The Netherlands has officially switched on its national implementation of the EU’s NIS2 directive. The Cyberbeveiligingswet, which came into force today, imposes a sweeping set of obligations that extend well beyond the roughly 8,000 organisations that fall directly under its scope.
Estimates suggest as many as 1.5 million entities across the Dutch economy will feel the law’s impact indirectly through their position in supply chains. That cascading effect stems from a single provision: Article 21, which makes supply-chain security mandatory for regulated organisations. Companies must now verify that their vendors and subcontractors uphold adequate security standards, a requirement that effectively pushes compliance duties down the chain.
Three Core Duties and a 24-Hour Clock
For the organisations directly captured by the legislation, the framework rests on three pillars. First comes registration with the National Cyber Security Centrum (NCSC). Second, firms must exercise a comprehensive duty of care, implementing technical and organisational measures to protect their network and information systems. Third, and perhaps most demanding, is the
Security experts caution that ticking compliance boxes is not enough. Cyber resilience and risk management, they argue, need to be woven into daily operations as an ongoing process rather than treated as a one-off regulatory exercise.
Board Members Face Personal Liability
A notable shift concerns accountability at the top. Under the new law, company directors — referred to as bestuurders in Dutch law — can be held personally liable if negligence is proven. Violations also carry the threat of substantial fines.
With directors now facing personal liability, documenting your compliance efforts has never been more important. A free toolkit with 41 ready-to-use templates and checklists helps you demonstrate that your risk management is genuinely under control. Download the free Risk Assessment Toolkit
The Netherlands is not alone in tightening the screws on executives. Across Europe, regulators are moving in the same direction. In Ireland, Minister Jim O’Callaghan has recently drawn explicit links between digital resilience and economic prosperity, pointing to frameworks such as the Cyber Fundamentals Framework. German companies face their own pressures: breaches of cybersecurity requirements can void insurance coverage or trigger penalties under NIS2 and the GDPR.
Small Firms Caught in the Contractual Web
The supply-chain provision is where the law’s reach multiplies. Small and medium-sized enterprises that never expected to fall under NIS2 will nonetheless encounter contractual demands from larger clients requiring them to demonstrate compliance with the new standards. For many smaller operators, this means investing in security measures they previously had no reason to adopt.
Three Dutch service providers — Bizway, Guardian360 and NFIR — have already announced a joint offering to help organisations navigate the new requirements.
European Patchwork Remains Uneven
The Dutch launch is one piece of a broader European effort to harden digital infrastructure. Across the EU, NIS2 now spans 18 sectors, with penalties reaching up to €10 million or 2 percent of global annual turnover, whichever is higher.
Implementation progress varies widely by member state. Austria, for instance, still lacked a complete transposition law as of mid-2025, despite an estimated 4,000 companies being affected there. The Netherlands, by contrast, now has legal certainty.
Just as European regulators are raising the bar on compliance, UK businesses face their own tightening obligations. A free Health & Safety toolkit covering COSHH, PUWER and the Health & Safety at Work Act 1974 helps you stay ahead of inspections and avoid costly penalties. Get the free Health & Safety Toolkit
Regulatory momentum continues on other fronts as well. Germany’s Federal Office for Information Security (BSI) published technical guideline TR-03183 on 14 August 2026, addressing the Cyber Resilience Act (CRA). Manufacturers of digital products must comply with those specifications by 11 December 2027. The financial sector, meanwhile, is operating under the Digital Operational Resilience Act (DORA), in force since 17 January 2025, with key transition periods ending on 31 December 2026.
