The Cybersecurity Act has applied since 15 August 2026. It is the Dutch implementation of the European NIS2 Directive. The act imposes duties on more than 8000 organisations in the Netherlands. Organisations must check for themselves whether they are covered (Dutch Government, 7 July 2026).
For an IT company there are two questions. Are you covered yourself, for example as a provider of managed IT for clients? And what do clients who are covered ask of you as a supplier? For most small IT companies the second question matters most.
In short
- Providers of managed IT services and managed security services are covered if they are medium-sized or large. DNS service providers and some other digital services always.
- If you are covered, you register with the NCSC, take appropriate measures, give early warning of a significant incident within 24 hours and full notification within 72 hours, and the board follows training.
- A smaller IT company has no duties of its own under the act. Clients who are covered must assess their direct suppliers and can ask for measures and evidence.
In this article
- Is your IT company covered by the Cybersecurity Act?
- When is your company medium-sized?
- What must you do if you are covered?
- What if you are too small, but your clients are covered?
- Which requirements can you expect in contracts?
- How does this relate to a data breach under the GDPR?
- What does the Cyber Resilience Act mean for software companies?
Is your IT company covered by the Cybersecurity Act?
That depends on what you do and how large you are. In annex 1 the act lists the sector of ICT service management, with providers of managed services and providers of managed security services. Under digital infrastructure it lists, among others, providers of cloud services, data centre services and DNS service providers (Cybersecurity Act, annex 1).
A provider of managed services is a company that installs, manages, operates or maintains ICT products, networks, infrastructure or applications, at the client's site or remotely (Cybersecurity Act, article 1). That is what many IT management firms and MSPs do. MSP stands for managed service provider.
Such a company is an important entity if it is medium-sized, and an essential entity if it is larger than medium-sized (Cybersecurity Act, articles 8 and 12). Qualified trust services, top-level domain registries and DNS service providers are always essential, regardless of their size (Cybersecurity Act, article 8(1)).
A software company that only builds custom software and manages nothing is not on the list. If you build software and also manage it for clients, or host it, you may fall under ICT service management or cloud services. Look at what you actually do. The NCSC says you choose the sector in which your organisation itself is active, not the sector of your clients (NCSC, registering).
When is your company medium-sized?
The act refers to the European definition of a medium-sized enterprise (Cybersecurity Act, article 12(1)). In the NCSC diagram an organisation with fewer than 50 employees is small, unless both annual turnover and balance sheet total exceed € 10 million. With 50 to 249 employees it is medium-sized (NCSC, information brochure on the Cybersecurity Act, February 2026).
The KVK summarises it like this: it usually concerns companies with at least 50 employees and more than € 10 million annual turnover, but the act can also apply to smaller companies (KVK, Cybersecurity Act). An IT management firm with 20 people is therefore usually not covered itself, one with 60 people is.
What must you do if you are covered?
You register in the national register of entities at mijn.ncsc.nl, with eHerkenning at level EH2+, and report changes within 14 days (NCSC, registering). For ICT service management and digital infrastructure the Dutch Authority for Digital Infrastructure (RDI) supervises (RDI, 15 August 2026).
You take appropriate and proportionate technical, operational and organisational measures. The act lists as a minimum, among others, risk analysis, incident handling, back-ups and recovery plans, the security of your supply chain, secure development and maintenance, cyber hygiene and training, encryption, access policy and where appropriate multi-factor authentication (Cybersecurity Act, article 21).
In a significant incident you give an early warning without delay, and at the latest within 24 hours, to your CSIRT and your supervisor. The notification follows within 72 hours (Cybersecurity Act, articles 26 and 27). A CSIRT is the team that handles incidents, in the Netherlands through the NCSC.
The board must approve the measures. Each board member must be able to recognise and assess risks, and within two years holds a certificate of training. If a holding company is director, this applies to the person who sits on the board on behalf of the holding (Cybersecurity Act, article 24). For an owner-director with an operating company that means: you.
The fines are high. For an important entity at most € 7,000,000 or 1.4% of worldwide annual turnover, if that is higher. For an essential entity € 10,000,000 or 2% (Cybersecurity Act, articles 80 and 87).
What if you are too small, but your clients are covered?
