Map your attack surface. You cannot manage risks you do not see. Start with what an attacker sees of your domain.
Include your chain. Inventory critical suppliers and record which baseline requirements you set for them. See how to monitor this at Monitor my suppliers.
Make it demonstrable. Make sure you can show what was found, when, and what happened with it. That evidence is what a regulator, auditor or customer wants to see.

Exposentry helps with steps 3 to 5: continuous, forensically substantiated monitoring of your own domains and your supplier chain, based on OpenKAT. Not a compliance guarantee, but a demonstrable building block for your duty of care. You can see where you stand today: start a scan of your organisation.

Source

Rijksoverheid, "Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf 15 augustus 2026 van kracht", 7 July 2026, rijksoverheid.nl

Written by Edward Hasekamp, founder of Exposentry and core maintainer of the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides NL-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.