Does the Cyberbeveiligingswet (NIS2) apply to your organisation?

The Dutch Cyberbeveiligingswet (Cbw) has applied since 15 August 2026. Use the form to see whether your organisation is likely an essential or important entity under NIS2, then read the Dutch registration and incident rules below. The result is an indication.

Indicative only, not legal advice.

Check your organisation

Your answers stay in this browser. Submitting the form does not send them to a server, and the page does not store them.

Activity

Annex I is sectors of high criticality. Annex II is other critical sectors. If more than one activity fits, run the check again. Confirm the stricter result with the competent authority.

Size

Use annual figures in euro. Headcount is the number of employees (annual work units if you have them). Medium means 50 or more employees, or turnover and balance sheet total both above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Linked and partner enterprises

Add 100 percent of a linked enterprise: a holding or control above 50 percent. Add only your share of a partner enterprise: a holding from 25 to 50 percent. A holding below 25 percent stays out of the total. This is the simple version of Recommendation 2003/361/EC. NIS2 says a public-sector shareholder does not by itself change the size test.

Country

Choose a Member State to see national notes. Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Slovenia and Sweden show national notes. Every other country says that national details are coming soon.

Possible national designation

Optional. Tick a box only if it might apply. The checker cannot see a Member State's list, so the result will tell you to check the designation.

Indicative result only. This is not a legal determination of your NIS2 status and not legal advice. Your status depends on national law and on any identification by your Member State. Confirm it with the competent authority or a qualified adviser.

Try the live demoBook a gap review

Install free from GitHub (self-hosted). Core is the free self-hosted edition.

Last checked: 1 November 2026.

The Cbw at a glance (Stb. 2026, 187; in force 15 Aug 2026)

The Cyberbeveiligingswet is the Wet van 8 juli 2026, Stb. 2026, 187. The Cyberbeveiligingsbesluit, Stb. 2026, 189, Article 35, brings the Act and the decree into force on 15 August 2026. The Cbw has been in force since that date. Article 106 repeals the Wbni. The Cbw uses "essentiële entiteit" for an essential entity and "belangrijke entiteit" for an important entity (Art. 1).

Who falls under the Cbw: sectors and size

The Cbw follows the Directive's medium and large enterprise test. Annex I and Annex II activities that are medium-sized or larger are the starting point. Size-independent cases in Article 2(2) to Article 2(4) of the Directive still apply. Run the checker with your own figures, including linked and partner enterprises. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Municipalities, provinces, water boards and education

The Cbw covers decentralised government (municipalities, provinces, water boards) and lets the Minister of Education designate higher-education institutions (Art. 11, Art. 15 Cbw). Check your category with your competent authority. Public administration is not decided by headcount.

Registration and the national register

Register via MijnNCSC. Registration has been required since 15 August 2026. Changes are due within 14 days. Under Article 15 of the Cbw the competent authority is the minister responsible for your sector, for example: Economic Affairs for digital infrastructure, ICT service management (B2B), space, postal and courier services, manufacturing and digital providers; Finance for banking and financial market infrastructures; Infrastructure and Water Management for transport, drinking water, waste water, waste management, chemicals and the water boards; Climate and Green Growth for energy; the Interior and Kingdom Relations for central and decentralised government (except water boards). Check Article 15 for your sector; supervision may be carried out by an inspectorate on the minister's behalf.

Incident reporting to the CSIRT and the competent authority

Significant incidents are reported to the CSIRT and the competent authority. The national CSIRT is NCSC-NL, and some sectors have their own CSIRT. The clocks are an early warning within 24 hours, a notification within 72 hours and a final report no later than one month after the incident notification (Art. 23(4)(d)). Sector rules can set significance thresholds. See the incident reporting guide for the product clocks.

Duty of care (zorgplicht) and how GRCompliance helps

The Cbw carries a duty of care: security measures, management approval and training for directors. GRCompliance can hold the Article 21 measures, the risk register and the incident clocks on infrastructure you control. It does not file your registration with NCSC and it does not decide your legal status.

Next steps

Check another country. Read the NIS2 checklist for SMEs and the guide to NIS2 incident reporting deadlines. NIS2 compliance software and the self-hosted install are the product pages. Try the live demo or book a gap review.

Other country pages: Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, Poland, Slovenia, Sweden.

FAQ

When did the Cyberbeveiligingswet enter into force?

The Cyberbeveiligingswet has applied since 15 August 2026. Article 35 of the Cyberbeveiligingsbesluit, Stb. 2026, 189, sets that date. The Act itself is Stb. 2026, 187.

Does the Cbw replace the Wbni?

Yes. Article 106 of the Cyberbeveiligingswet repeals the Wbni, the earlier Dutch NIS law.

Are municipalities covered?

The Cbw covers decentralised government (municipalities, provinces, water boards) and lets the Minister of Education designate higher-education institutions (Art. 11, Art. 15 Cbw). Check your category with your competent authority. The checker does not decide that category from headcount.

Who keeps the register?

Under Article 15 of the Cbw the competent authority is the minister responsible for your sector. Register via MijnNCSC. The Cbw has been in force since 15 August 2026.

Is this checker legal advice?

Indicative only, not legal advice.

Directive text: Directive (EU) 2022/2555 on EUR-Lex. Size test: Commission Recommendation 2003/361/EC. Agency overview: ENISA.

Dutch sources: Stb. 2026, 187, Stb. 2026, 189, BWBR0052872, Rijksoverheid, 15 August 2026, mijn.ncsc.nl.