The Dutch NIS2 law applies. Are you in scope, and what does it cost?

Two months, and no transition period

On 15 August 2026 the Cyberbeveiligingswet and the critical entities resilience act (Wwke) entered into force. From that day the registration duty, the duty of care and the reporting duty apply. There was no phase in which the obligations existed but could not yet be enforced.

That is unusual enough to note. Much new regulation comes with a year to get things in order, and that year was not given here. Starting today is therefore not early.

The penalty everyone quotes is not the ceiling

Ten million euro. That figure is in almost every summary, and it really is in the statute. What usually falls away is what comes after it.

• Essential entities, article 80(3)(a): for breaches of the duty of care (article 21) and the reporting duty (articles 25 to 30), at most 10 million euro or 2 per cent of total worldwide annual turnover for the preceding financial year, whichever is higher.
• Important entities, article 87(3)(a): for the same category, at most 7 million euro or 1.4 per cent, whichever is higher.

Note the word or. The flat amount is not a ceiling but a floor under one: it is the higher of the two. For an organisation with half a billion in turnover, 2 per cent is exactly ten million, and above that only the percentage counts. A group with five billion is not looking at ten million but at a hundred. Saying “up to ten million” names the lower bound of the maximum.

That also makes it the wrong figure to plan with. A percentage scales to the organisation reading it; a flat amount is too high or too low for most readers, and never theirs.

And it does not belong to the register

The second place summaries cut the corner. The law has two buckets, and the register sits in the other one.

Article 80(3)(a) names only articles 21, 21a and 25 to 30: the duty of care and the reporting duty. Providing information for the national register sits in article 44 and does not appear in that list. Failing to register therefore falls under (3)(b): at most 1 million euro, with no percentage beside it. For important entities the same limit is in article 87(3)(b).

A million is not pocket change. But it is not ten million and it is not a percentage, and the difference matters the moment you use it in a boardroom. Walk in with the highest figure for an obligation it does not belong to, and it comes back at you next time: *last time you said ten million too*. That costs you more than the argument was worth.

The board member is in there personally

The part summaries almost always leave out, and that lands hardest in a boardroom.

• Article 93: a member of the management body of an essential or important entity can personally receive an administrative fine of at most 25,000 euro, among other things for breaching article 24, which covers the knowledge, skills and training of board members.
• Article 78: for essential entities, suspension of members of the management body can be requested.

Twenty-five thousand euro is small next to a percentage of turnover, and it is the figure that changes the conversation. A fine on the company is a line on a profit and loss account. A fine in someone's own name is something else, and a request for suspension is something else again. It is also why board-level training is not a soft provision in this law but a fineable one, which connects to what we wrote about going from knowledge to demonstrable resilience.

Are you in scope? Three questions

You do not need a compliance programme to find out. Three questions, in this order, and most organisations have the answer within an hour.

1. Which service are you assessing? Not the legal entity, but the service you provide. This is the step most often skipped and the most expensive one: a company with three services can have three different outcomes, and that is not an error but the design.
2. Does that service fall under annex 1, annex 2 or neither? Annex 1 holds the sectors of high criticality, annex 2 the other critical sectors. A service in neither is outside the law, and that too is an outcome you write down.
3. Which size class are you in? Counted over staff, annual turnover and balance sheet total, including partner and linked enterprises. This is where group companies get surprised: you are not counting only yourself.

The outcome follows. Large organisations in annex 1 are essential. Medium organisations in annex 1 and medium and large organisations in annex 2 are important. Government bodies are essential and have no size criterion. There are exceptions to check first, because they take the size step out of play:

• Providers of public electronic communications networks and services, (qualified) trust service providers, top-level domain name registries, DNS service providers, domain name registration services and government bodies are covered regardless of size.
• An organisation designated a critical entity under the Wwke is essential by operation of law. That designation comes from outside and overrides what you concluded yourself.
• Micro and small enterprises are in principle outside the law, but a sector minister can designate one on the basis of a risk assessment.

The Dutch government self-assessment tool gives a first indication and is worth using: regelhulpenvoorbedrijven.nl. It has no legal status, nor do the quickscan and control framework circulating beside it, and it does not know your group structure. Responsibility for your own assessment stays with the organisation.

Why “important” is not reassuring

It is the most common misreading, and an understandable one: one word sounds heavier than the other. But the registration duty, the duty of care and the reporting duty apply to both, in the same form.

The difference is in supervision. Essential entities are supervised proactively: someone checks whether you have it in order, even when nothing has happened. Important entities are supervised reactively: someone looks when there is cause. That is a difference in the supervisor's calendar, not in what has to be in place at your end.

The evidence is the reasoning, not the confirmation

A screenshot of your registration proves you filled in a form. It is the one piece of evidence almost every organisation does have, and it does not answer the question that can be asked.

