The Dutch Cybersecurity Act from 15 August 2026: what to arrange now

On 15 August 2026 the Dutch Cybersecurity Act takes effect, the transposition of the European NIS2 directive. For organisations in scope something fundamental changes: you not only have to take measures, you have to be able to demonstrate them.

Three obligations, in short

The law imposes three things. The duty of care: you assess your own risks and take appropriate measures. The reporting duty: significant incidents are reported within tight deadlines. And board responsibility: the board must understand the risks and be able to demonstrate oversight.

The last is the biggest shift. IT security is no longer something you delegate to a supplier or a systems administrator. Outsourcing is allowed; transferring responsibility is not.

The measures you have to be able to show

The law names no products, but the categories are clear. In practice we test these points:

• Access management and multi-factor authentication on all accounts, including administrator accounts.
• Backup and recovery, with recovery actually tested.
• Patch management with demonstrable execution, not just good intentions.
• Monitoring and logging, so you can reconstruct after an incident what happened.
• Supplier management: which parties touch your systems, and what have they arranged.
• Staff awareness, with evidence that training happens periodically.
• An incident process with roles, contacts and reporting deadlines, that has been rehearsed.

The reporting deadlines are shorter than you think

A significant incident requires an early warning within 24 hours, a fuller incident report within 72 hours and a final report within a month. If that process is not set up beforehand, the first hours go to working out who is actually in charge.

What helps: record in advance who decides whether an incident is significant, who files the report, who informs customers and who supplies the technical evidence. That is half a page, and in a crisis it saves days.

Not in scope? You will still get the questions

The law affects organisations in designated sectors from roughly 50 staff or 10 million euro turnover. But organisations in scope have to assess their supply chain, and they pass that on contractually. In practice that means questionnaires, clauses and sometimes a demand for certification, including at smaller suppliers.

We already see that effect at customers in logistics and manufacturing: the requirements come not from the regulator but from the largest client.

What you can do this month

Do not start with a thirty-page project plan. Start by knowing where you stand.

• Determine whether the law applies to you directly, indirectly or not at all.
• Test the seven measure categories above and write down what is in place for each.
• Set up the incident process, with names and phone numbers.
• Record what you have done; without records a measure formally never existed.
• Put a reassessment in the calendar, at least annually.