The Cybersecurity Act is the Dutch implementation of the European NIS2 directive. The House of Representatives passed the proposal on April 15, 2026, the Senate on July 7, and the law came into force on August 15, 2026. Over eight thousand Dutch organizations are directly affected, in sectors such as energy, drinking water, healthcare, transport, government, and digital infrastructure. There is no transition period: the obligations applied from day one.
Your security is in place. Can you prove it?
What the Cybersecurity Act has required of you since August 15, 2026, and why most organizations don’t struggle with security, but with evidence.
Cybersecurity Act: these are the measures you need to take
You have backups. Access management with MFA (multi-factor authentication). Agreements with your hosting provider. Someone who calls if something goes wrong. Ask the team, and the answer is: yes, it’s all arranged. Then a client or regulator asks if you can prove it. When was that recovery procedure last tested? Who owns that process? Where is the agreement with that supplier documented? Everything exists, but it’s scattered across four people, three folders, and a few conversations that were never written down.
That difference—between having things in place and being able to prove it—is what the Cybersecurity Act is about. In this blog, we explain exactly what the law requires, why evidence is the real bottleneck, and what happens if you’re not directly subject to the law but supply to someone who is.
Author: Allard Rothengatter
Published: 13 October, 2026
What applies since August 15
The law has three obligations:
The registration requirement
Those covered by the law must register in the entity register via mijn.ncsc.nl.
The duty of care
Appropriate technical, operational, and organizational measures to manage risks, detailed in the Cybersecurity Decree and further specified per sector. This explicitly includes the security of your supply chain.
The notification obligation
In the event of a significant incident, an early warning must be given within 24 hours, a detailed report within 72 hours, and a final report within a month. If the incident affects your customer services, you must inform them as well.
Possible sanctions
The penalties are substantial. For essential entities, fines can reach up to 10 million euros or 2 percent of global annual turnover; for important entities, up to 7 million or 1.4 percent. The responsibility lies explicitly with the board: they must approve the measures, undergo training, and can be fined or face an enforcement order themselves.
One nuance often missing from summaries: the law does not prescribe a specific standard or certification. ISO 27001 is not mandatory. What matters is whether your measures are appropriate to your risks and whether you can substantiate that.
In place is not the same as provable
In the regulatory language of the RDI (Dutch Digital Infrastructure Inspectorate, one of the regulators for the Cybersecurity Act), one word keeps coming up: demonstrable. You must demonstrably manage your risks. This isn’t legal fluff—it’s the core issue.
Because almost every organization follows the same pattern. The measures exist. They were once implemented by someone who knew why. But they’re not brought together anywhere, no one is formally responsible, and there’s no set moment for checking if everything is still correct. On the day you’re asked for evidence, you have to reconstruct it—and reconstructing under time pressure is exactly when you discover that the recovery procedure hasn’t been tested since last year.
The RDI uses its own supervisory framework. After an inspection, the inspector discusses the findings with you and can require you to create an improvement plan. Only then do sanctions come into play. That sounds lenient, and in a sense it is. But it also means the first question you’ll get is a request for evidence, and from that moment on, your position depends on what you can put on the table.
"The question is rarely whether something is arranged. The question is who knows about it, where it’s documented, and when it was last checked."
– Allard Rothengatter, CEO van Dolphiq
Where things break down in practice
Four patterns we keep seeing, both in ourselves and with clients.
Outdated evidence
1
The documents exist
But they’re two years out of date
A recovery test, a risk analysis, a supplier assessment: all done at some point. Without a review moment, they quietly expire. A document without a last review date is worth little in a conversation with a regulator or client.
No owner
2
Everyone thinks someone else is doing it
So no one does it
Without a name next to a measure, it gets left behind when things get busy. This is also why audit improvement points are often still open a year later.
Verbal agreements
3
You trust each other
But trust isn’t evidence
Your hosting provider calls you if something’s wrong. Fine, but is that notification period also in the contract? This is where supply chain security often fails in practice: the agreement exists, just not on paper.
An untested notification process
4
Twenty-four hours is shorter than you think
Especially on a Friday night
The first deadline starts as soon as you become aware of the incident. Someone must be able to assess whether it’s significant and know where to report it. That only works if the process exists and has been run through at least once.
Your client is covered, you’re not
This is where it gets real for many companies. The duty of care also requires organizations to arrange the security of their supply chain, including relationships with their direct suppliers and service providers. Since August, that means mail: questionnaires, certification requirements, new contract clauses.
Here’s what’s rarely said out loud: if you’re not directly covered by the law, the law doesn’t impose obligations on you. The NCSC puts it plainly: suppliers not directly covered can still expect requirements from clients who are. So you negotiate requirements—you’re not enforcing the law. That distinction sets the tone for the conversation, and it also means the requirements must be proportional to what you deliver. Still, it’s wise to take the question seriously, and not for legal reasons. A client who can’t get evidence from you has a problem in their own file.
In tenders and contract renewals, that’s a reason to choose someone else. Before you conclude the law doesn’t apply to you, here’s one sector from Annex 1 that’s often overlooked: management of ICT services between companies, including providers of managed services and managed security services. That category counts as an essential entity, with proactive supervision by the RDI. The threshold is fifty employees, with figures from affiliated companies included. So a small operating company within a larger group can still fall under the law. If you’re a financial entity, you’re actually exempt under Article 7 and DORA applies instead.
"You negotiate requirements—you’re not enforcing the law. That makes a big difference in the tone of the conversation."
– Allard Rothengatter, CEO van Dolphiq
Why we do it even though we don’t have to
Dolphiq is not subject to the Cybersecurity Act. Twelve people, about a million in revenue: we’re well below every threshold. Still, we chose to set things up and comply.
Not because we thought we had to. But because we’re on the receiving end of those questionnaires, and because we found exactly the problem described above in our own organization. We already had a lot: supplier assessments, access policy, data policy, AI policy, a process for reporting incidents. But it was fragmented. The content was there, but not the overview. If asked to "show us," it would have taken us an afternoon.
That’s also why we started building software for it: to get insight into where we stand and keep track of what still needs to be done. The same reason we run AI-generated code through the same checks as hand-written code: if something matters to you, you need to be able to point to it.
How to make your security demonstrable
Whether you’re covered by the law or not, the practical steps are the same. Map out which measures you have and where the evidence for them is. Assign a name to each. Agree on when it will be reviewed again. And run through your notification process before you actually need it.
This isn’t a compliance project. It’s simply knowing where you stand, and that’s always a good thing.
Want to discuss where your organization stands, or what to do with the questionnaire that landed on your desk? Get in touch. We’re happy to help, even if the outcome is that you don’t need us.