Anyone responsible for information security in Dutch healthcare is working to two calendars. One belongs to NEN 7510: the revised standard from December 2024, with a certification window that closes in February 2027. The other belongs to the Cyberbeveiligingswet, the Dutch law implementing NIS2, which took effect on 15 August 2026 and covers healthcare too. Two developments, one underlying question: can you show that your protection of patient data actually works?
#What NEN 7510 is, and why there is no way around it
NEN 7510 is the Dutch standard for information security in healthcare, based on ISO 27001 and extended with healthcare-specific controls. Unlike most standards, it is not optional: for providers that process patient data electronically, the law makes NEN 7510 mandatory, including through the decree on electronic data processing by healthcare providers.
The Health and Youth Care Inspectorate (IGJ) supervises compliance and expects you to be able to show that you are working on a management system that meets the standard. Note the distinction: certification is not mandatory, but being able to demonstrate compliance is. A certificate is one way of doing that, not a goal in itself. In practice, though, partner organisations and purchasers of care increasingly ask for one.
#What changed in NEN 7510:2024
The revised standard was published on 16 December 2024, aligned with ISO 27001:2022. The structure has been simplified considerably: fourteen chapters became four themes (organisational, people, physical and technological), and the controls were consolidated into 93 general controls plus eight healthcare-specific ones. New controls cover cloud services, threat intelligence and data leakage prevention, topics that barely featured in the old 2017 version.
For organisations already on ISO 27001:2022, the switch is manageable. For those still on the old structure, it is more than a matter of rewording: the risk analysis, the statement of applicability and the internal audits all have to change with it.
#Then there is the Cyberbeveiligingswet
Healthcare is one of the eighteen sectors covered by the Cyberbeveiligingswet, which took effect on 15 August 2026. Mid-sized and large providers are subject to a duty of care, an obligation to report significant incidents and an obligation to register with the National Cyber Security Centre (NCSC).
Good news for anyone who has taken NEN 7510 seriously: the law's duty of care and the standard's management system overlap heavily. If you can show that you work to NEN 7510, most of the groundwork for the Cyberbeveiligingswet is already done. For the full picture of that law, see "The Netherlands has its NIS2 law".
#The blind spot: AI use with patient data
The standard covers systems, processes and roles. But the biggest day-to-day risk lies in something no process description covers: a clinician asking a public chatbot to summarise a referral letter, or pasting patient details into a prompt to get a report done faster. Patient data is special category data, and NEN 7510 demands strict control of exactly this kind of processing.
A policy that says "no patient data in AI" is a start, not a safeguard. You want to see which AI tools are actually in use, and you want a measure that works at the point where things go wrong: while someone types, before they send. How the standard and AI use fit together is covered in more depth in BIO and NEN 7510: AI and privacy in government and healthcare.
#What to do now
- Map the transition to NEN 7510:2024. New structure, updated risk analysis, statement of applicability and audits. Certified? Then aim to have switched well before 20 February 2027.
- Check whether the Cyberbeveiligingswet applies to you and register via mijn.ncsc.nl.
- Include AI use in your risk analysis. Which tools are used and with which data, and what has been decided about them?
- Make awareness practical. Not an annual e-learning module, but a cue at the moment someone types sensitive data somewhere.
- Organise your evidence. The IGJ, the auditor and soon the regulator under the Cyberbeveiligingswet all ask the same thing: show that it works.
Getting a view of AI use does not have to be manual work. The AI Governance module shows which AI tools are in use, checked against a catalogue of over 1,000 assessed tools, without ever showing an individual employee.
#From observing to substantiating
Demonstrating compliance is the hardest requirement in healthcare, because gathering evidence takes time nobody has. BeeSensible turns this around: the evidence comes from the work itself. Sensitive data is highlighted as someone types in AI tools, email and chat, and the aggregated figures show how often that happened and where. Always as counts: never the text, never an individual and no per-employee breakdown anywhere.
Put the two calendars side by side, 20 February 2027 and 15 August 2026, and make AI use a standing item in the risk analysis you are revising for the transition anyway.
Further reading: "BIO and NEN 7510: AI and privacy in government and healthcare" and "The Netherlands has its NIS2 law".
