Series
Blogs
Series
Blogs
Author: Lilianne Bunk
The Netherlands has recently implemented the NIS2 Directive. The new law is intended to strengthen the digital resilience of essential and important organisations, and includes personal liability for directors. We consider the implications as cybersecurity moves from the server room to the boardroom.
The NIS2 Directive
The NIS2 Directive is one of a range of new EU cyber instruments, which also includes the Digital Operational Resilience Act (DORA), the Critical Entities Resilience Directive (CER) and the Cyber Resilience Act (CRA). The NIS2 Directive is intended to strengthen the digital resilience of essential and important organisations across EU member states.
However, unlike many instruments in the EU Digital Package, NIS2 is a Directive and not a Regulation. This means it had to be implemented in each Member State, which has led to significant delays and infringement proceedings by the Commission against Ireland, Spain, France and the Netherlands.
In the Netherlands, the wait is over and the directive has been implemented through the Dutch Cybersecurity Act (Cyberbeveiligingswet (Cbw)) which entered into force on 15 August 2026. Although the Netherlands was almost two years late in implementing the NIS2 Directive, its arrival marks an important step for Dutch cybersecurity regulation. The delay reflected extensive parliamentary scrutiny, the need for amendments, the breadth of the Act itself, and the challenge of aligning it with related legislation such as the Dutch Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten).
Now, we identify three key themes that Dutch businesses and their boards should note: (1) the scope of this new law; (2) the core obligations it imposes, and (3) the director liability framework, particularly the mandatory training obligation.
The Cbw applies far beyond the traditional vital sectors covered by the original NIS1 Directive and its Dutch implementation, the Wet beveiliging netwerk- en informatiesystemen (e.g. energy and telecoms). The scope of the Cbw is considerably broader, and many organisations that previously fell outside Dutch cybersecurity regulation will now find themselves within it.
The Cbw mirrors the NIS2 Directive as regards the sectors in scope and does not extend that list. Those sectors include energy, transport, digital infrastructure, banking, financial market infrastructure, healthcare, drinking water, wastewater, chemicals, food and government. What these sectors have in common is that they support critical social or economic functions. Disruption in any of them can have serious effects on public safety, public health, the economy and other connected sectors.
Whether a particular organisation falls within scope depends on two factors: (i) the sector in which it operates and (ii) its size.
As a rule of thumb, organisations with more than 50 employees, or with an annual turnover or balance sheet total exceeding EUR 10 million, should assess whether they are required to comply. Smaller organisations that do not directly fall within the scope of the Cbw may nonetheless find themselves affected indirectly, through supply chain responsibility, as the larger parties in their network begin imposing stricter requirements on them.
The Cbw distinguishes between essential entities (e.g. large hospitals and energy companies) and important entities (e.g. mid-sized organisations in the same sectors). The dividing line is primarily one of size and sector. A number of entities are also designated as essential entities by operation of law regardless of size, including qualified trust service providers, top-level domain name registries, DNS service providers, and government ministries.
Essential entities face stricter supervision and potentially higher fines in the event of non-compliance, with penalties of up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. Important entities face fines of up to EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher. Both categories, however, share the same core obligation: the board bears ultimate responsibility.
Click the image to see the full version
The Cbw imposes the following four principal obligations on in-scope organisations.
Registration obligation (registratieplicht)
Organisations within scope must register with the Dutch National Cyber Security Centre (NCSC) via a dedicated online portal and provide data for the entity register. With this register, the European Union increases insight into the digital resilience of important and essential organisations. The NCSC registration form is limited to identifying and contact information.
However, recent news reports following the Act's entry into force indicated that a significant number of in-scope organisations had not yet completed their registration, underlining that many businesses still need to take action on this front. Given how far the Cbw's scope now extends, many organisations may simply not realise they are in scope at all, making a scope assessment the first step before registration can be considered.
Duty of care (zorgplicht)
Organisations within scope are subject to a duty of care to take measures to manage the risks to the security of their network and information systems, and to prevent incidents and their consequences. These measures must, among other things, cover risk analysis and information system security policy, incident handling, business continuity and crisis management and development and maintenance of network and information systems.
The duty of care is not a tick-box exercise. Boards should ensure that risk assessments are conducted systematically and that measures are proportionate to the risk profile of the organisation. Measures must be approved by the board, and it must also supervise their implementation.
Incident reporting (meldplicht)
The Cbw requires entities to report significant cyber incidents to their Computer Security Incident Response Team (CSIRT) and supervisory authority. An incident is significant if it could materially disrupt the continuity of an entity’s services, taking into account factors such as the number of people affected, the duration of the disruption and potential financial damage. The reporting process has three stages: an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours and a final report within one month.
