2025 was marked by stricter legislation and new standards frameworks for information security and privacy. Organizations faced higher demands, more responsibility, and stricter enforcement. In this retrospective, we highlight the most important developments of the past year.
Cybersecurity law
In the Netherlands, the European NIS2 Directive has been translated into the Cyber Security Act. This law imposes stricter requirements on essential and key entities. The law is expected to go into effect in Q2 of 2026. Key obligations:
- Duty of CareAn organization must be able to demonstrate that it has taken measures to prevent cyberattacks and limit their impact.
- Reporting requirementAn organization is required to report significant incidents to the competent authority. Incidents must be reported within 24 hours.
- Registration requirementAny organization that falls under the NIS2 directive must be registered with the competent authority for that purpose, the NCSC.
- Administrative responsibilityAnd oversight by the RDI. Fines can amount to €10 million or 2% of global turnover.
AI ACT
Since August 2, 2025, the first parts of the European AI Act have come into force. This law sets clear requirements for organizations that develop, offer, or use AI. The focus is on responsible and controllable AI use. Key obligations for organizations:
- Governance & oversight: clear rules, human oversight including, risk management & data transparency
- Risk Management: insight into used AI and continuous monitoring of risks
- Cybersecurity & reliability: safe, accurate and reliable AI systems
- Quality Management: maintains strict quality standards throughout the entire AI life cycle
- Impact Assessments: attention to human rights, ethics and legislation
- Roles & responsibilities: clear division of tasks around AI within the organization
BIO2
In 2025, BIO2 has been introduced for government organizations: the updated Baseline Information Security for Government. This further development better aligns with current laws and regulations and strengthens administrative accountability. What is new?
- Alignment with Cybersecurity Act(NIS2): This directly aligns BIO2 with European obligations for essential and important entities.
- In line with NEN-EN-ISO/IEC 27002:2022: Emphasis is placed on an explicitly risk-driven approach and working with an ISMS is mandatory.
- Operationalization of the duty of care:This enables regulators to objectively assess whether an organization is compliant.
- More managerial responsibility:Executives explicitly responsible for policies, reporting, and roles such as the CISO
Â
EU Data ACT
From September 12, 2025, the European Data Act will apply. This regulation changes how organizations handle data generated from digital products and services, such as smart devices and vehicles. The law strengthens the position of users and promotes fair data sharing. Key points:
- Right to own data:Users have access to the data they generate themselves
- Protection of SMEs:Ensuring against unfair contract terms
- Simple switching:Lower thresholds when switching cloud or software providers
- Government access:Only in exceptional emergency situations
- Security & data sovereignty:Data remains protected and within EU frameworks
DORAÂ
The Digital Operational Resilience Act (DORA) is a European regulation that strengthens the digital resilience of the financial sector. The focus is on managing ICT risks and increasing the cyber resilience of both financial institutions and their suppliers. Key obligations:
- Mandatory and periodic pentesting of digital resilience.
- Incident Report:Mandatory reporting of serious IT incidents to regulators
- Oversight of IT vendors:Large, critical service providers such as cloud providers fall under direct European oversight
- Understanding chain risks:Overview and evaluation of used IT suppliers
- Information sharing:Possibility to securely share information about IT incidents within the sector