First Chamber votes in favor: cyber laws will enter into force this summer

The Dutch Senate has approved the Cyber Security Act (Cbw) and the Act on the Resilience of Critical Entities (Wwke), marking a significant advancement in the nation's digital and physical resilience. These legislative measures are designed to bolster the defenses of numerous organizations against escalating cyber threats, reflecting a broader European push towards enhanced digital sovereignty and security. The laws, set to take effect on August 15, 2026, will introduce mandatory cybersecurity requirements for a substantial number of entities across the Netherlands. Under the new regulations, over 8,000 organizations, including ministries, municipalities, water boards, provinces, and various independent administrative bodies, will face stringent cybersecurity obligations. Those designated as critical entities under the Wwke will be formally recognized as such, necessitating adherence to specific protective measures. The Cbw introduces a registration obligation for affected organizations with the National Cyber Security Centre (NCSC), a duty of care for risk management and incident mitigation, and a mandatory reporting system for significant cyber incidents to swiftly inform relevant authorities. The legislation places direct administrative responsibility on organizational leadership for cyber risk management, requiring them to possess adequate knowledge and undergo appropriate training. This emphasis on governance underscores the critical role of leadership in fostering a robust cybersecurity posture. Furthermore, supervisory bodies like the State Inspectorate for Digital Infrastructure will actively monitor compliance, ensuring that organizations meet their legal obligations under these new cyber laws.