Important NIS2 update: Cybersecurity Act enters into force

First, an important update. It is official: the Cybersecurity Act (the Dutch implementation of NIS2) is going ahead. The Senate approved it on July 7, 2026, which means the law will take effect on August 15, 2026. No more speculation about "maybe it will be delayed" or "it probably won't be that bad." The law is here, and for many organizations in the Netherlands, things will truly change from that date on. In this article, we explain exactly what the Cybersecurity Act entails, who it applies to, and what steps you can take now.

The role of executives under NIS2

Under NIS2 (read: Cybersecurity Act), executives are expected to:

‍

• approve the necessary cybersecurity risk management measures;
• oversee compliance with these measures within their organization;
• take personal responsibility for overall cybersecurity compliance.

‍

This liability means that not only the organization but also individual executives can face legal and financial consequences for non-compliance.

Why cybersecurity training is mandatory

The NIS2 Directive requires that all members of management be trained in managing cybersecurity risks. These trainings are crucial to ensure that leaders can not only identify and evaluate risks but also implement effective measures to protect their organizations.

NIS2 supervision and enforcement

Enforcement of NIS2 regulations is carried out by national authorities, which have extensive powers to monitor compliance. This includes inspections, audits, and the right to demand immediate action upon identifying shortcomings.

The consequences of NIS2 non-compliance

Non-compliance with NIS2 can lead to significant sanctions, including:

‍

• warnings;
• binding instructions to correct shortcomings;
• fines and other financial penalties;
• public disclosure of non-compliance.

‍

These sanctions underscore the importance of active involvement, initiative, and compliance by management.

In-company NIS2 executive training

For executives who want to understand the severity and complexity of cyber threats, manage them effectively, and meet NIS2 obligations, the In-company NIS2 executive training is the solution. This training not only provides the necessary knowledge and skills but also ensures that your organization complies with the latest EU cybersecurity regulations.

NIS2 executive training in Guardey

To support organizations in complying with the NIS2 directive, the mandatory training for management and executives is now also available in Guardey. This interactive and gamified training is designed to make executives and managers aware of their roles and responsibilities under NIS2 legislation in an accessible way.

‍

Within Guardey, a special content module has been set up for this purpose, focusing on themes essential for management and executives. Think of topics such as risk management, reporting obligations, and cybersecurity governance. This module aligns with broader awareness campaigns and can be fully integrated into the existing Guardey platform.

‍

As an official distributor of Guardey, Fendix provides support with implementation, training, and advice. This makes it easier for organizations to meet the new NIS2 requirements.

Want to know more?

Schedule a no-obligation introductory meeting below. We will then look at what best suits your organization.