NIS2 has been the subject of enough delayed transpositions and moved deadlines across the EU that it would be reasonable for a compliance team to have stopped tracking the calendar closely. The Netherlands just gave that team a reason to look again: the Dutch Senate approved the Cyberbeveiligingswet on 7 July 2026, and the law takes effect on 15 August 2026 with no grace period attached.
What changes on 15 August
From that date, organisations in scope, essential and important entities across sectors including energy, transport, healthcare, digital infrastructure and public administration, along with domain name registration service providers, are legally required to register with the National Cyber Security Centre through its portal at mijn.ncsc.nl. Registration has been available on a voluntary basis in the run-up to the deadline; after 15 August it is mandatory, with more than 8,000 organisations estimated to fall within scope. Alongside registration, the law imposes risk-based security measures, incident reporting obligations and, notably, a requirement for board-level oversight of cybersecurity, moving the topic explicitly out of the IT department and into governance.
The rest of Europe is not moving in step
The Netherlands reaching the finish line does not mean the directive is landing evenly across the bloc. On 8 July 2026, the European Commission referred Ireland, Spain, France and the Netherlands’ neighbours to the Court of Justice of the EU for failing to fully transpose NIS2 into national law, with financial sanctions requested against each. For a business operating across multiple EU member states, this creates a genuinely uneven compliance landscape: obligations, deadlines and enforcement postures now differ country by country, even though the underlying directive is meant to harmonise exactly that.
What this means if you have any Dutch footprint
If your organisation operates in the Netherlands and falls within a NIS2 sector, even as a subsidiary or service provider rather than the primary regulated entity, the practical question is not whether NIS2 applies eventually, it is whether registration and board-level oversight are in place before 15 August. Given that there is no grace period, organisations that assumed they had more runway because other member states are still transposing the directive are the ones most likely to be caught out. Beyond registration, this is also a useful forcing function to confirm that incident reporting workflows, risk assessments and vendor oversight processes are actually documented rather than assumed, since a registration requirement with real teeth tends to be followed by supervisory attention.
If you need help determining whether your organisation falls within NIS2 scope in the Netherlands or elsewhere in the EU, registering with the appropriate authority, or building the risk management and incident reporting processes the directive requires, contact Excello Digital. We help European businesses turn NIS2 compliance from a looming deadline into a completed checklist.