Cyberbeveiligingswet in force since 15 August 2026

The Cyberbeveiligingswet (Cbw), the Dutch implementation of NIS2, entered into force on 15 August 2026. The same applies to the Cyberbeveiligingsbesluit, which elaborates the law. For Dutch boards, this means the NIS2 obligations now apply. This article was first published in October 2024 and updated on 4 November 2026.

How did the law come about?

• 17 October 2024: the EU deadline for transposing NIS2 into national law. The Netherlands did not make it.
• Q3 2025: the expectation of the then government, as set out in its government programme. This was later postponed further.
• 15 April 2026: the House of Representatives passes the bill.
• 7 July 2026: the Senate passes the bill.
• 10 July 2026: the law and the decree are published in the Staatsblad, the Dutch official gazette.
• 15 August 2026: the law and the decree enter into force.

What is the Cyberbeveiligingswet?

The Network & Information Security (NIS) directive 2 was published in December 2022. It succeeds the ‘NIS’ directive, implemented in the Netherlands in 2016 in the Wet beveiliging netwerk- en informatiesystemen (Wbni). The Netherlands implemented NIS2 under the name Cyberbeveiligingswet.

The Netherlands was not the only country with delays. Belgium was early: its national law entered into force on 18 October 2024. Countries such as Denmark, France, Ireland and Spain were also behind in October 2024.

What should your organisation do now?

• Register: organisations must register with the NCSC via mijn.ncsc.nl.
• Duty of care: take measures to manage the risks to your network and information systems. Read more about how the duty of care is elaborated.
• Board: board members must have sufficient knowledge and take appropriate training. See our NIS2 boardroom training.

Not sure where your organisation stands? Read how we help with NIS2 compliance.