Then you have no duties of your own, but you do have requirements from your clients. The NCSC writes that the act imposes no obligations on suppliers, but that organisations under the act are likely to set their suppliers extra requirements to secure the chain (NCSC, consequences for suppliers). An organisation under the act must also include its direct suppliers in its security (Cybersecurity Act, article 21(3)(d)).
According to the NCSC, requirements are likely if you supply services or products related to the client's systems, if you supply an ICT component of those systems, or if you have access to those systems. Suppliers of your suppliers fall outside the act (NCSC, consequences for suppliers). For an IT company this almost always applies: you build, manage or have an account in the client's environment.
The KVK gives the example of a software company that supplies an electronic patient record to thirty hospitals. If you supply a company under the act, you must be able to prove that your cybersecurity is in order (KVK, Cybersecurity Act).
Which requirements can you expect in contracts?
Requirements that match the risk you pose to the client. The act does not prescribe a fixed list for suppliers. Not every measure can be required of a supplier, and there are no labels or certificates with which you can show that you comply with the act. You are not supervised yourself, but the client can ask for evidence that it can show to the supervisor (NCSC, consequences for suppliers).
In practice, requirements that match the list in article 21 of the act are likely, because the client must itself meet that list. Think of multi-factor authentication on accounts at the client, managing who has access, back-ups, closing vulnerabilities quickly, and agreements on how quickly you report an incident to the client. The client itself has only 24 hours for an early warning (Cybersecurity Act, articles 21 and 26).
Write down what you already do. Research based on 25 expert interviews showed that SMEs often have no documented processes, no fixed security budgets and no specialised staff, while much security research assumes they do (Heidt, Gerlach & Buxmann, 2019). A short, current description of your measures is what a client under the act needs for its own file.
How does this relate to a data breach under the GDPR?
They are two separate tracks. If you process personal data for a client, you are a processor under the GDPR. You inform the client without undue delay as soon as you discover a data breach, and the client reports it where possible within 72 hours to the Dutch Data Protection Authority (GDPR, article 33).
A processor may only report a data breach to the authority itself if the client has authorised it to do so. The authority recommends agreeing in the data processing agreement whom you call or email in a data breach and how quickly (Dutch DPA, controller and processor). An incident at your company can therefore mean a report under the Cybersecurity Act and under the GDPR at the same time for the client.
What does the Cyber Resilience Act mean for software companies?
The Cyber Resilience Act is a European regulation for software and hardware with digital elements, such as apps and computer programs. It has applied since 10 December 2024. The reporting obligations apply from 11 September 2026, the main obligations from 11 December 2027 (European Commission, Cyber Resilience Act).
If you place your own software product on the European market, from 11 September 2026 you must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours and a full notification within 72 hours (European Commission, CRA reporting obligations). Whether and how the regulation applies to pure SaaS, the Commission does not say on these pages. Have that assessed separately for your product.
Sources
- Cybersecurity Act, articles 1, 8, 12, 21, 24, 26, 27, 80 and 87 and annex 1, version in force from 15 August 2026. wetten.overheid.nl
- Dutch Government, Cybersecurity Act and Critical Entities Resilience Act in force from 15 August 2026, 7 July 2026. rijksoverheid.nl
- Dutch Authority for Digital Infrastructure, The Cybersecurity Act enters into force, 15 August 2026. rdi.nl
- NCSC, Information brochure on the Cybersecurity Act, February 2026. ncsc.nl
- NCSC, Registering, accessed 31 October 2026. ncsc.nl
- NCSC, The Cybersecurity Act can also affect suppliers, 8 July 2025. ncsc.nl
- KVK, Cybersecurity Act: make sure you are ready, updated 8 September 2026. kvk.nl
- General Data Protection Regulation, article 33, as published by the Dutch Data Protection Authority. autoriteitpersoonsgegevens.nl
- Dutch Data Protection Authority, Controller and processor, accessed 31 October 2026. autoriteitpersoonsgegevens.nl
- European Commission, Cyber Resilience Act, accessed 31 October 2026. digital-strategy.ec.europa.eu
- European Commission, CRA reporting obligations, accessed 31 October 2026. digital-strategy.ec.europa.eu
- Heidt, M., Gerlach, J.P. & Buxmann, P. (2019). Investigating the security divide between SME and large companies: how SME characteristics influence organizational IT security investments. Information Systems Frontiers, 21(6), 1285-1305. doi.org