Cyberbeveiligingswet (NIS 2 Netherlands) Copilot

The Cyberbeveiligingswet (Cbw) is the Dutch law that transposes the EU NIS 2 Directive (2022/2555). It is the Act of 8 July 2026, published as Stb. 2026, 187, and it replaces the Wbni. Its implementing decree, the Cyberbeveiligingsbesluit (Cbb, Stb. 2026, 189), sets out the risk-management measures, the extra registration details, and the content of board training. Both took effect on 15 August 2026. The government puts the number of organisations in scope at more than 8,000 across 18 sectors.

Essential and important entities in the sectors listed in Annexes 1 and 2 of the Act, from energy, transport, banking and health care to digital infrastructure, manufacturing, food and research. The starting point is establishment in the Netherlands, with exceptions: public electronic communications providers are covered where they offer services here, and some digital providers, such as cloud, data centre and managed service providers, fall under Dutch law when their main EU establishment or their EU representative is in the Netherlands. Which category you fall into depends on your sector, your size and, in some cases, a ministerial designation. Provinces, municipalities and water boards are essential entities, as are most ministries and critical entities under the Wet weerbaarheid kritieke entiteiten. Defence, the intelligence services and certain security and law-enforcement bodies are excluded. Registering in the national register has been mandatory since 15 August 2026.

For a significant incident: an early warning without delay and at the latest within 24 hours of becoming aware of it (article 26), a notification within 72 hours with an initial assessment, or within 24 hours for a trust service provider when the incident affects its trust service (article 27), and a final report within one month of the notification, or a progress report if the incident is still ongoing (article 29). Reports go to the reporting point set up by the Minister of Justice and Security, which the NCSC runs through its reporting and registration portal. Banks, trading venues, central securities depositories and central counterparties report under DORA instead, and the decree requires that report to reach both their financial supervisor and the relevant CSIRT (article 30).

It reads your situation against the Dutch texts rather than the directive alone: which annex and entity category you fall into, what to submit to the register, how the Cbb measure areas line up with the controls you already run under ISO 27001 or NEN 7510, and what your board must approve and be trained on. The explanatory note to the decree says entities may keep their existing framework, provided the applicable Cbb measures are secured within it. Treat the output as a draft for your own review. The Copilot does not register you or report incidents for you, and your supervisor decides whether your measures are adequate.