NOTABLEupdateNATOA2policy

UPDATE — the Dutch NIS2 clock the prior weekly recorded as forthcoming started on 15 August, and the national CERT confirms the registration duty applies from the entry-into-force date itself with no transition window

discovered 2026-08-16 23:59 UTCrun 2026-08-16T2315Z-weekly3 sourcessingle-source · national CERT

UPDATE · originally covered NIS2 enters its enforcement phase in two more jurisdictions from opposite ends — the Netherlands' transposition law takes effect on 15 August for 8,000+ organisations, while Germany's registration deadline has lapsed with BSI's own site telling unregistered entities to register immediately (2026-08-09)

the prior weekly recorded two NIS2 clocks running from opposite ends — the Dutch transposition law due to take effect on 15 August, and Germany's registration deadline already lapsed with BSI telling unregistered entities to register immediately. The Dutch half has now happened, and the mechanics that were not published then are published now.

NCSC-NL confirmed on the day: "Vanaf vandaag, 15 augustus 2026, gelden de Cyberbeveiligingswet (Cbw) en de Wet weerbaarheid kritieke entiteiten (Wwke)" — from today, 15 August 2026, the Cyberbeveiligingswet and the Critical Entities Resilience Act apply, and organisations falling under them face new obligations (NCSC-NL, 2026-08-15). The operative detail is in the registration guidance rather than the announcement. NCSC-NL states that the registration duty "geldt pas vanaf de inwerkingtreding van de Cyberbeveiligingswet (Cbw) op 15 augustus 2026" — applies only from the entry into force of the Act on 15 August 2026 (NCSC-NL, 2026-08-15). That sentence was written to answer the question organisations were asking before the date, and it answers a second one by omission: the guidance describes no transition period after it. An in-scope organisation that had not registered by the fifteenth was not working toward a deadline; it was already non-compliant. Registration runs through the national entity register and is gated by eHerkenning at assurance level EH2+, or SSOnRijk for connected government bodies — an authentication dependency that is itself a lead time for any organisation that does not already hold those credentials. Dutch compliance press reported the date independently ahead of it (EES.nl, 2026-08-11).

Defender takeaway

nothing here creates a Swiss obligation, and the contrast with Germany is the reason it is worth recording anyway. Two member states have now reached the enforcement phase by opposite routes — the Netherlands with a hard start and no grace period, Germany with a deadline that lapsed and a registration gap the federal authority has been publicly urging entities to close — which tells anyone planning against the directive that "transposition timetable" and "enforcement posture" are separate variables and the second is not predictable from the first. The concrete near-term reading for a Swiss public-sector or critical-infrastructure body is on the supplier side rather than the regulatory one: an organisation regulated under the Cbw must impose supply-chain due diligence on its own vendors, so Swiss suppliers into Dutch essential and important entities should expect those requirements to arrive contractually, and a Swiss body procuring from Dutch-regulated entities gains a lever it did not have before. The pattern to watch, since further member states will follow, is the shape rather than the dates: mandatory portal registration, strong-authentication gating, and obligations that bind from a fixed calendar date rather than phasing in.

Vanaf vandaag, 15 augustus 2026, gelden de Cyberbeveiligingswet (Cbw) en de Wet weerbaarheid kritieke entiteiten (Wwke).

De plicht geldt pas vanaf de inwerkingtreding van de Cyberbeveiligingswet (Cbw) op 15 augustus 2026.

NCSC-NL

Sources

NCSC-NL (Nationaal Cyber Security Centrum)primary NCSC-NL (Nationaal Cyber Security Centrum)primary EES.nlcorroborating

Update chain

updates NIS2 enters its enforcement phase in two more jurisdictions from opposite ends — the Netherlands' transposition law takes effect on 15 August for 8,000+ organisations, while Germany's registration deadline has lapsed with BSI's own site telling unregistered entities to register immediately 2026-08-09

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Assessment

NATOA2NATO Admiralty code

Source reliabilityA Completely reliable

Info credibility2 Probably true

Verificationsingle-source · national CERT

Confidencehigh

Carried on the national CERT's own announcement and its own registration guidance, which is the first-party authority for the legal-effect date in its own jurisdiction; Dutch compliance press corroborates the date independently. The absence of a transition window is stated as an absence — NCSC-NL's guidance describes none — rather than as a positive statement that one was ruled out. No penalty regime or first enforcement date is stated in the cited pages and none is asserted here.

Entities

Netherlands Cyberbeveiligingswet (NIS2 transposition)

Tags · regions · sectors

supply-chain eu-nexus europe switzerlandpublic-sectorenergywatertransporthealthcarefinancetelco