The Cybersecurity Act and the Critical Entities Resilience Act will come into force on 15 August 2026. The Acts strengthen the digital and physical resilience of organisations and introduce new statutory obligations for thousands of organisations, including registration, duty of care and reporting obligations, supervision and management responsibility.
The Cybersecurity Act implements the European NIS2 Directive and replaces the Network and Information Systems Security Act. The Act applies to organisations providing essential or important services in 18 sectors, including energy, drinking water, digital infrastructure, healthcare, government and transport. Organisations must determine for themselves whether the Act applies to them.
Organisations covered by the Act must register in the national entities register and take appropriate and proportionate measures to manage risks to network and information systems. Significant incidents must be reported to the competent CSIRT and competent authority within the statutory deadlines. The management board is responsible for approving and implementing the duty of care measures. Directors must also have sufficient knowledge and complete appropriate training for this purpose.
The Critical Entities Resilience Act implements the European CER Directive and applies to approximately 500 organisations designated as critical entities by the responsible ministry. Within nine months of designation, they must carry out a risk assessment. Appropriate technical, organisational and physical measures must be in place within ten months. Incidents that cause or could cause a significant disruption to essential services must be reported within 24 hours.
