Does NIS2 apply to me? A first answer in four questions, with the legal article

By the Dutch government's estimate, over 8,000 organisations have been covered by the Dutch Cybersecurity Act since 15 August 2026, public bodies not counted, and far from all of them know whether they are among them. A customer calling you "NIS2-obliged" does not make you so: the act decides, through sector, size and a short list of exceptions. Answer the questions; every step names the legal article, and the outcome can be printed as preparation for the official self-assessment.

By Edward Hasekamp, founder of Exposentry · Published on October 26, 2026 · Updated on October 29, 2026

Is your organisation a public body?

This check assumes an organisation established in the Netherlands (article 4). The act designates a number of public bodies as essential entities regardless of size, and explicitly excludes some parts of government.

How this check works

The Dutch Cybersecurity Act has applied since 15 August 2026, without a general transition period, and divides organisations into essential entities (article 8) and important entities (article 12). Two criteria together decide where you stand: the sector in which you provide a service or activity and the size of your organisation. Annex 1 and 2 together list 18 sectors: eleven of high criticality, including public administration from question 1, and seven others. On top of that, the act designates a number of categories regardless of size: parts of government, DNS service providers, telecom providers, trust services and critical entities under the Critical Entities Resilience Act. And article 5 keeps Defence, the intelligence services, the Public Prosecution Service, the police and the safety regions outside it.

Size is counted according to the EU SME definition (Recommendation 2003/361/EC): employees in annual work units, including working owners, and partner and linked enterprises count too. A small company in a large group can therefore still be covered. The check assumes an organisation established in the Netherlands (article 4); where the group's head office is does not matter then. For DNS, cloud, data centre and CDN providers, MSPs and MSSPs, online marketplaces, search engines, social networks and registrars only the main establishment in the EU counts; if that is in another member state, that country's law applies. For telecom providers the country where they offer the service counts.

The outcome names the legal article at every step, so you can look it up. The Dutch government's official self-assessment remains the document for your file; that tool dates from October 2024 and follows the directive; the final text of the act is of a later date. What the act then asks of you, article by article and with the evidence on paper and the measurement from outside for each measure, is on the Dutch Cybersecurity Act page.

After the check: paper and measurement

The self-assessment is paperwork, and useful paperwork: it records whether and why the act applies to you. One part of the duty of care then asks for something else: knowing what your organisation actually exposes to the internet, and being able to show that, dated, as part of your substantiation. Exposentry measures that with OpenKAT, the open-source scanner that originated in the Dutch government and to which Edward Hasekamp contributes.

What such a measurement delivers, and where it stops, is in what an attacker sees of your domain and in why a scan on its own is not compliance.

Sources

Further reading