It is now confirmed: the Cybersecurity Act will come into force on 15 August 2026. Around 10,000 Dutch organisations will fall directly within the scope of the Act. However, many suppliers will also face new cybersecurity requirements.
NIS2 also affects suppliers
The Cybersecurity Act is the Dutch implementation of the European NIS2 Directive. Organisations that fall within the scope of the Act must take appropriate measures to manage cyber risks and be able to demonstrate that their cybersecurity is in order.
They must also manage risks within their supply chains. After all, a cyber incident involving a supplier can lead to system outages, data loss or disruption to critical business processes.
Suppliers can therefore expect to face questions such as:
- What security measures have been implemented?
- How are systems and data protected?
- What happens in the event of a cyber incident?
- Can you demonstrate that measures have actually been implemented?
Even if your organisation does not fall directly within the scope of NIS2, you may still face these requirements through your customers.
Demonstrable cybersecurity is becoming increasingly important
Simply stating that you operate securely is no longer enough. Customers increasingly want to see evidence, for example through policies, reports, audits or independent certification.
NIS2 Supply Chain helps organisations demonstrate their cybersecurity at a level appropriate to the supplier risk:
- SC10 for a limited risk profile;
- SC20 for an elevated risk profile;
- SC30 for a high or critical risk profile.
Don’t wait until 15 August
Now is the time to determine whether your organisation falls directly within the scope of NIS2 or supplies organisations subject to the Cybersecurity Act. Review which measures are already in place, where improvements are needed and how you can demonstrate effective implementation.
15 August 2026 is the date on which the obligations take effect, not the date to start preparing.
