Energy

Dutch NIS2 law in force: what plant operators must do

November 7, 2026 4 min reading

The Netherlands now has its national version of the EU NIS2 Directive. According to the Dutch government, the Eerste Kamer (Senate) approved the Cyberbeveiligingswet (Cbw) on 7 July 2026, and the law took effect on 15 August 2026. It replaces the earlier Wbni. For operators of plants in energy, drinking water, transport and other covered sectors, the practical starting point is a self-assessment and, if the plant's organisation is in scope, registration with the NCSC.

What changed

The Rijksoverheid release of 7 July says the Cbw covers organisations providing essential or important services in 18 sectors, with energy, drinking water, digital infrastructure, healthcare, government and transport named as examples. It puts the number of organisations facing new obligations at more than 8,000. Security Management, a trade publication, repeats the same figures in its report of 3 August 2026.

A second law took effect on the same date: the Wet weerbaarheid kritieke entiteiten (Wwke), which implements the EU CER Directive. It applies to about 500 organisations and is aimed at resilience against threats such as sabotage, terrorism and natural disasters. The sectors listed include energy, transport, drinking water and wastewater, nuclear, and food production and distribution. According to the government, the responsible minister designates these organisations as critical entities. They do not decide that themselves.

Obligations under the Cbw

The government and Security Management list the same core duties:

Self-assessment. Organisations must check for themselves whether they fall under the law. The Rijksoverheid release of 15 April 2026, issued when the Tweede Kamer adopted the bills, states this explicitly.
Registration. In-scope organisations register in the entity register through the NCSC (mijn.ncsc.nl). The government says this is mandatory from 15 August. Security Management adds that registration also gives access to CSIRT services.
Duty of care (zorgplicht). Organisations must take measures to manage cyber risks and to prevent incidents or limit their impact.
Incident reporting. Significant incidents must be reported to the CSIRT and the competent authority within statutory deadlines, through a portal.
Management accountability. The board is ultimately responsible for cyber risk management, must have sufficient knowledge of these risks, and must follow suitable training.

Why it matters on the plant floor

The sources do not mention operational technology or industrial control systems by name. The following is our interpretation: a duty of care for cyber risk management applies to the systems that keep a plant running, so operators will probably need to include OT and ICS in their risk assessment, their asset knowledge and their incident process, not only office IT. Whether and how the detailed requirements treat OT is not stated in the pages we reviewed.

This is also our interpretation: because the duties sit at board level, plant management cannot leave the question to the IT department alone. According to the government release, the training requirement applies to the management body.

What the sources do not say

The Rijksoverheid release describes no transition period. It says registration applies from 15 August. We found no statement of a grace period in the sources used here.
The sources we cite do not say when supervisors will begin enforcing the rules, or what penalties apply. The release says only that supervisors check compliance.
The incident reporting deadlines are described as statutory, but the sources used here do not give the hours or days.
The April release gave a planned entry into force in the second quarter of 2026. The final date, 15 August 2026, replaced that.

Practical next steps

An operator that has not yet acted could take these steps. They are our suggestions, not requirements quoted from the sources:

Work out whether the organisation's activities fall into one of the 18 sectors, and whether it is an essential or important entity.
Confirm whether the organisation is registered on mijn.ncsc.nl. The government states the obligation has applied since 15 August.
Check whether the plant is likely to be designated under the Wwke. This is the minister's decision, so watch for notification.
Review the risk management and incident reporting process against the duty of care and the reporting duty, including how a significant incident at a plant would reach the CSIRT.
Arrange management training and record it.

In April the Dutch government advised organisations not to wait for the law to take effect, since the underlying risks already exist.