Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Your parent company or a branch is in another EU country. Which NIS2 law applies to you?

For a company established in the Netherlands that provides its services in the EU, the Dutch Cbw applies, even if the parent company is abroad. For your establishments in other Member States, the laws of those countries apply. Only for certain digital providers, such as cloud, data centre and managed IT service providers, does it matter where the main establishment is.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Ask a specialist

The main rule

The Cbw applies to essential and important entities that are established in the Netherlands and provide their services in the Netherlands or another Member State [1]. The establishment in the Netherlands is decisive, not the nationality of the shareholder.

Digital providers: the main establishment

For, among others, providers of cloud computing services, data centre services and managed (security) services, the Cbw applies if their main establishment or representative is in the Netherlands [2]. The main establishment is where the decisions on cybersecurity measures are mainly taken [3].

Size counts per group

Whether you are medium-sized or larger, you determine with the European SME definition, in which linked and partner enterprises may count. See the question on essential and important entities.

In practice

A group with establishments in several countries deals with several supervisory authorities and reporting points. Register the Dutch entity in the Dutch register and state there in which Member States you provide services [4].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Provide the required national-register information. Cbw 44(1), Cbb 27, NIS2 3(4)

Sources

  1. [1] Cbw Art. 4(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The Cbw applies to entities established in the Netherlands that provide their services in the Netherlands or another Member State. Original Dutch text:
    1. Het bepaalde bij of krachtens deze wet met betrekking tot essentiële entiteiten en belangrijke entiteiten is van toepassing op die entiteiten, indien zij in Nederland zijn gevestigd en hun diensten verlenen of hun activiteiten verrichten in Nederland of een andere lidstaat van de Europese Unie.
    Source, retrieved on 3 October 2026.
  2. [2] Cbw Art. 4(3) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). For certain digital providers, the main establishment or representative in the Netherlands counts. Original Dutch text:
    3. In afwijking van het eerste lid is het bepaalde bij of krachtens deze wet met betrekking tot essentiële entiteiten en belangrijke entiteiten van toepassing op de volgende entiteiten, indien zij hun hoofdvestiging of vertegenwoordiger in Nederland hebben en hun diensten verlenen of hun activiteiten verrichten in Nederland of een andere lidstaat van de Europese Unie: […] c. aanbieders van cloudcomputingdiensten; d. aanbieders van datacentrumdiensten; […] f. aanbieders van beheerde diensten; g. aanbieders van beheerde beveiligingsdiensten;
    Source, retrieved on 3 October 2026.
  3. [3] Cbw Art. 4(5) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). The main establishment is where the decisions on cybersecurity measures are mainly taken. Original Dutch text:
    5. Een entiteit als bedoeld in het derde of vierde lid wordt geacht haar hoofdvestiging in Nederland te hebben indien de beslissingen met betrekking tot de maatregelen voor het beheersen van cyberbeveiligingsrisico’s hoofdzakelijk in Nederland worden genomen.
    Source, retrieved on 3 October 2026.
  4. [4] Cbw Art. 44(1) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). For the register, the entity states in which Member States it provides its services. Original Dutch text:
    d. indien van toepassing, een vermelding van de lidstaten van de Europese Unie waar de entiteit haar diensten als bedoeld in bijlage 1 of bijlage 2 van deze wet verleent;
    Source, retrieved on 3 October 2026.

Related questions

Is your company an essential or an important entity?Must you register your company under the Cyberbeveiligingswet, and when?Which Cbw rules apply if you are a cloud or IT service provider for logistics?Which transport and logistics companies fall under the Cyberbeveiligingswet?

Next step

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed. Describe your question; we reply within one working day.

Ask a specialist

Not sure whether the Cbw applies to your business? Take the Cbw check (in Dutch).

This page gives general information based on the text of the law. It is not legal advice for your situation.