The Cyberbeveiligingswet is arriving: what Dutch suppliers should do in the first 90 days

The Cyberbeveiligingswet, the Dutch implementation of NIS2, is expected to enter into force in 2026. For suppliers in manufacturing and logistics the sensible response is a short sequence: determine whether you are in scope, map who actually touches your systems and sites, close the training gap including your flexible workforce, and prepare the evidence your customers will request.

Step 1: determine scope honestly

The law applies to essential and important entities in listed sectors above size thresholds, and NIS2 broadened those categories substantially compared with the previous regime. Even if your own organisation falls outside scope, your customers may be inside it, and their obligation to secure their supply chain becomes your commercial reality through questionnaires and contract clauses. Our NIS2 readiness checker gives a structured first pass.

Step 2: map the real population

List everyone with access to systems, production environments or information: employees, agency workers, contractors, drivers, cleaners and maintenance crews. Most organisations discover the flexible layer is between 10 and 40 percent of the people on the floor and 0 percent of the people in the training system.

Step 3: close the training gap where it is widest

Permanent staff usually have some awareness training history. The flexible shell usually has none, changes weekly and speaks several languages. Prioritise accordingly: short, mobile, in the worker's own language and tested, with a result you can show. That is the design brief behind EdXactly Pass.

Step 4: prepare evidence before it is requested

Decide now what you will hand over when a customer or auditor asks: a register of who is trained, on what and until when. If producing that takes you a week of spreadsheet archaeology, it is not evidence, it is homework.

What about German customers?

Many Dutch suppliers will feel NIS2 from Germany before they feel it from The Hague, because the German implementation has been in force since December 2025 and German clients are already pushing requirements down their supply chains. The 90-day sequence above answers both at once.

Last reviewed: June 2026. This article is general information and is not legal advice.