On 15 August 2026, the Netherlands brought into force the Cyberbeveiligingswet (Cbw), its national transposition of the NIS2 Directive, with no grace period of any kind. Eight thousand organisations moved on the same day from being out of scope to being obliged entities. For French organisations with a subsidiary, a provider or a partner operating in the Netherlands, this date has an immediate significance. For those still waiting for the Loi Résilience, it means something else: this is what a NIS2 transposition looks like when it arrives.
Eight thousand organisations subject to binding obligations from day one
Under the first NIS Directive, the Netherlands had around 1,000 regulated entities. The Cyberbeveiligingswet counts more than 8,000 (source: Dutch government, press release of 7 July 2026). This massive widening of scope reflects NIS2's core ambition: to cover not only traditional operators of vital importance, but also the medium-sized companies that structure sector value chains.
The size criterion is the same as in the European directive: at least 50 employees, or annual turnover or a balance sheet total above 10 million euros, in one of the 18 sectors listed in Annexes I and II of NIS2. The covered sectors include energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, managed digital services, space, public administration, and several sectors classed as important.
No adaptation period was provided. The law was adopted by the Dutch Senate on 7 July 2026, promulgated straight after, and its obligations took effect on 15 August, five weeks later. Entities in scope had to be compliant on the date of entry into force, not in the months that followed.
What the Cbw concretely requires
The Cyberbeveiligingswet breaks down into four obligations that any reader familiar with NIS2 will recognise, since it is a faithful transposition of the directive.
The registration obligation. Entities in scope must register in a national register managed by the competent supervisory authority. This registration is not a mere formality: it confirms that the entity has taken note of its obligations, and it is the starting point of the dialogue with the authority.
The risk management obligation. The entity must put in place security measures suited to the risks facing its information systems. The directive lists ten categories of minimum measures: incident handling, business continuity, supply chain security, network security, access control, encryption, vulnerability management, assessment of measure effectiveness, cyber hygiene and personnel security policies.
The incident notification obligation. In the event of a significant incident, the entity notifies the competent national authority within 24 hours (early warning), within 72 hours (full notification), and submits a final report within one month. These deadlines are identical in all national transpositions, because they are set by the directive itself.
The liability of executives. The Cbw explicitly introduces the personal liability of members of management: an executive may be held personally responsible for a breach of security obligations if it is established that they did not take them seriously. This mechanism is one of the most structural changes NIS2 brings compared with the first directive.
What this transposition reveals for French organisations
Two populations are directly concerned.
French organisations present in the Netherlands. A medium-sized Dutch subsidiary with 50 employees in digital services has been subject to the Cbw since 15 August. If it is not registered, has not put risk management measures in place, and has no incident notification process, it has been in breach since that date. The French parent company often carries this risk indirectly: group compliance requirements are rising, and a subsidiary's non-compliance can weigh on tenders, supplier audits or due diligence.
French organisations waiting for the Loi Résilience. The Dutch example shows that NIS2 leaves no adaptation period after promulgation. When the law takes effect, the obligations apply. The Loi Résilience is on the National Assembly's agenda from 7 October 2026: the detail of this timetable is analysed in the article on what the coming days require from your NIS2 programme. If the law is promulgated quickly after its vote, the window between promulgation and effective obligation will be very short.
A gap between Member States that creates operational asymmetry
One aspect rarely discussed deserves attention. As of 28 September 2026, three Member States have not yet adopted their NIS2 transposition: France, Ireland and Spain. All three were referred to the Court of Justice of the European Union by the European Commission on 8 July 2026 for failure to transpose, with a request for financial penalties.
This asymmetry creates an uneven situation for companies operating in several European countries. A French mid-sized company present in the Netherlands, Germany and Poland, three countries that have transposed NIS2, is subject to three distinct national regimes, with local variations in penalties, competent authorities and notification procedures. It has no regulated-entity status in France, since the French law does not yet exist.
This creates a real operational burden. Compliance teams must monitor not one regime but several, whose local requirements may diverge on the margins the directive leaves to Member States. The directive sets floors for penalties (10 million euros or 2% of turnover for essential entities; 7 million euros or 1.4% for important entities), but Member States may set higher ceilings.
Three checks to carry out before the end of the month
The Cyberbeveiligingswet is in force. The French Loi Résilience could follow by the end of the year. Here are the points to check now.
Map the group entities subject to a NIS2 transposition already in force. The Netherlands, Germany, Italy, Poland, Sweden, Croatia: subsidiaries in these countries are under an active regime. Their registration status and level of compliance with local obligations should be verified.
Identify the regime applicable to each entity. National transpositions diverge on several points: precise size thresholds, list of covered sectors, competent supervisory authorities, specific notification mechanisms. A country-by-country mapping avoids blind spots.
Assess whether your incident management systems can meet NIS2 deadlines. The 24-hour deadline for early warning is identical in every country that has transposed the directive. If your process for detecting, qualifying and notifying incidents cannot meet this deadline, the problem is not geographic: it is structural, and it will concern your French entity as soon as the Loi Résilience is promulgated.