NIS2 and the Cyber Resilience Act: what applies to a Dutch company
The Cyberbeveiligingswet, the Dutch NIS2 law, has applied since 15 August 2026. The reporting duty of the Cyber Resilience Act has applied since 11 September 2026. Who is in scope, what must happen, and where I help.
I am not a lawyer. This is a technical reading of what the official pages say, with the sources at the bottom. For a definite answer about your own organisation, use the NCSC self-check.
Who is in scope
The NCSC says the law covers more than 8,000 organisations that provide essential or important services in critical sectors. Size decides which class you fall in, and for some kinds of organisation there are exceptions to the size criteria.
Providers of managed services, and of managed security services, are named in the NCTV questions and answers: essential if they are large, important if they are medium-sized. A supplier is not automatically in scope itself. Whether a very small supplier falls under the law depends on the size criteria and the sector; use the NCSC self-check and do not assume.
What an in-scope organisation must do
- Register in the entity register at the NCSC.
- Carry out a risk analysis and take appropriate, proportionate measures for its network and information systems (the zorgplicht).
- Report incidents to the CSIRT and the supervisor as soon as possible, and within 24 hours at the latest.
Why a small supplier still feels it
The law makes an in-scope organisation map the risks in its supply chain and take measures. It may set cybersecurity requirements for its direct suppliers. In practice that arrives as a clause in a contract or a questionnaire: how do you handle patches, access, backups, incidents. A supplier who can answer with a document wins over one who answers with a promise.
The Cyber Resilience Act is a second track
The Cyber Resilience Act, Regulation (EU) 2024/2847, is about products, not organisations. It entered into force on 10 December 2024. The duty to report actively exploited vulnerabilities applies from 11 September 2026. The main obligations for manufacturers of products with digital elements apply from 11 December 2027. The Commission published practical guidance on 27 July 2026, written for businesses of all sizes, and says the act takes a special approach to free and open-source software. If you sell software that other people install or run, read it now, not in 2027.
Where I help
The technical part: a gap analysis against NIS2, GDPR or DORA, with your measures tested against each requirement in a table you can hand to an auditor or a customer, and the remediation done in an agreed order. It is technical work, not legal advice and not a certification. Fines, lawyers and the auditor are not in the quote.
Compliance Alignment: quoted per regime, EUR 90 per hour excl. VAT. If you first want to know where you stand technically, the security quick scan is a fixed EUR 720 excl. VAT (8 hours).
Book a callRead about Compliance Alignment
The measures themselves are mostly Hardening work. If you want a first overview before you decide, the Health Check includes a security quick scan, and the sample report shows how findings are written down.
Sources, read on 30 October 2026
- NCSC: Cyberbeveiligingswet (NIS2)
- NCTV: questions and answers about the Cyberbeveiligingswet
- Staatsblad 2026, 189: Cyberbeveiligingsbesluit, article 35 (entry into force 15 August 2026)
- European Commission: Cyber Resilience Act
Did a customer ask you for this?
Tell me which customer asked which question. I reply within one working day with a first opinion, free.