meta_id 3315826

On July 8, 2026, the Netherlands Official Gazette published the Cyberbeveiligingswet (Cybersecurity Act), legislation implementing Directive (EU) 2022/2555 of the European Parliament and Council of December 14, 2022, concerning measures for a high common level of cybersecurity across the Union. The act establishes a comprehensive framework for managing cybersecurity risks across essential and important entities in critical sectors. Essential entities include qualified trust service providers, top-level domain name registries, DNS service providers, mid-sized public electronic communications network and service providers, government ministries, provinces, municipalities, water boards, and critical entities designated under the Critical Entities Resilience Act. Important entities comprise smaller-sized operators in the same sectors plus online marketplaces, search engines, and social network platforms meeting specified thresholds. The legislation imposes mandatory cybersecurity due diligence obligations requiring entities to implement appropriate technical, operational, and organisational measures proportionate to identified risks. Entities must establish incident reporting procedures, with significant incidents requiring notification to their Computer Security Incident Response Team (CSIRT) and competent authority within 72 hours of discovery. The act designates competent authorities across multiple ministries based on sector, with the Ministry of Justice and Security serving as the central contact point. The act establishes enforcement mechanisms including security scans, audits, binding directives, administrative fines reaching €10,000,000 or two percent of global annual turnover for essential entities, and €7,000,000 or 1.4 percent for important entities. A national register of essential entities, important entities, and domain name registrars will be maintained. The legislation repeals the prior Network and Information Systems Security Act and amends related legislation including the Telecommunications Act and Digital Resilience Act. The act enters into force on a date to be determined by royal decree, with different effective dates possible for specific provisions.