Cybersecurity Act and Critical Entities Resilience Act to take effect from August 15, 2026

On July 7, the Senate approved the Cybersecurity Act and the Critical Entities Resilience Act (Wwke). With this, the Netherlands is taking an important step in strengthening the digital and physical resilience of organizations against increasing threats.

NIS2 and CER directives

Since January 2023, the Dutch government has been working on the national implementation by translating the guidelines into Dutch legislation. The NIS2 directive is being implemented in the Cybersecurity Act (Cbw) and the CER directive in the Critical Entities Resilience Act(Wwke).

The Cybersecurity Act

The Cybersecurity Act implements the European NIS2 Directive in the Netherlands and replaces the current Security of Network and Information Systems Act (Wbni). The Cybersecurity Act applies to organizations that provide essential or important services. The act oversees organizations from 18 sectors, including energy, drinking water, digital infrastructure, healthcare, government, and transport. The act applies to more than 8,000 organizations in the Netherlands.

The Critical Entities Resilience Act

The Critical Entities Resilience Act (Wwke) implements the European CER Directive in the Netherlands. The purpose of that directive is to protect critical infrastructure and economic activities in Europe as effectively as possible against all kinds of threats, such as the consequences of terrorist offenses, sabotage, and natural disasters.

The Wwke applies to approximately 500 organizations, including at least the following sectors: energy, transportation, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, government, aerospace, nuclear, chemicals, flood control and management, meteorology, and food production, processing, and distribution.

Organizations are responsible for determining whether they are subject to the Cybersecurity Act. Through the NIS2 Self-Assessment You can determine whether the law applies to your organization. Under the Wwke, organizations are designated.

New Requirements

Organizations subject to the Cybersecurity Act will face, among other things:

• Oversight and Enforcement: Supervisors check whether organizations comply with the regulations. comply with the obligationsfrom the Cyber Security Act.
• Registration requirementOrganizations must be registerin the entity register via the National Cyber Security Center (NCSC).
• Duty of CareOrganizations must measuresThey must take these measures to prevent incidents or to limit their consequences.
• Reporting requirementOrganizations must significant incidentsReport to their CSIRT and the competent authority within the legal deadlines via the reporting portal.
• Administrative responsibilityThe board is ultimately responsible for cyber risk management. Board members must have the following: sufficient knowledgeTo be able to assess risks and security measures and to provide appropriate training for this purpose.

Don't wait—start getting ready

Does your organization fall under the cyber security act? Then registration with the National Cyber Security Centre is mandatory from August 15. The national government is calling on organizations to start now: the risks for which the law is intended already exist today. Make sure you are ready on time and Start preparing for registration now.