Dutch Cybersecurity Act and Critical Entities Resilience Act Take Effect, Transposing EU NIS2 and CER Directives

As of August 15, 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, Wwke) have come into force. These acts transpose the European NIS2 and CER directives into national legislation, imposing new obligations on thousands of organizations across 18 sectors, including energy, digital infrastructure, and healthcare, to enhance digital resilience, cybersecurity, and incident handling.

Context

The Dutch Cybersecurity Act and the Critical Entities Resilience Act are part of the European Union's broader strategy to enhance cybersecurity across member states. They transpose the NIS2 and CER directives into national law, which sets minimum cybersecurity standards and resilience requirements for critical sectors. The legislation affects organizations in 18 sectors, including energy, healthcare, and digital infrastructure, which are vital for the functioning of society.

Why it matters

The implementation of the Dutch Cybersecurity Act and the Critical Entities Resilience Act is crucial for improving the overall cybersecurity landscape in the Netherlands. By aligning with EU directives, these laws aim to protect critical infrastructure and services from increasing cyber threats. This is particularly important as digital reliance grows across various sectors, making robust cybersecurity measures essential for national security and public safety.

Implications

The new laws will likely lead to increased investment in cybersecurity infrastructure and training across affected sectors. Organizations may face significant operational changes to comply with the new regulations, which could strain resources, particularly for smaller entities. Ultimately, improved cybersecurity resilience is expected to benefit the public by reducing the risk of cyber incidents that could disrupt essential services.

What to watch

As organizations begin to implement the requirements of these acts, attention will be on how effectively they enhance cybersecurity measures and incident response capabilities. Monitoring compliance and the government's role in enforcement will be key in the coming months. Additionally, the impact of these laws on the cybersecurity market and service providers may become evident as organizations seek support to meet new obligations.