NederlandsDoes the Dutch Cybersecurity Act apply to you? Check and register before 15 August
On Saturday 15 August 2026 the Cyberbeveiligingswet takes effect, the Dutch implementation of the European NIS2 Directive. There is no transition period: the registration obligation applies immediately and is enforceable from day one.
An estimated 8,000 organisations in the Netherlands fall under this law. A good number of them do not yet know it.
Friday 14 August is the last working day to get this in order. Two steps will tell you where you stand. Together they take about half an hour.
Step 1. Check whether the law applies to you
1 Run the check on the NCSC website
The law covers eighteen sectors. In most cases a threshold applies as well: 50 or more employees, more than €10 million in annual turnover, or a balance sheet total above €10 million. Some organisations are covered regardless of their size, such as providers of public electronic communications networks and DNS service providers.
Sectors covered include
EnergyTransportDrinking waterDigital infrastructureICT service managementHealthPublic administrationPostal servicesWaste managementFoodChemicalsResearchManufacturingNot sure? The NIS2 self-assessment from the RDI, the Dutch Authority for Digital Infrastructure, also tells you whether you qualify as an essential or an important entity. Both the NCSC pages and the self-assessment are in Dutch only.
Step 2. Register your organisation
2 Sign up with the NCSC
Does the law apply to you? Then register your organisation in the national entity register. You do this yourself through Mijn NCSC, using eHerkenning or SSO-Rijk for connected government bodies. Registration takes five steps.
Have this ready
- Your organisation details, which are largely retrieved automatically from the Dutch Business Register
- Your sector or sectors, type of service, the EU member states you operate in, and your entity classification
- A named contact person for incident reporting
- Technical network details: IP addresses, domain names and AS numbers
Note: any change to your registration details must be reported within 14 days. That is a legal obligation too.
Operating internationally? You register in the member state where your main establishment or service provision is located. If you are active in several member states, a separate registration per country may be required.
Practical point: Mijn NCSC and eHerkenning are available in Dutch only, and eHerkenning is issued to your Dutch legal entity. Allow time for this if your organisation does not yet have it.
Either way, there is something to do
Both answers call for action. Just not the same one.
Covered by the law
Register with the NCSC before 15 August. After that, a duty of care and an incident reporting obligation apply as well.
Not covered
Expect questions from your clients. Organisations that are covered must manage the risks in their supply chain, and they will ask suppliers to demonstrate what they have in place.
We are happy to help
Not sure whether the law applies to you, or stuck partway through the registration? Get in touch with our service desk. We can help with the check, the sign-up and the next steps around your security measures and reporting duties.