The National Cyber Security Centre (NCSC) and the supervisory authorities RDI, ILT, ANVS and NVWA signed cooperation agreements on 7 October 2026 for the implementation of the Cybersecurity Act. The supervisory authorities have also formalised agreements among themselves. The agreements concern the coordination of supervisory activities, information exchange and the division of roles between the parties involved.
The Cybersecurity Act sets requirements for the digital resilience of more than 8,000 organisations that provide essential or important services. These organisations will, among other things, be subject to registration, reporting and duty-of-care obligations. They must register in the national entity register, which is managed by the NCSC.
After registration, organisations can use the services provided by the NCSC or the CSIRT designated for their sector. Among other things, they receive information about cyber threats and assistance with cyber incidents. They must also report incidents.
The agreements set out when the parties involve one another and how they share information. The main points have been recorded; over the coming period, the parties will develop these further into practical working arrangements. The agreements will be evaluated after one year. Which supervisory authority is responsible for supervision depends on the sector.
