Ongoing

The legislative proposal for the Dutch Cybersecurity Act (Cyberbeveiligingswet) (''Cbw''), which will implement the NIS2 Directive in the Netherlands, was submitted to the Dutch Parliament on 5 June 2025. A plenary debate in the House of Representatives is scheduled for 16 March 2026, and the bill has not yet been voted on.

• Closely modelled based on the NIS2 Directive. 
• The scope has been extended to local governments (e.g., the provinces, municipalities and water boards) which have been assigned the status of essential entities. Educational institutions can be assigned the status of essential or important entities in individual cases based on a ministerial decree. 
• The minister responsible for a particular sector may, based on a risk assessment, determine that the Cbw is applicable to a micro or small enterprise even though it does not meet the NIS2 size thresholds. This could be the case if it appears that the services of the enterprise are of crucial importance to the Dutch economy or society. In such cases, the enterprise will be informed of this by the relevant minister.  
• The explanatory memorandum to the Cbw proposal states that 'partner enterprises' and 'linked enterprises', as defined in Article 3 Recommendation 2003/371/EC, shall be included for determining the size of the entity. The employees and the financials of these partners and linked enterprises shall be included in the threshold. The Cbw does not take the degree of independence between the network and information systems of partner or linked enterprises into account. It is important to note, however, that each enterprise must independently determine whether it falls within the scope of the Cbw and that these entities must also comply with the obligations under the Cbw. Therefore, there may be multiple entities within a group of companies that qualify as essential entities or important entities and must comply with the obligations under the Cbw. 
• Essential and important entities must report significant incidents to both the CSIRT and the competent authority (the relevant Ministry in that sector). To make the reporting of cybersecurity incidents easier, a single notification portal will be set up by the Dutch Cybersecurity Centre (National Cyber Security Centrum), part of the Ministry of Justice and Security, to ensure cybersecurity incidents can be reported via a single notification to the CSIRT and competent authority. Entities that are not important or essential can report incidents on a voluntary basis to a CSIRT.
• The Annexes are, for the most part, similar to those in the NIS2 Directive, except for the ‘Public administration’ sector in Annex I and the ‘Postal and courier services’ and ‘Research’ sectors in Annex II.
• The Dutch Cybersecurity Decree (Cyberbeveiligingsbesluit) ("Cbw Decree") has been drafted to further detail the Dutch implementation of various NIS2 obligations. In particular, the Cbw Decree contains local requirements in relation to:
  • specific security measures that must be implemented to meet the cybersecurity duty of care imposed by the NIS2 Directive; 
  • periodic training of board members, who also have to obtain certificates evidencing completion of relevant cybersecurity training; 
  • requirements and thresholds for notifying cybersecurity incidents to the CSIRT and competent authority; and
  • information that has to be provided by essential and important entities for the national Cbw entity register.

On 21 November 2025, the Dutch government announced that it expects that the Cbw will enter into force in the second quarter of 2026, depending on the speed of the legislative process. This is also when the obligations under the Cbw will enter into force.