AI answer written only from the numbered passages below
The Cyberbeveiligingswet (Cbw), the Dutch transposition of the EU NIS2 directive, entered into force on 15 August 2026, later than the government's 1 July 2026 target and the EU's original 17 October 2024 transposition deadline 1. From that date roughly 8,000 Dutch organisations are expected to fall in scope, and energy — electricity generation, transmission and supply, and by extension offshore wind and oil & gas operators — is designated an 'essential' sector 1. The law imposes three obligations: a duty of care (appropriate technical and organisational measures based on a risk assessment), a phased incident-reporting duty (early warning within 24 hours of a significant incident, fuller notification within 72 hours, final report within a month), and registration with the competent authority 2. Management-body liability is explicit: the board must approve the measures and oversee compliance, and can be held accountable for failing to do so 2. Supervision lies with sectoral regulators together with the Rijksinspectie Digitale Infrastructuur (RDI) 2.
Not in the sources: The passages do not set out size or turnover thresholds for which specific energy companies are in scope, nor any sanctions or fines.
Cited passages
Passage 1: It is now in force
The Cyberbeveiligingswet (Cbw), the Dutch transposition of the EU NIS2 directive, entered into force on 15 August 2026 — later than the government's own 1 July 2026 target and much later than the EU's original 17 October 2024 transposition deadline. Roughly 8,000 Dutch organisations are expected to fall in scope from that date. Energy — including electricity generation, transmission and supply, and by extension offshore wind and oil & gas operators — is one of the sectors NIS2 designates as 'essential', alongside transport, digital infrastructure and several others.
The Cyberbeveiligingswet: NIS2 becomes Dutch law (energy-sector angle)Rijksoverheid.nl / NCTV, with explanatory text adapted from trusq's Cyberbeveiligingswet page · rijksoverheid.nl · retrieved 18 Sep 2026
Passage 2: Three core duties
The law rests on three obligations: a duty of care (appropriate technical and organisational measures based on a risk assessment), a phased incident-reporting duty (an early warning within 24 hours of a significant incident, a fuller notification within 72 hours, and a final report within a month), and a registration duty with the competent authority. Management-body liability is explicit: the board must approve the measures, oversee compliance, and can be held accountable for failing to do so. Supervision sits with sectoral regulators together with the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI).
The Cyberbeveiligingswet: NIS2 becomes Dutch law (energy-sector angle)Rijksoverheid.nl / NCTV, with explanatory text adapted from trusq's Cyberbeveiligingswet page · rijksoverheid.nl · retrieved 18 Sep 2026
Sources consulted
- The Cyberbeveiligingswet: NIS2 becomes Dutch law (energy-sector angle)Rijksoverheid.nl / NCTV, with explanatory text adapted from trusq's Cyberbeveiligingswet page · rijksoverheid.nl · retrieved 18 Sep 2026 · cited
General information from public sources, not legal advice. Passages are our own-words summaries of the linked publications; follow the link for the authoritative text.