Almost two years later than intended, but it is here: on 7 July 2026 the Dutch Senate adopted the Cyberbeveiligingswet, the Dutch Cybersecurity Act, and on 15 August 2026 it takes effect. That turns NIS2 in the Netherlands from a directive you prepare for into a law you comply with. For more than 8,000 organisations, cybersecurity becomes a legal duty, with a regulator, reporting deadlines and fines.
#From European directive to Dutch law
NIS2 is the European directive that raises the bar on cybersecurity well beyond its predecessor. A directive only takes effect through national legislation, so the Netherlands had to transpose it. That should have happened by 17 October 2024; in the end it took until August 2026. The Cyberbeveiligingswet replaces the old Wbni (the Dutch Network and Information Systems Security Act) and passed parliament together with the law on the resilience of critical entities.
#Who is covered
The law covers organisations in eighteen sectors, from energy, drinking water and transport to healthcare, digital infrastructure and government. Within those sectors a size test applies: mid-sized and large organisations are covered, as a rule of thumb from roughly fifty employees or ten million euros in annual turnover. Some organisations, such as providers of essential digital services, are covered regardless of size.
The law distinguishes between essential and important entities. The duties are largely the same; the difference lies mainly in supervision (proactive for essential entities, after the fact for important ones) and in the fine ceilings. If you are unsure of your status, the FAQ from the regulator, the RDI, is the place to check.
#The three duties
1. The duty of care. You demonstrably manage cyber risks with appropriate measures: a current risk analysis, security of your network and information systems, a working incident procedure, business continuity and supply chain security. Demonstrably is the key word. Policy that sits in a binder but is not followed does not count as managing the risk.
2. The reporting duty. A significant incident triggers a tight schedule: an early warning within 24 hours, a full report with an initial assessment of severity and impact within 72 hours and a final report within a month. You will only meet those deadlines if you spot incidents quickly and have set up the reporting route in advance.
3. The registration duty. Organisations covered by the law register through mijn.ncsc.nl. Voluntary registration has been possible since October 2024; from 15 August it is mandatory.
#The board is on the hook
The Cyberbeveiligingswet places responsibility squarely with the board. Directors must approve the security measures themselves, oversee their implementation and undergo training so they can assess the risks. For serious negligence, board members can be held personally accountable. Formally, the days of delegating cybersecurity to IT and looking the other way are over.
The fines underline the point: up to €10 million or 2 per cent of global annual turnover for essential entities, and up to €7 million or 1.4 per cent for important entities.
#Where AI use meets the law
NIS2 never mentions AI, and yet AI sits right in the middle of it. AI tools are part of your attack surface and your data processing, and every AI vendor is part of the supply chain your duty of care must cover. An employee pasting customer data into a public chatbot creates exactly the kind of risk this law expects you to see, weigh and manage. And when it goes wrong, a data breach through an AI tool can be a reportable incident, with the 24-hour clock starting immediately.
The hard part: most organisations do not know which AI tools are in use. You cannot manage what you cannot see. How NIS2 and AI use come together is covered in NIS2 and AI.
#What to do now
- Establish whether you are covered, and whether you count as essential or important.
- Register through mijn.ncsc.nl. The first formal step, and the easiest one.
- Update your risk analysis, including the supply chain and AI use in everyday work.
- Set up the reporting route. Who assesses an incident and who reports it? Can you meet the 24-hour deadline?
- Involve the board. Approving the measures and undergoing training are not formalities but legal requirements.
Getting a view of AI use does not have to be manual work. BeeSensible shows which AI tools are in use, how often and at what risk, checked against a catalogue of over 1,000 assessed tools.
#Substantiating your measures without the busywork
The common thread in the Cyberbeveiligingswet is demonstrability. Taking measures is not enough; you have to be able to show they work. That is where most organisations get stuck, because collecting evidence is manual work that has to happen on top of the day job.
BeeSensible draws that evidence from the work itself: which AI tools are in use, which sensitive data was highlighted before it left the building and how it was handled. Always as counts, never the text and never an individual. The Accountability screen sets those figures, per month or quarter, against NIS2 Article 21(2)(a), (d) and (g) (Article 21(3) of the Cyberbeveiligingswet in the Netherlands), and shows for each provision what BeeSensible contributes and what lies outside its reach.
The first step takes an afternoon: register on mijn.ncsc.nl and write down which AI tools are in use today. The rest of the duty of care builds on that.
