A Long-Delayed Law Finally Lands
On August 15, 2026, the Netherlands' Cyberbeveiligingswet — the domestic transposition of the EU's NIS2 Directive — entered into force alongside the companion Wet weerbaarheid kritieke entiteiten (Critical Entities Resilience Act). Together they bring roughly 8,000 organizations across 18 sectors, from energy and drinking water to digital infrastructure, healthcare, government, and transport, under a unified security regime for the first time (Rijksoverheid). The Senate approved both bills on July 7, 2026, giving covered entities barely five weeks to prepare before obligations became binding — with no general grace period (NCSC).
The substance is significant. Entities must register with the National Cyber Security Center via MijnNCSC, conduct a formal risk analysis and implement "appropriate and proportionate" technical measures, and report significant incidents within 24 hours to their CSIRT and supervisory authority (NCTV). Boards, not just CISOs, now carry personal accountability for cybersecurity oversight. Non-compliance carries real teeth: essential entities face fines up to €10 million or 2% of global annual turnover, whichever is higher; important entities face up to €7 million or 1.4% (Dxfferent).
The Case for the Law
The strongest argument for the Cbw is straightforward: cybersecurity investment by any single firm is chronically underprovided relative to the risk it poses to everyone connected to it. A ransomware hit on a Dutch port operator, a hospital trust, or a regional water utility doesn't stay contained — it cascades through supply chains and public services that never chose to bear that risk. Voluntary security standards have consistently failed to keep pace with the scale of ransomware and state-linked intrusion campaigns targeting European critical infrastructure over the past three years. A mandatory floor, backed by supervisory power to inspect proactively rather than wait for a breach, is a defensible response to a genuine market failure — and the EU-wide harmonization NIS2 provides means a hospital in Rotterdam and one in Rotterdam's counterpart in Lyon now answer to comparable minimum standards, closing the weakest-link problem that let attackers route through whichever member state regulated loosest.
Where the Design Strains
That said, the execution deserves scrutiny on three fronts. First, the timeline: five weeks between final Senate passage and a binding registration deadline, for a law reaching 8,000 organizations — many of them mid-sized "important" entities with no prior compliance infrastructure — is punishingly tight. Firms that miss the registration window face enforcement exposure for a paperwork failure entirely independent of whether their actual security posture is sound.
Second, the fine structure. A cap of 2% of global turnover makes sense for a multinational cloud provider; it is a wildly disproportionate threat for a regional transport operator or a mid-cap health-tech firm that happens to sit inside a covered sector but does the bulk of its business in the Netherlands alone. NIS2's minimums were set with the largest platforms in mind, and member states transposing them at the floor risk hitting exactly the smaller, less-resourced entities the proactive-supervision model was supposed to help mature, not punish.
Third, mandatory 24-hour reporting — while faster disclosure is generally good policy — risks producing shallow, defensively-worded initial reports rather than useful signal, a criticism that has dogged breach-notification regimes since GDPR's own 72-hour rule. Speed and accuracy trade off against each other in the first day after an incident is discovered, and regulators should expect, and plan for, a wave of hedged first reports followed by substantive corrections.
What the Law Doesn't Touch
The Cbw's entire architecture is entity-facing: it regulates organizations, not the fraud that reaches individual Dutch residents directly. And that fraud is evolving fast, just not through the channel this law governs. Dutch police recorded more than 7,200 reports of fake-police impersonation scams in the first half of 2026 alone — the highest six-month total on record, with people over 70 the primary targets (iamExpat). Notably, the Dutch version of this scam remains analog: phone calls and doorstep visits, not the WhatsApp video-call "digital arrest" format that has become endemic in India, where fraudsters impersonate agencies like the CBI over video and coerce victims into transferring money while ostensibly "under arrest" — a tactic serious enough that WhatsApp banned more than 9,400 accounts linked to it in a single enforcement drive (FakeOut).
That gap matters for policy sequencing, not alarmism: nothing in current Dutch reporting suggests the WhatsApp-video variant has arrived domestically. But the underlying tactic — real-time video impersonation of authority, engineered for platforms with weaker identity friction than a phone call — has already proven exportable once. The Cyberbeveiligingswet was never designed to address it, and no comparable statutory architecture currently exists on the consumer-fraud side in the Netherlands; response there still runs through police reporting, the Fraudehelpdesk, and ACM's ConsuWijzer advisory service, not a duty-of-care regime with proactive supervision. Regulators who spent five years building NIS2's entity-level framework should not assume the job of protecting the public from platform-native fraud is done because critical infrastructure now has one.