Supervision (toezicht)
In-scope organisations are subject to supervision by an independent authority that will assess compliance with obligations under the Cbw. Supervision is allocated sector by sector: for example, the Minister of Economic Affairs supervises digital infrastructure and manufacturing entities, and the Minister of Finance supervises the banking and financial market infrastructure sectors. To simplify reporting for companies, however, the NCSC serves as the central point for incident notifications.
The Cbw introduces personal liability for directors and the accompanying obligation to acquire and demonstrate knowledge of cybersecurity. The board is required to formally approve security measures and actively supervise their implementation.
For years, digital security was a technical matter that rested with the IT department of companies or their external providers. The Cbw puts an end to that: cybersecurity is no longer solely an IT matter, but a board responsibility.
Mandatory training obligation
Under the Cbw, board members are expected to have sufficient substantive knowledge to engage meaningfully with internal or external specialists. The board remains ultimately responsible for the proper management of digital risks.
The Cbw goes so far as to prescribe a mandatory training obligation: every member of the board of an essential or important entity must have sufficient knowledge and skills to identify network and information system security risks, assess cybersecurity risk management measures, and assess the consequences of those risks and measures for the entity's services, and must hold a certificate evidencing participation in training covering these topics. Supervisory directors are exempted from this obligation, though this does not diminish their board-level engagement with the subject.
Existing board members have two years from the entry into force of this obligation (that is, until 15 August 2028) to comply with the training obligation and obtain a certificate. A board member appointed after that date must comply within two years of appointment. If a board member fails to comply, the competent authority may impose a penalty order (last onder dwangsom) requiring them to obtain the certificate within a set period, backed by increasing financial penalties for continued non-compliance. It may also impose an administrative fine, as explained below.
Personal liability of directors
The Cbw raises the stakes for directors by introducing the possibility of personal liability. The competent authority can now impose a separate administrative fine of up to EUR 25,000 directly on an individual board member for breach of the governance obligations in Article 24 of the Act, including the aforementioned training obligation.
The risk is not limited to regulatory fines. A director who does not complete the mandatory training within the two-year deadline will be in a much weaker position to argue that they exercised proper oversight of cybersecurity risk. If a significant incident occurs, that failure is likely to weigh heavily in any regulatory or civil assessment of whether the director met the required standard of care.
The Cbw also implements the NIS2 Directive’s power to seek the temporary suspension of directors. Where an essential entity fails to remedy a breach after the competent authority has exhausted its other enforcement measures, the authority may apply to the Dutch civil court for an order temporarily suspending one or more members of the entity’s board.
From our work with clients, we know that determining whether an organisation falls within the scope of the Cbw is often less straightforward than it may first appear. That is particularly true for groups with complex structures, such as multiple Dutch entities, operations across several European Union member states, or a footprint both within and outside the European Union. This is because scope not only depends on sector and size, but also on where the organisation’s main establishment is located for Cbw purposes. Identifying the main establishment and putting in place appropriate documentation to support this assessment can be a complex exercise.
In M&A transactions, we now routinely consider, as part of due diligence, whether a target or its group entities fall within scope of the Cbw (or an equivalent NIS2 implementation elsewhere in the EU), whether the required registration has been completed, and what exposure follows if it has not. Because supervisory authorities are still at an early stage of enforcement, and a settled practice on penalties has yet to emerge, the practical consequences of historic non-compliance remain uncertain. That uncertainty can make risk allocation and protection in transaction documents more difficult to assess and negotiate.
Looking ahead
The Cbw is no longer a future compliance milestone. It is now in force, and the enforcement timetable is already running, with supervisory authorities recommending that organisations register as soon as possible. At the same time, the Cbw sits within a broader and increasingly connected regulatory framework, including DORA, CER and the CRA’s new vulnerability reporting obligations. The overlap between an organisation’s obligations under the Cbw and these other regulatory instruments will also need to be considered.
For many organisations, compliance with the Cbw will therefore need to be approached as part of a broader resilience framework, rather than as a standalone legal exercise. Against that backdrop, the key question for in-scope businesses and their boards is no longer whether the Act applies, but whether they can demonstrate to regulators, courts and customers that they have taken it seriously. If you would like to discuss what the Cbw means for your organisation, please contact us.
Mainstream Corporate Partner, Amsterdam
Netherlands
Associate
Netherlands
Managing Associate, Amsterdam
Netherlands
TMT Partner, London
United Kingdom
TMT Partner, Paris
France
TMT Partner, Brussels
Belgium
German Head of TMT, Partner, Frankfurt
Germany
23 October 2026
