A law with no runway
On 15 August 2026, the Cyberbeveiligingswet (Cbw) entered into force, transposing the EU's NIS2 Directive into Dutch law with no transition period. More than 8,000 organizations across 18 essential and important-service sectors — energy, drinking water, digital infrastructure, healthcare, government and transport among them — must now be registered in the national entity register, maintain a documented duty-of-care risk-management programme, and report significant incidents within 24 hours, with follow-up updates at 72 hours and a final report within one month (Rijksoverheid, 15 August 2026; NCSC). Registration runs through Mijn.NCSC.nl and is, in the regulator's own words, "a legal obligation that can be actively enforced" — failure to register correctly can itself trigger fines (RDI).
The stakes are real. The statute's enforcement chapter sets administrative fines for essential and important entities under Articles 80 and 87, and the Dutch government has cited penalties of up to €10 million or 2% of global annual turnover for essential entities — whichever is higher — mirroring the NIS2 ceiling (wetten.overheid.nl, BWBR0052872). Boards, not just IT departments, are on the hook: management bodies must approve cybersecurity measures and receive training sufficient to do so knowledgeably, and that responsibility cannot be delegated away.
The case for it
The strongest argument for the Cbw is not abstract. The directive it transposes, NIS2, replaced a 2016 framework that regulators across the EU had concluded was too narrow and too weakly enforced for a threat environment defined by ransomware against hospitals, state-linked intrusions into energy grids, and supply-chain compromises that skip past any single company's own defenses. Harmonized reporting timelines and a mandatory national register give the NCSC something it did not reliably have before: a real-time, cross-sector picture of who is under attack and how, rather than fragmented disclosures arriving late or not at all. Extending duty-of-care obligations to "important" entities — not just critical-infrastructure operators — also closes a well-documented weak link: attackers increasingly route through smaller vendors and service providers precisely because they sit outside the old rules. None of that is manufactured urgency.
The problem is not the law. It's the runway
What is hard to defend is the total absence of a transition period for the regulated. The Cbw commenced with the same immediacy Dutch officials would never have accepted for themselves. NIS2 set an EU-wide transposition deadline of 17 October 2024. The Netherlands missed it — badly. On 7 July 2026, the Dutch Senate finally passed the Cbw (Houthoff); on 9 July 2026, two days later, the European Commission referred the Netherlands — alongside Ireland, Spain and France — to the Court of Justice of the EU for failing to notify complete transposition measures, seeking a lump-sum penalty plus daily fines until compliance was confirmed. The Commission's own framing was that these four states were more than 20 months late (The Record, Recorded Future News).
That is the asymmetry worth naming plainly: the state gave itself 20 months of slack beyond its own legal deadline, then gave the 8,000-plus organizations now in scope zero days between royal assent and enforceability. A mid-sized hospital trust, water utility or logistics operator newly captured by the "important entity" tier does not have a compliance department that can stand up a documented risk-management framework, register with the NCSC, and brief its board to Cbw standard overnight — certainly not to the standard regulators will expect when the first real incident report lands on their desk. Clyde & Co's client guidance captured the practical reality bluntly: organizations "should urgently take steps" because there is no grace period to lean on (Clyde & Co).
Proportionality cuts both ways
None of this is an argument against NIS2's substance, or against the Netherlands' obligation to implement it. It is an argument that proportionate regulation has to include proportionate sequencing — and that a government which spent 20 extra months getting its own transposition right has a weak claim to zero-notice enforcement against the private actors who had no say in that delay. A phased compliance window, or even a documented soft-enforcement period tied to good-faith registration, would have preserved the security gains NIS2 is designed to deliver without converting first-year compliance into a lottery of who happens to get audited before their risk-management documentation is finished.
The Cbw's substance — a national register, tiered incident reporting, non-delegable board accountability — is a reasonable modernization of Dutch cybersecurity law. Its rollout, launched the same month the state itself stood accused in Luxembourg of exactly the kind of delay it now tolerates from no one else, is not.