Free tool · Dutch Cybersecurity Act (NIS2)
Does your organisation fall under the Dutch Cybersecurity Act (NIS2)?
It depends on three things: your sector, your size and a few special situations. Answer four questions and you will know whether you are an essential or important entity, which duties follow and which article of the Act says so.
- Your answers stay in your browser: nothing is sent or stored
- Based on the Act as in force since 15 August 2026
- Last checked against the Act:
NIS2 scope check (Dutch Cbw): result
Date: ·
Result
Your organisation is probably an essential entity Your organisation is probably an important entity Your organisation probably does not fall under the Act The Act does not apply to this organisation Dutch law probably does not apply to you Not an essential or important entity, but you must register Only after designation by the minister
The Act applies in full. The supervisor may also inspect without a specific reason, for example with an audit or a security scan. The duties are the same as for essential entities. The difference is supervision: the supervisor only acts when there is an indication that you are in breach. Based on your answers you are neither an essential nor an important entity. The Act then places no duties of its own on you. Defence, the intelligence and security services, the Public Prosecution Service, the police and the safety regions are excluded, except in so far as they provide trust services that are also used outside a closed system (art. 5(2)). The Act covers organisations under Dutch jurisdiction. If your organisation is established in another EU member state, that state's NIS2 legislation applies. Providers of domain name registration services must register and keep accurate registration data. The duty of care and the reporting duty do not apply on this ground alone. Higher education institutions only come under the Act once the Minister of Education designates them as an essential or important entity. Without designation the duties do not apply.
What is this based on?
- Art. 8(1)(a): qualified trust service providers are essential, whatever their size.
- Art. 8(1)(b): top-level domain name registries are essential, whatever their size.
- Art. 8(1)(c): DNS service providers are essential, whatever their size.
- Art. 8(1)(d): medium-sized providers of public electronic communications networks are essential.
- Art. 8(1)(e): medium-sized providers of public electronic communications services are essential.
- Art. 8(1)(f): organisations listed in Annex 1 that exceed the ceilings for medium-sized enterprises are essential.
- Art. 8(1)(g): ministries and autonomous administrative authorities of central government are essential.
- Art. 8(1)(h): provinces, municipalities, water boards and joint arrangements are essential.
- Art. 8(1)(i): critical entities under the Wwke are essential, in every sector and at every size.
- Art. 9 and art. 10: a minister can designate an Annex 1 or 2 organisation as essential, for example as the sole provider of an indispensable service or as a former operator of essential services.
- Art. 10: an organisation that was designated an operator of essential services under the former Dutch Network and Information Systems Security Act before 16 January 2023 can be designated an essential entity.
- Art. 11: the Minister of Education can designate a higher education institution as an essential entity.
- Art. 13: the Minister of Education can designate a higher education institution as an important entity.
- Art. 12(1)(a): medium-sized organisations listed in Annex 1 are important.
- Art. 12(1)(b): medium-sized and larger organisations listed in Annex 2 are important.
- Art. 12(1)(c): small and micro providers of public electronic communications networks are important.
- Art. 12(1)(d): small and micro providers of public electronic communications services are important.
- Art. 12(1)(e): small and micro trust service providers are important.
- Art. 4: the Act covers organisations established in the Netherlands, telecom providers offering services here, and digital service providers with their main establishment or representative in the Netherlands.
- Art. 4(4): the rules for domain name registration services apply where the main establishment or representative is in the Netherlands.
- Art. 44: providers of domain name registration services also supply information for the national register.
- Art. 5: the Act does not apply to these public bodies.
- Your organisation is not one of the types of entity in Annex 1 or 2, or is too small for them (art. 8 and 12).
Size under the EU SME definition: small or micro medium-sized large
What do you need to arrange?
- Register: supply your details for the national register of entities and report changes within two weeks (art. 44).
- Duty of care: take appropriate and proportionate measures in ten areas, from risk analysis and incident handling to backups, the supply chain and multi-factor authentication (art. 21).
- Board: the board approves the measures. By 15 August 2028 every board member has demonstrable knowledge and skills, backed by a training certificate; new board members within two years of their appointment (art. 24).
- Reporting: report a significant incident with an early warning within 24 hours, a notification within 72 hours and a final report within one month (art. 25 to 29).
- ENISA register: supply your details, including establishments and IP ranges, for the European register within one month of coming into scope, and report changes within three months (art. 47).
- Registration data: keep a database of accurate and complete domain name registration data and answer lawful access requests within 72 hours (art. 49 and 50).
