The Netherlands on Friday formally implemented the European Union’s NIS2 directive and Critical Entities Resilience (CER) law, ushering in a new era of cybersecurity and infrastructure protection requirements for thousands of Dutch organizations.
The new Cybersecurity Act (Cyberbeveiligingswet) and the Law on Resilience of Critical Entities (Wwke) have finally entered into force, making the Netherlands one of the last EU member states to transpose the directives. The legislation introduces a sweeping overhaul of the country’s security landscape, expanding the number of regulated entities from roughly 1,000 under the previous Wbni act to approximately 8,000 directly affected organizations.
Strict Mandates and No Transition Period
Unlike some other jurisdictions, the Dutch implementation includes no transition period. The legal basis and the supervisory mandate of the national cybersecurity authority exist from day one. Organizations in scope must now comply with a substantial set of cybersecurity requirements, including risk management, incident response, and supply-chain security.
The CER law adds another layer by formally designating roughly 500 critical entities across sectors such as energy, transport, banking, healthcare, and digital infrastructure. These entities must now meet specific resilience standards to protect against physical threats, sabotage, and natural disasters.
Penalties and Board Liability
The enforcement regime under NIS2 is significantly more stringent than its predecessor. Essential entities face maximum fines of up to €10 million or 2 percent of their annual worldwide turnover. Important entities face penalties up to €7 million or 1.4 percent of turnover.
Perhaps most notable is the introduction of personal liability for management bodies. Board members and executives can be held accountable for failures in cybersecurity compliance, and in extreme cases, supervisors may have the power to temporarily remove management from their roles within essential entities.
Industry Response and Next Steps
Industry groups like NLdigital have been preparing organizations for this transition for months, providing guides on compliance and registration with the national Computer Security Incident Response Team (CSIRT). While no one expects immediate raids or inspections, the legal mandate is now active.