Dutch Cyberbeveiligingswet (Cbw) in force since 15 August 2026

Since 15 August 2026, essential entities (Cbw Art. 8) and important entities (Art. 12) must take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems (duty of care, Art. 21); those measures require the approval of the management body (Art. 24(1)). They provide their details for the national register kept by the Minister (Arts 43 and 44(1)) and report any change within two weeks (Art. 44(2)). A significant incident is reported to the entity's CSIRT and competent authority: an early warning without undue delay or, if that is not possible, within 24 hours after awareness (Art. 26(1)) and a notification without undue delay or, if that is not possible, within 72 hours after awareness (Art. 27(1)). A trust service provider notifies without undue delay or, if that is not possible, within 24 hours after awareness where the incident affects its trust service (Art. 27(2)). Every reporting entity submits a final report no later than one month after the notification (Art. 29(1)); if the incident is still ongoing then, it submits a progress report at that point and the final report within one month after handling the incident (Art. 29(2)). For transport, officials of the Human Environment and Transport Inspectorate (ILT) supervise compliance (Stcrt. 2026, 24155).

For transport and logistics entities in scope, the duty of care, registration and incident reporting apply from the date of entry into force. Board members already in office on 15 August 2026 have until 15 August 2028 to meet the knowledge and skills requirement, and later appointees two years from appointment (Cbw Art. 24(3)), but the management body's approval of the measures (Art. 24(1)) applies now.

Entities of a type listed in Annex 1 (transport among them) or Annex 2 to the Cbw that qualify as essential or important entities under Articles 8 and 12, and the members of their management bodies.