Network and Information Systems Directive 2 (NIS2)

The NIS2 Directive significantly expands the regulatory perimeter compared with Network and Information Systems Directive (NIS1), moving from 6 to 18 sectors listed across Annex I (highly critical) and Annex II (other critical), and has been transposed by the Belgian law of 26 April 2024, the Dutch Cyberbeveiligingswet of 8 July 2026 and the Luxembourg law of 5 May 2026. In-scope entities must adopt appropriate technical, operational and organisational risk-management measures, based on a minimum baseline that Member States may supplement, and comply with staged incident-reporting duties, alongside governance obligations for management bodies.

Digital Operational Resilience Act (DORA)

The DORA has applied since 17 January 2025 to most regulated financial entities in the EU, including banks, insurers, investment firms, fund managers, crypto-asset service providers and crowdfunding service providers. It sets requirements on ICT risk management, incident reporting, digital operational resilience testing and third-party risk, and is further specified by the RTS on Subcontracting (Delegated Regulation (EU) 2025/532), adopted on 24 March 2025. Competent authorities across the Benelux have indicated that supervisory activity will intensify from 2026 onwards, in particular on ICT third-party risk management and contractual arrangements.

Cyber Resilience Act (CRA)

The CRA, adopted on 23 October 2024, introduces the first horizontal EU-wide cybersecurity requirements for products with digital elements, covering hardware and software products that connect to a device or network. Its reporting obligations start applying on 11 September 2026 and its full set of requirements, including CE marking, on 11 December 2027. For entities already in scope of NIS2 or DORA, the CRA operates in a different dimension by addressing the security of the products themselves, and directly reinforces their supply-chain security obligations.

In this edition of Quoted the following topics will be discussed:
  • Introduction to the EU cybersecurity landscape
  • The NIS2 Directive and Its Implementation in the Benelux: objectives, scope, key obligations, supervision, and sanctions
  • Digital Operational Resilience Act (DORA): scope, governance and ICT risk management, subcontracting requirements, incident reporting, supervision, and sanctions in the Benelux
  • The Cyber Resilience Act (CRA): scope, product categorisation, key obligations, implementation timeline, and sanctions
  • Navigating the interplay between NIS2, DORA, and the CRA
  • Key takeaways and conclusion  

Download

Development of digital legislation in Europe: focus on cybersecurity

Quoted 172

Contact

If you have any questions or would like to discuss the implications of these frameworks for your organisation, please reach out to your usual Loyens & Loeff adviser or a member of our Tech, Data & Commercial team.