NIS2 & the Cyberbeveiligingswet: From European Directive to Dutch Law

Digital Escrow Legal Insights — Episode 2

NIS2 and its Dutch implementation, the Cyberbeveiligingswet, took effect on August 15, 2026. Unlike DORA, which only applies to financial services, NIS2 reaches organizations across energy, transport, healthcare, digital infrastructure, government, and manufacturin, roughly eight thousand Dutch organizations fall within scope.

From directive to law

NIS2 is Directive (EU) 2022/2555. As a directive, it required national transposition, which arrived as the Cyberbeveiligingswet, approved by the Eerste Kamer on July 7, 2026. The EU deadline was October 17, 2024, so the Dutch law landed much later than the directive itself. Where the two texts differ, the Dutch law governs.

Essential vs. important entities

Classification depends on sector and size, generally 50+ employees or over €10 million in turnover. The substantive requirements are largely the same for both categories; what differs is supervision. Essential entities are supervised proactively, important entities reactively. All in-scope organizations must register in the national entity register.

Three obligations

The duty of care (zorgplicht) requires risk-based measures covering incident handling, business continuity, and supply chain security. The notification duty requires an early warning within 24 hours of awareness, a full notification within 72 hours, and a final report within a month. The registration duty is self-assessed. No authority tells you you’re in scope, and failing to register is a breach on its own.

Supply chain security is where escrow fits

Article 24 requires assessing the cybersecurity of direct suppliers and documenting that assessment. In practice, this makes your supplier’s weaknesses your compliance problem. An escrow arrangement addresses business continuity, supply chain security, and system maintenance at once: it reduces dependency on a single supplier, provides a recovery route that doesn’t need that supplier’s cooperation, and produces evidence for a supervisory authority.

Takeaways

NIS2 compliance in the Netherlands runs through the Cyberbeveiligingswet, and management carries personal accountability for getting the duty of care right, including the continuity of your suppliers.

Next up: how DORA is supervised and enforced by DNB and the AFM.

Watch the video: Episode 2 – NIS2 & the Cyberbeveiligingswet: From European Directive to Dutch Law