Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Is your company an essential or an important entity?

A company in a sector of Annex 1 that is larger than medium-sized (250 or more employed persons, or annual turnover of more than 50 million euros and a balance sheet total of more than 43 million euros) is an essential entity. A medium-sized company in Annex 1, and a medium-sized or larger company in Annex 2 (such as postal and courier services), is an important entity. Small and micro enterprises are as a rule not covered, unless the minister designates them as essential entities. A company designated as a critical entity under the Wet weerbaarheid kritieke entiteiten (Wwke) is always an essential entity, regardless of size.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Take the Cbw check (in Dutch)

The two categories

Essential by operation of law are, among others, the entities in Annex 1 that exceed the threshold for medium-sized enterprises [1]. Important are entities in Annex 1 that are medium-sized, and entities in Annex 2 that are medium-sized or larger [2].

What is medium-sized?

The Cbw refers to the European SME definition. An SME has fewer than 250 employed persons and an annual turnover of at most 50 million euros or a balance sheet total of at most 43 million euros; a small enterprise has fewer than 50 employed persons and a turnover or balance sheet total of at most 10 million euros [3]. Medium-sized is an SME that is not a small or micro enterprise. Partner and linked enterprises count: linked enterprises in full, partner enterprises in proportion to the interest [5]. A small transport company in a group can therefore still be medium-sized.

Designation

Regardless of size, the minister can designate an entity from Annex 1 or 2 as an essential entity, for example if it is the only provider of an essential service in the Netherlands or if disruption could have significant consequences [4]. An entity designated as a critical entity under the Wet weerbaarheid kritieke entiteiten is an essential entity by operation of law, regardless of its size [6].

Why the difference matters

The duties (duty of care, reporting duty, registration, management body) are the same for both categories. The difference lies in supervision and the maximum fines.

Sources

  1. [1] Cbw Art. 8(1)(f) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Essential entities by operation of law: entities in Annex 1 above the medium-sized threshold. Original Dutch text:
    1. De volgende entiteiten zijn essentiële entiteiten: […] f. andere entiteiten, genoemd in bijlage 1 van deze wet, die de in artikel 2, eerste lid, van de bijlage bij Aanbeveling 2003/361/EG bedoelde drempel voor middelgrote ondernemingen overschrijden;
    Source, retrieved on 2 October 2026.
  2. [2] Cbw Art. 12(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Important entities by operation of law. Original Dutch text:
    1. De volgende entiteiten zijn belangrijke entiteiten: a. entiteiten, genoemd in bijlage 1 van deze wet, niet zijnde een essentiële entiteit, die in aanmerking komen als middelgrote onderneming uit hoofde van artikel 2 van de bijlage bij de Aanbeveling 2003/361/EG; b. entiteiten, genoemd in bijlage 2 van deze wet, niet zijnde een essentiële entiteit, die in aanmerking komen als middelgrote onderneming uit hoofde van artikel 2 van de bijlage bij de Aanbeveling 2003/361/EG of de in het eerste lid van laatstgenoemd artikel vastgestelde drempels voor middelgrote ondernemingen overschrijden;
    Source, retrieved on 2 October 2026.
  3. [3] Recommendation 2003/361/EC, Annex, Article 2 (Commission Recommendation 2003/361/EC (definition of SMEs)). The SME thresholds from the annex to Recommendation 2003/361/EC.
    1. The category of micro, small and medium-sized enterprises (SMEs) is made up of enterprises which employ fewer than 250 persons and which have an annual turnover not exceeding EUR 50 million, and/or an annual balance sheet total not exceeding EUR 43 million. 2. Within the SME category, a small enterprise is defined as an enterprise which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million.
    Source, retrieved on 2 October 2026.
  4. [4] Cbw Art. 9(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Designation as an essential entity on the basis of criteria. Original Dutch text:
    1. Bij regeling of besluit van Onze Minister die het aangaat, na overleg met Onze Minister, wordt een in bijlage 1 of bijlage 2 van deze wet genoemde entiteit aangewezen als essentiële entiteit, op grond van de toepasselijkheid van één of meer van de volgende criteria: a. de entiteit is in Nederland de enige aanbieder van een dienst die essentieel is voor de instandhouding van kritieke maatschappelijke of economische activiteiten; b. verstoring van de door de entiteit verleende dienst kan aanzienlijke gevolgen hebben voor de openbare veiligheid, de openbare beveiliging of de volksgezondheid; c. verstoring van de door de entiteit verleende dienst kan een aanzienlijk systeemrisico met zich brengen, met name voor sectoren waar een dergelijke verstoring een grensoverschrijdende impact kan hebben;
    Source, retrieved on 2 October 2026.
  5. [5] Recommendation 2003/361/EC, Annex, Article 6(2) (Commission Recommendation 2003/361/EC (definition of SMEs)). Data of partner and linked enterprises are added together.
    To the data referred to in the first subparagraph are added the data of any partner enterprise of the enterprise in question situated immediately upstream or downstream from it. Aggregation is proportional to the percentage interest in the capital or voting rights (whichever is greater). In the case of cross-holdings, the greater percentage applies. To the data referred to in the first and second subparagraph is added 100 % of the data of any enterprise, which is linked directly or indirectly to the enterprise in question, where the data were not already included through consolidation in the accounts.
    Source, retrieved on 2 October 2026.
  6. [6] Cbw Art. 8(1)(i) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Critical entities under the Wwke are essential entities by operation of law. Original Dutch text:
    1. De volgende entiteiten zijn essentiële entiteiten: […] i. kritieke entiteiten als bedoeld in artikel 6, eerste lid, van de Wet weerbaarheid kritieke entiteiten.
    Source, retrieved on 22 October 2026.

Related questions

Is my road transport company covered by the Cyberbeveiligingswet?Which transport and logistics companies fall under the Cyberbeveiligingswet?Who supervises the Cbw in transport and logistics, and how high are the fines?Must you register your company under the Cyberbeveiligingswet, and when?Your parent company or a branch is in another EU country. Which NIS2 law applies to you?

Next step

Six questions about the activities and size of your business. You see at once whether the Cbw probably applies to you, as an essential or important entity, through which sector and under which ministerial regulation. You do not have to enter any data. The check is in Dutch.

Take the Cbw check (in Dutch)

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.