The Dutch Critical Entities Resilience Act (Wwke) — what designated organisations must do

What the Wwke is and who it touches

The Wwke transposes the EU Critical Entities Resilience Directive into Dutch law. Where earlier Dutch practice treated the resilience of vital infrastructure largely as policy, the Wwke makes it a statutory regime: sector ministries designate individual organisations as kritieke entiteiten, and designation activates binding obligations. Several hundred Dutch organisations are expected to be designated across sectors including energy, transport, banking, financial market infrastructure, health, drinking water and waste water, digital infrastructure, food and public administration.

The change that matters most for security managers: the regime is all-hazards. It covers physical attack, sabotage, insider action, natural hazards and hybrid campaigns in one framework — which means the response cannot live in the IT department alone. Physical protection, access management and personnel reliability sit inside the legal obligation, alongside the cyber duties that arrive simultaneously through the Cyberbeveiligingswet.

The obligations, in order of arrival

• Risk assessment — a structured, all-hazards assessment of the threats to the entity's essential services. Under the CER framework this must be completed within nine months of the entity being notified of its designation.
• Resilience measures — technical, security and organisational measures proportionate to the assessed risk: physical protection of sites, access control, incident and crisis management, personnel security, recovery capability.
• Incident reporting — significant incidents that disrupt or could disrupt essential services must be reported to the competent authority.
• Ongoing accountability — resilience is treated as a living obligation: assessments and measures must remain current as the threat picture changes.

Why the timing is not comfortable

The obligations arrive against the threat picture the Dutch government itself describes: the national terrorism threat level stands at 4 of 5 (substantieel), the AIVD reported in July 2026 that the Netherlands is a target of a Russian espionage operation exploiting internet-connected cameras, and unidentified drones were observed over Dutch and Belgian ports and energy infrastructure through the past winter. Designated entities are being asked to formalise resilience in exactly the period in which the threats the law contemplates are active. Relevant capabilities: physical security assessment, counter-drone measures and technical surveillance counter-measures.

What to do before and after designation

Organisations that expect designation do not need to wait for the letter. The risk assessment is the schedule-critical item — it gates the measures, and its nine-month clock starts at notification. Building the assessment early, to the all-hazards standard the law expects, converts a statutory deadline into a formality. Mission Support supports critical entities with threat-led physical risk assessment, protective-measure design and validation exercises, delivered by operators with governmental and defence backgrounds.

Last reviewed: 11 August 2026. This article summarises the regime for orientation; it is not legal advice — the statutory text and your competent authority's guidance govern.