Skip to content

Knowledge base · Cbw/NIS2 for transport and logistics

Since when does the Cyberbeveiligingswet apply, and is there a transitional period?

The Cyberbeveiligingswet and the Cyberbeveiligingsbesluit have applied since 15 August 2026. There is no transitional period for the duty of care, the reporting duty and registration; only members of the management body have until 15 August 2028 to meet the knowledge requirement.

In force now (since 15 August 2026)Trusq editorial · checked against the official textLast verified:

Next step: Take the Cbw check (in Dutch)

The date

The act and the decree entered into force at the same time, on 15 August 2026 [1]. From that date the duty of care, the reporting duty and the registration duty apply to essential and important entities.

The only deadline for companies

Members of the management body who were in office at the entry into force have two years to meet the knowledge and skills requirement: until 15 August 2028 [2].

What that means now

Anyone covered by the Cbw must therefore be able to show the measures already now. Start with the registration, a risk analysis and a working reporting procedure.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Organisation: Maintain security and risk-management policies. NIS2 21(2)(a), Cbw 21(3)(a)
  • Organisation: Ensure board members have the required knowledge and skills. Cbw 24(2), Cbw 24(3), NIS2 20(2)

Sources

  1. [1] Cbb Art. 35 (Dutch Cyberbeveiligingsbesluit (Cbb); Dutch law, unofficial translation). Entry into force on 15 August 2026. Original Dutch text:
    De Cyberbeveiligingswet en dit besluit treden in werking met ingang van 15 augustus 2026.
    Source, retrieved on 2 October 2026.
  2. [2] Cbw Art. 24(3) (Dutch Cyberbeveiligingswet (Cbw); Dutch law, unofficial translation). Two years for members of the management body. Original Dutch text:
    3. Ieder lid van het bestuur van een essentiële entiteit of belangrijke entiteit voldoet binnen twee jaar na de inwerkingtreding van het tweede lid aan het bepaalde in het tweede lid.
    Source, retrieved on 2 October 2026.

Related questions

Must you register your company under the Cyberbeveiligingswet, and when?When must a director have completed the Cbw training and what is on the certificate?What does the duty of care of the Cyberbeveiligingswet involve?When and where do you report a significant incident under the Cbw?What is the difference between NIS2 and the Cyberbeveiligingswet?

Next step

Six questions about the activities and size of your business. You see at once whether the Cbw probably applies to you, as an essential or important entity, through which sector and under which ministerial regulation. You do not have to enter any data. The check is in Dutch.

Take the Cbw check (in Dutch)

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.