Dutch Parliament Approves Cybersecurity Act to Implement NIS2 Directive

• •The Dutch Cybersecurity Act implements the EU NIS2 Directive.
• •Organizations must adhere to strict cybersecurity risk management and reporting obligations.
• •Management can be held personally accountable for non-compliance with the new regulations.

On April 15, 2026, the Dutch Parliament approved the Cybersecurity Act, which implements the EU NIS2 Directive. This act introduces extensive cybersecurity obligations for essential and important entities across sectors such as energy, transport, and healthcare. Key requirements include risk management measures, governance accountability, and mandatory incident reporting. Management bodies may face personal accountability for non-compliance, and enforcement authorities have been granted supervisory powers. The act aligns closely with NIS2, ensuring organizations in the Netherlands will face familiar compliance requirements. Notable amendments include a requirement for additional cybersecurity measures to be submitted to Parliament before implementation. The act aims to enhance the cybersecurity posture of critical infrastructure in the Netherlands.