No duties of your own under the Dutch Cybersecurity Act.
Supervision and fines
Supervision in advance and afterwards (art. 70 to 80). Fine for the organisation: up to €10 million or 2% of worldwide annual turnover, whichever is higher. For a board member personally: an order subject to a penalty, or a fine of up to €25,000 (art. 92 and 93).
Supervision afterwards, on an indication of a breach (art. 81 to 87). Fine for the organisation: up to €7 million or 1.4% of worldwide annual turnover, whichever is higher. For a board member personally: an order subject to a penalty, or a fine of up to €25,000 (art. 92 and 93).
Good to know
Several activities: the Act applies to the organisation as a whole. The strictest class is shown above; the duties cover all network and information systems you use for your operations or services.
Group: the class depends on the figures of the whole group. A small subsidiary of a large group is not small for this Act. Have this checked when in doubt.
Financial sector: if you fall under DORA (Regulation (EU) 2022/2554), its duty of care, board duties and incident reporting apply instead of those in the Dutch Cybersecurity Act (art. 22, art. 24(13) and art. 31); supervision of those follows DORA. Registration still applies. Organisations that DORA itself exempts are also outside this Act (art. 7).
Trust services: a significant incident that affects your trust service must be notified within 24 hours instead of 72 (art. 27(2)).
Public bodies: the ‘board’ is the minister, the provincial executive, the municipal executive or the executive committee (art. 24(12)). Suspension of board members and of licences does not apply to public bodies (art. 79).
Higher education: after designation, the duty of care and the board duties only apply 36 months later (art. 97).
Note: a minister can still designate a small organisation in this sector as an essential entity, for example as the sole provider of an indispensable service (art. 9). You would receive a decision about that.
As a supplier you will notice it anyway: customers in scope must secure their supply chain and take account of the vulnerabilities and security practices of each direct supplier (art. 21(3)(d) and (4)). Expect questionnaires, contract clauses and requests for evidence such as an ISO 27001 certificate.
Established outside the EU? If you do offer these services in the Netherlands, you must designate a representative in the EU (art. 42).
Your answers
- Sector
- Type of organisation
- Established in the Netherlands
- Offers telecom services in the Netherlands
- Main establishment or representative in the Netherlands
- Part of a group
- Staff
- Annual turnover
- Balance sheet total
- Special situations
This is an indication based on your own answers, not legal advice. Group structures, multiple activities or a possible designation can change the outcome. The text of the Act on wetten.overheid.nl prevails.
How does the Dutch Cybersecurity Act decide whether you are essential or important?
In short: the sector decides whether you are in scope, size usually decides how. Large organisations in a sector of high criticality are essential. Medium-sized organisations in those sectors, and medium-sized and large organisations in the other critical sectors, are important. Small organisations are usually out of scope.
| Sector | Small or microfewer than 50 FTE, and turnover or balance sheet total up to €10 million | Medium-sizedneither small nor large | Large250 FTE or more, or turnover above €50 million and balance sheet total above €43 million |
|---|---|---|---|
| Annex 1: energy, transport, banking, financial market infrastructure, healthcare, drinking water, waste water, digital infrastructure, ICT service management, public administration, space | Not in scope | Important | Essential |
| Annex 2: postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research | Not in scope | Important | Important |
Six exceptions to the size rule
- DNS service providers, top-level domain name registries and qualified trust service providers are always essential (art. 8(1)(a) to (c)).
- Providers of public telecom networks and services are already essential as a medium-sized enterprise, and important as a small one (art. 8(1)(d) and (e), art. 12(1)(c) and (d)).
- Non-qualified trust service providers are in scope at every size (art. 12(1)(e)).
- Ministries, provinces, municipalities and water boards are essential, as are autonomous administrative authorities and joint arrangements that qualify as a public body (art. 8(1)(g) and (h)).
- Critical entities under the Dutch Critical Entities Resilience Act are essential, in every sector and at every size (art. 8(1)(i)).
- A minister can designate organisations, including small ones, former operators of essential services and higher education institutions (art. 9 to 11 and art. 13).
Sources
- Cyberbeveiligingswet on wetten.overheid.nl (in Dutch): articles 4 to 13, 15, 21 to 31, 44 and 68 to 93, and Annexes 1 and 2.
- NIS2 Directive (EU) 2022/2555, which this Act implements in the Netherlands.
- Recommendation 2003/361/EC: the EU definition of small and medium-sized enterprises to which the Act refers.
