meta_id 3315827

On July 8, 2026, the Netherlands enacted the Wet weerbaarheid kritieke entiteiten (Critical Entities Resilience Act), implementing Directive (EU) 2022/2557 of the European Parliament and Council. The legislation establishes a comprehensive framework to strengthen the resilience of critical entities providing essential services across multiple sectors. The act designates critical entities across nine primary sectors: energy, transport, banking, financial market infrastructure, healthcare, water (drinking and wastewater), digital infrastructure, government, and food production and distribution. Each sector falls under the oversight of relevant ministers, with the Minister of Justice and Security serving as the central contact point for cross-border coordination. The framework requires critical entities to conduct risk assessments identifying natural and human-made threats, including accidents, natural disasters, health emergencies, hybrid threats, and terrorism. Entities must implement proportionate technical, security, and organisational measures to prevent incidents, ensure physical protection, manage business continuity, and maintain personnel security protocols. Competent authorities will conduct their own sector-wide risk assessments at least every four years. Critical entities must report significant incidents disrupting essential services within 24 hours to competent authorities. The government will establish a national resilience strategy addressing cross-sectoral dependencies and governance frameworks. Competent authorities may audit entities' compliance and issue binding directives for remedial action. Enforcement mechanisms include administrative fines up to €10 million or 2 percent of global annual turnover for violations of core obligations, and up to €1 million for other breaches. The Minister of Justice and Security will report annually to parliament on implementation, including incident statistics and enforcement actions. The first critical entity designations must occur by July 17, 2026, with initial risk assessments and resilience strategies due by January 17, 2026. Obligations apply to designated entities from ten months after designation.