← All resources

NIS2 Netherlands: are software vendors and IT providers in scope?

Published October 22, 2026 · 9 min read · CyberNovaLabs.io

Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.

The short answer

In the Netherlands, NIS2 is transposed by the Cyberbeveiligingswet (Cbw), in force since 15 August 2026^[1][6]. To know whether NIS2 Netherlands applies to you, do not read your SBI code: read the service you sell. "Software publishing" appears in neither Annex I nor Annex II of the directive^[9]. Three profiles that are entirely ordinary in IT are directly in scope: managed service providers (MSPs) and managed security service providers (MSSPs), grouped under "beheer van ICT-diensten (B2B)"; providers of cloud computing, data centres, CDN and DNS; and online marketplaces, search engines and social networks in Annex II^[9].

Put differently: if you sell a licence the customer installs and runs, you are probably out of scope. If you host, monitor, patch or operate the customer's infrastructure on their behalf, you are almost certainly in. And out of scope does not mean obligation-free: your Dutch customers that are Cbw entities must secure their supply chain, which means you.

Are you in scope? The boxes to tick

• Size threshold: at least 50 employees and annual turnover or a balance-sheet total above EUR 10 million. Above 250 employees or EUR 50 million turnover, an entity in a highly critical sector becomes an essential entity; others are important entities^[8].
• Managed service: do you install, manage, operate or maintain ICT products, networks, infrastructure or applications on behalf of customers? Dutch law separates beheerde diensten (managed services) from beheerde beveiligingsdiensten (managed security services)^[3]. Selling engineering hours is not enough; taking the wheel of the customer's infrastructure is.
• SaaS: if you host and operate your own software, you no longer sell a licence but a cloud computing service — digital infrastructure, Annex I^[9].
• Main establishment: see the next section. This is the point that catches out IT groups.
• No size threshold: some categories are in scope regardless of size, notably DNS service providers, top-level domain name registries and trust service providers^[9].

What Dutch law requires: the reference points that matter

The Dutch specificity is how the roles are split. The competent CSIRT for "beheer van ICT-diensten" and for "digitale aanbieders" is the NCSC; the supervisory authority is the Rijksinspectie Digitale Infrastructuur (RDI); the lead ministry is Economic Affairs and Climate Policy (EZK)^[4]. The RDI supervises nine sectors, including digital infrastructure, ICT service management and digital providers^[1]. So you will deal with two distinct bodies: the NCSC to report, the RDI to inspect.

Two Dutch details worth keeping. First, the board training requires a certificate showing that knowledge is current, and it only covers executive directors — supervisory board members and non-executive directors are an explicit exception^[3]. Second, the Cbw entered into force on the same day as the Wet weerbaarheid kritieke entiteiten (Wwke), the Dutch transposition of the CER directive^[6]. Two laws, two scopes, the same 15 August.

Administrative fines: up to EUR 10 million or 2% of total worldwide annual turnover for an essential entity, EUR 7 million or 1.4% for an important entity, whichever is higher^[8].

Where is your "main establishment"? The Dutch cascade

For providers of managed services, managed security services, cloud, data centres, CDN and DNS, jurisdiction does not follow your customers: it follows your main establishment. The NCSC publishes guidance for organisations with complex business models that sets out the rule in three steps^[5]:

The practical consequence for a Dutch MSP serving Belgian or French customers: the RDI inspects it, not the Belgian CCB or the French ANSSI. And for an IT group whose holding company is Dutch but whose SOC sits in Poland, the answer is settled at step 1, on where decisions are taken — not where work is performed. This guidance is not legally binding, as it says itself^[5]; it is still the best starting point.

The sector's three weak spots, measured by the RDI

The RDI published its NIS2 quickscan results for the "beheer van ICT-diensten" sector. Respondents score themselves lowest on exactly three topics^[3]:

1. Setting up a notification procedure for significant incidents. The 24-hour deadline does not hold without an on-call rota, the CSIRT's details and someone authorised to report on a Sunday.
2. Training every board member. It is a named obligation, with a certificate, and it is the easiest one to close before an inspection.
3. Reducing supply chain risk. For an IT provider this cuts twice: you are yourself your customers' critical supplier.

For the first year of supervision, the RDI says it wants to get to know the sectors first: letters, invitations to an introductory meeting, questionnaires to complete^[2]. Supervision comes in two forms: ex ante, with no prior incident, and ex post, after an incident or a report^[2]. Essential entities face proactive supervision; important entities, in principle reactive^[8].

The software vendor that stays out of scope

You publish software installed at the customer's site, you are under 50 people and under EUR 10 million? You are probably not a Cbw entity. Two obligations still reach you. First, through your customers: a Dutch Cbw entity has to address supply chain security, which means yours — in practice, security questionnaires, contract clauses and enforceable remediation deadlines. Second, the Cyber Resilience Act, which covers any product with digital elements, independently of NIS2 and of your size. To compare two neighbouring transpositions, see our guide to NIS2 Belgium for software vendors and IT providers: Belgium chose a national framework and a two-wave registration timetable, where the Netherlands started everything on 15 August 2026.

The first five actions

1. Settle scope per legal entity, not per group: run the NCSC self-evaluation for each company that sells a managed service, hosting or SaaS.
2. Determine your main establishment with the cascade above, and write the answer down in a one-page note — that note names your regulator.
3. Register on Mijn.NCSC.nl if you are in scope: the obligation has been running since 15 August 2026 and you are responsible for your own registration^[2][7].
4. Write the 24h / 72h procedure: who detects, who judges an incident "significant", who reports, from which account, and who takes over at night.
5. Get the executive directors' training certified and start the supplier review — the other two weak spots the RDI measured^[3].

If your customers are Cbw entities, the security questionnaire arrives before the inspection does. Our guide to NIS2 Netherlands for healthcare and laboratories shows what those customers will have to demand from you. And if your aim is to sell to these companies, read the rules for B2B appointment setting in the Netherlands.

At CyberNovaLabs.io

Our free NIS2 check places you in a few minutes, and the page on NIS2 Netherlands — managed IT services goes into the MSP and MSSP case. If your question is commercial rather than regulatory, our B2B appointment setting offer also serves IT providers, with no minimum term and priced on quotation.

Discuss your case with CyberNovaLabs.io

Sources

1. RDI — De Cyberbeveiligingswet treedt in werking (15/08/2026)
2. RDI — Veelgestelde vragen (FAQ) Cyberbeveiligingswet
3. RDI — NIS2-quickscan, sector 'beheer van ICT-diensten'
4. NCSC — Doorverwijsboom Cyberbeveiligingswet 2026 (CSIRT en toezichthouder per sector)
5. NCSC — Handreiking voor organisaties met complexe bedrijfsmodellen
6. Rijksoverheid — Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf 15 augustus 2026 van kracht
7. RDI — Registratieplicht Cyberbeveiligingswet
8. Houthoff — Cyberbeveiligingswet vanaf 15 augustus van kracht (drempels, boetemaxima, toezicht)
9. Richtlijn (EU) 2022/2555 (NIS2), bijlagen I en II

Read next