NIS2 for groups in the Netherlands and Belgium, entity by entity

A group with subsidiaries in the Netherlands and Belgium does not have one NIS2 file but at least two. NIS2 applies entity by entity and country by country: a Dutch subsidiary falls under the Cyberbeveiligingswet (Cbw, the Dutch Cybersecurity Act), a Belgian one under the Belgian NIS2 law. Both transpose the same directive, but registration, deadlines and supervision differ.

This comparison was checked on 6 November 2026. It is not legal advice: have your own situation confirmed by your legal adviser or the competent authority.

The Netherlands and Belgium side by side

Which law applies to which entity?

The main rule is simple: each entity falls under the law of the country where it is established. The Dutch law applies to entities established in the Netherlands (Art. 4(1)). The NCSC adds that you cannot register for all Member States at once. The CCB writes that the Belgian law applies to all organisations individually, even if they belong to the same group or holding company.

Two exceptions in the Dutch law:

• Providers of public electronic communications networks or services fall under the law of the country where they offer their services (Art. 4(2)).
• DNS service providers, top-level domain registries, providers of cloud computing, data centre and content delivery services, managed (security) services, online marketplaces, online search engines and social networking platforms fall under the country of their main establishment in the EU (Art. 4(3)). That is, as a rule, where decisions on cybersecurity risks are mainly taken (Art. 4(5)).

A group therefore has to answer this question for each entity, not once for the whole group.

Why the group still counts

Assessing each entity separately does not mean the group is irrelevant. It counts on two points:

• Size. The thresholds come from EU Recommendation 2003/361/EC, which includes linked enterprises. A small subsidiary of a large group can therefore exceed the threshold. Work this out for each entity.
• The fine. The Dutch law refers to the annual turnover of "the undertaking to which the entity belongs" (Art. 80 and 87), and the CCB uses the same wording. That can reach further than the subsidiary's own turnover.

Registration: who does what?

Register each entity covered by a law in the country competent for it: in the Netherlands through MijnNCSC, in Belgium through Safeonweb@Work. In the Netherlands, changes must be reported within two weeks (Art. 44(2)).

According to the NCSC, a significant incident must be reported in every Member State where the organisation operates. So record for each entity who reports, to which authority and within which time limit: the 24 hours, 72 hours and one month of NIS2 are the starting point in both countries.

Deadlines running now

• Netherlands: the law has applied since 15 August 2026 and organisations it covers must be registered since then. Board members have two years for the knowledge, skills and training of Article 24.
• Belgium: essential entities choosing CyFun had to hold at least a Basic or Important verification by 18 April 2026. The next date is 18 April 2027: a CyFun Essential certificate if their risk assessment calls for that level, or otherwise a remediation plan towards 18 April 2028. Important entities have no formality with the CCB on these dates but must apply all the measures.

What if an entity falls under DORA?

For financial entities identified as essential or important, DORA is a sector-specific legal act within the meaning of Article 4 of NIS2 (DORA, Art. 1(2)). In practice, such an entity follows DORA for ICT risk management and incident reporting. The Dutch law covers this in its articles on sector-specific legal acts (Art. 22 and 31). Non-financial entities of the same group remain under their country's NIS2 transposition. See also DORA vs NIS2.

One programme, accountability per entity

A group does not have to reinvent the work for each country. What usually works:

1. List all entities with their country, activity, size and applicable law.
2. Impose one method: the same BIA scales and the same measures, so that results can be compared.
3. Keep the evidence per entity, because each authority asks about the entity under its remit.
4. Map shared suppliers: one critical supplier can affect several entities at once.

The ResiPlan group solution is built for this: an isolated workspace per entity, a group BIA methodology and a consolidated view for headquarters.

FAQ

Must our subsidiaries in the Netherlands and Belgium each register separately?

As a rule, yes. Each entity covered by a law registers in the country where it is established: in the Netherlands through MijnNCSC, in Belgium through Safeonweb@Work. According to the NCSC, you cannot register for all Member States at once. Whether a holding company can act for its subsidiaries is covered in the CCB's FAQ (question 3.13.5): check it for your case.

What are the differences between the Dutch Cybersecurity Act and the Belgian NIS2 law?

Mainly the date (15 August 2026 against 18 October 2024), the registration body (NCSC or CCB), supervision (by sector in the Netherlands, the CCB in Belgium) and proof: Belgium works with CyFun or ISO/IEC 27001 and fixed deadlines for essential entities. The maximum fines are the same in both countries.

What fines does a group risk?

The fine is imposed on the entity: up to €10 million or 2% of worldwide annual turnover for an essential entity and up to €7 million or 1.4% for an important entity, whichever is higher. The turnover is that of the undertaking to which the entity belongs. In the Netherlands, a board member can also receive a fine of up to €25,000.

How do we handle DORA and NIS2 together in a group?

Determine for each entity which framework applies: DORA for financial entities, the country's NIS2 transposition for the others. Then work with one method for risks, BIA and suppliers, and keep the evidence per entity.

Sources

• Cyberbeveiligingswet, wetten.overheid.nl
• NCSC, registration duty
• CCB, the NIS2 law
• CCB, FAQ on NIS2 and CyberFundamentals

Further reading

• NIS2 transposition by country: laws, dates and authorities
• NIS2: essential and important entities
• The NIS2 directive