The revised Cybersecurity Act is expected to take effect on July 1, 2026. This legislation incorporates the European NIS2 Directive, which will also apply in the Netherlands from that date onward. The implementation of the NIS2 Directive marks an important milestone in strengthening cybersecurity within the European Union. Effective July 1, 2026, organizations in critical and important sectors will be required to systematically improve their digital resilience.
Mandatory Reporting
In addition to managerial liability and the duty of care, the timely reporting of incidents is a component of the NIS2 Directive, or the Cybersecurity Act. The obligation to report incidents is intended to help make the digital society more resilient. After all, cyber incidents do not stop at the boundaries of a single organization—they often impact entire supply chains and sectors.
Transparency within 24 hours
By reporting incidents in a timely manner (an initial report within 24 hours), insights into threats can be gained more quickly. This enables regulators and other organizations to take proactive measures and limit further damage. Transparency thus contributes directly to the collective cybersecurity of supply chains and sectors.
An administrative burden?
The reporting requirement may be seen as an administrative burden for SMEs and small organizations, but without clear detection, classification, and escalation, it is simply impossible to report incidents in a timely manner. A pragmatic solution is a simpler incident response process that is well-suited to the needs of SMEs and small organizations.
By using predefined classifications, simple reporting formats, and clear escalation paths, the complexity of the reporting requirement is significantly reduced. By intelligently designing the incident management process and automating it where possible, the reporting requirement transforms from an administrative challenge into a manageable component of a mature and future-proof IT organization.
In short, the reporting requirement in the Cybersecurity Act is not merely a “compliance check,” but an essential step toward a more transparent, resilient, and collaborative digital ecosystem capable of withstanding cyber threats.
Want to know more?
Would you like to learn more, with no obligation, about what the Cybersecurity Act or the NIS2 Directive means for your organization? Or could you use support in conducting the self-assessment or drafting the plan? Govers can assist you with this. Our specialists have experience implementing similar regulatory frameworks in the areas of information security and privacy. Please contact Rolijn van Vught (rolijn.vanvught@govers.nl) for more information.