That question is: why did you arrive at this classification. Which service, which annex, which figures for which financial year, who decided, and when does it get looked at again. Six answers, and they fit on one page. They exist only if somebody wrote them down at the moment the decision was made, and in most organisations that decision was never taken as a decision: it was inferred, by whoever had the form in front of them, on an afternoon, with nobody else looking.

Here is the quiet failure. The classification is a snapshot of the year you made it, and almost everything that can tip it happens without anyone thinking about this law: a year of growth that carries you over a threshold, a new service under a different annex, an acquisition that makes you count with a parent, a designation under the Wwke. A classification without a review date is a conclusion standing still while the company keeps moving.

And the decision does not belong to IT. It is about which services you provide and how large you are, and that knowledge sits with the board and with finance. So: one name on the sheet, and that person knows their name is on it. The second half is not a formality. An owner who does not know is not an owner.

Two fields that go stale while you do nothing

The duty does not end at registering. Article 44(2) says you report a change in the registered data without delay, and in any case within two weeks of the date of the change.

Two weeks. That is shorter than most organisations need to notice anything changed at all. It covers your name and address, your contact details including email addresses, IP ranges and phone numbers, your sectors and subsectors, and the member states where you provide services covered by annex 1 or 2.

Read that list again with your own organisation beside it. A new IP block, a direct line that lapses, a security team moving mailbox, the first customer in Belgium: each of them carried out by someone who has never heard of article 44. This is not a fine you incur through negligence, but through org design. And it connects to the reporting duty: if you have to be able to issue an early warning within twenty-four hours, the channel has to work and the person has to exist. The same exercise as in the five questions for tomorrow morning, one step earlier.

What a fine is not

A figure is a reason to read something, not a reason to do something. Budget your security on the highest penalty you can find and you build an argument that falls over the moment somebody asks how likely that penalty is. And that is a fair question, because supervision of important entities is reactive.

The better reason sits a layer deeper and does not move with the size of a fine. An organisation that does not know whether it falls under this law also does not know who may decide at three in the morning to shut something down, and does not know how many suppliers its production depends on. The law makes those questions enforceable. It does not invent them.

That is also why this is the same question as in our other two domains. In OT, scoping is called zones and conduits: you cannot protect what you have not drawn a boundary around. In AI governance it is called the inventory. Here it is called the classification of your entity. Three times: what falls under this, who determined that, and what does it rest on. Worked out in the cornerstone article.

Frequently asked questions

We are under the thresholds. Nothing to do?

For the registration duty probably not, but write that decision down, with the figures and the financial year. Two things can still reverse it: a sector minister can designate a small company on the basis of a risk assessment, and you grow. Besides that, the requirement often arrives from the other side, through a customer who is covered and has to have their supply chain in order.

Does that 2 per cent apply to us as well?

To the duty of care and the reporting duty it does, if you are essential: article 80(3)(a) names 10 million euro or 2 per cent of worldwide annual turnover, whichever is higher. If you are important, it is 7 million or 1.4 per cent. For other breaches, the register among them, the maximum is 1 million with no percentage.

Our customer is an essential entity. Do we have to register too?

Not on those grounds. The classification is about your service and your size, not your customer's. What does happen: you become part of their supply chain security measures, and those reach you as contractual requirements. That is a different conversation, described in the piece on depending on a supplier you do not control.

We are registered. Are we done?

No, and that is the point of article 44(2): you report a change in your data without delay, in any case within two weeks. Put that with one person and a deputy, and tie it to the moments when something changes, because nobody checks a register of their own accord.

Can a fine really land on a board member personally?

Article 93 provides for an administrative fine of at most 25,000 euro for a member of the management body, among other things for breaching the provisions on the knowledge, skills and training of board members. Article 78 additionally allows a request to suspend board members at essential entities. This article is not legal advice; have the precise scope confirmed by a lawyer.

Does the classification change as we grow?

Yes, and that is why the sheet below has a review date. Growth, a new service, an acquisition or a designation under the Wwke can tip the outcome. Put the reassessment on the same list as the tax and employment consequences of an acquisition; that list does get read.

Further reading

• Statute: Cyberbeveiligingswet, version of 15 August 2026 (Dutch)
• NCTV: registration duty under the Cyberbeveiligingswet (Dutch)
• NCTV: which organisations fall under the Cyberbeveiligingswet (Dutch)
• RDI: frequently asked questions on the Cyberbeveiligingswet (Dutch)
• NIS2 self-assessment tool, Dutch government
• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• CyberBusters: from knowledge to demonstrable resilience
• CyberBusters: the decision pattern behind OT, AI and NIS2

If you want to get this sharp with your own team, the PECB NIS 2 Foundation training covers the scope and the concepts, and the PECB NIS 2 Lead Implementer training covers the measures that follow from it.