- within Accounting and Audit, Technology and Consumer Protection topic(s)
- in European Union
With digital transformation, cybersecurity issues have become a daily concern for businesses. This Quoted zooms in on three key pieces of EU cybersecurity legislation, the NIS2 Directive, the Digital Operational Resilience Act and the Cyber Resilience Act, by examining their impact on businesses and how they shape the EU’s overall cybersecurity landscape. Specific attention is given to the implementation and impact of these frameworks in Belgium, the Netherlands and Luxembourg.
Key insights
- The EU now regulates cybersecurity through three complementary instruments: NIS2 for critical sectors, DORA for finance and the CRA for connected products.
- All three Benelux countries have transposed NIS2, but with materially different scope extensions, so cross-border groups cannot rely on a single national playbook.
- NIS2 makes cybersecurity a boardroom risk: fines of up to EUR 10 million or 2% of worldwide turnover, potential suspension of senior managers.
- DORA has applied since 17 January 2025, and Benelux regulators are now shifting from implementation to intensified supervision of ICT third-party risk and the information register from 2026 onwards.
- The CRA adds product-level cybersecurity-by-design and CE-marking duties from 11 December 2027, adding directly into NIS2 and DORA supply-chain obligations that often apply cumulatively.
Network and Information Systems Directive 2 (NIS2)
The NIS2 Directive significantly expands the regulatory perimeter compared with Network and Information Systems Directive (NIS1), moving from 6 to 18 sectors listed across Annex I (highly critical) and Annex II (other critical), and has been transposed by the Belgian law of 26 April 2024, the Dutch Cyberbeveiligingswet of 8 July 2026 and the Luxembourg law of 5 May 2026. In-scope entities must adopt appropriate technical, operational and organisational risk-management measures, based on a minimum baseline that Member States may supplement, and comply with staged incident-reporting duties, alongside governance obligations for management bodies.
Digital Operational Resilience Act (DORA)
The DORA has applied since 17 January 2025 to most regulated financial entities in the EU, including banks, insurers, investment firms, fund managers, crypto-asset service providers and crowdfunding service providers. It sets requirements on ICT risk management, incident reporting, digital operational resilience testing and third-party risk, and is further specified by the RTS on Subcontracting (Delegated Regulation (EU) 2025/532), adopted on 24 March 2025. Competent authorities across the Benelux have indicated that supervisory activity will intensify from 2026 onwards, in particular on ICT third-party risk management and contractual arrangements.
Cyber Resilience Act (CRA)
The CRA, adopted on 23 October 2024, introduces the first horizontal EU-wide cybersecurity requirements for products with digital elements, covering hardware and software products that connect to a device or network. Its reporting obligations start applying on 11 September 2026 and its full set of requirements, including CE marking, on 11 December 2027. For entities already in scope of NIS2 or DORA, the CRA operates in a different dimension by addressing the security of the products themselves, and directly reinforces their supply-chain security obligations.
In this edition of Quoted the following topics will be discussed:
- Introduction to the EU cybersecurity landscape
- The NIS2 Directive and Its Implementation in the Benelux: objectives, scope, key obligations, supervision, and sanctions
- Digital Operational Resilience Act (DORA): scope, governance and ICT risk management, subcontracting requirements, incident reporting, supervision, and sanctions in the Benelux
- The Cyber Resilience Act (CRA): scope, product categorisation, key obligations, implementation timeline, and sanctions
- Navigating the interplay between NIS2, DORA, and the CRA
- Key takeaways and conclusion
Download
Development of digital legislation in Europe: focus on cybersecurity
Quoted 172
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
