Whether you do business in Belgium, the Netherlands, or France, NIS2 can quickly feel like a project with a fixed end date. In Belgium, that was March 18, 2025, the day on which essential and important entities had to register with the Centre for Cybersecurity Belgium. In the Netherlands, that moment is now fast approaching: the Cybersecurity Act, the national implementation of NIS2, is expected to come into force on July 1, 2026. In France, the Loi Résilience is expected during 2026, with ANSSI as the supervisory authority.
Three countries, one and the same European directive, but a very different pace. And in all cases, the same risk lurks in a single sentence you’ll eventually hear in a boardroom: “Great, we’re done.” Because with NIS2, supervision only begins the moment implementation ends.
| Country | Current status |
|---|---|
| Belgium | Law in force since October 18, 2024; registration with the CCB was required by March 18, 2025. |
| Netherlands | Cybersecurity Act, entry into force expected July 1, 2026. Until then, the Wbni remains applicable. |
| France | Loi Résilience, promulgation expected during 2026, with ANSSI as the regulator. |
One directive, three speeds
The confusion is understandable. NIS2 is a European directive that each member state must transpose into national law, with October 17, 2024, as the official transposition deadline. Belgium roughly met that deadline. The Netherlands and France did not: Dutch organizations formally remain under the old Wbni until the summer of 2026, and France also received a formal notice from the European Commission for late transposition.
But that difference in timing says nothing about the difference in obligations. The underlying requirements are virtually identical across the EU, as they stem from the same directive. A Dutch or French organization that waits until the law takes effect to think about its measures is starting exactly as late as a Belgian organization that only registered in March 2025 and then went silent.
Registering is not the same as being compliant
This is where many organizations go wrong. The registration or the effective date is treated as the finish line, when in reality it is the starting gun. The directive lists ten minimum management measures in the full NIS2 obligations that you don’t just set up once, but must apply and be able to demonstrate continuously.
One of those measures, Article 21(2)(g), explicitly mentions basic cyber hygiene and cybersecurity training. This makes training not a nice-to-have to be done when there’s time left over, but a legal requirement. Furthermore, Article 20 obliges the board itself to undergo training and encourages organizations to regularly provide similar training to employees. Under NIS2, liability for cybersecurity sits explicitly at the executive level.
Registering is not the same as being compliant. The effective date is the starting gun, not the finish line.
What the regulator continues to monitor
Supervision in every country is ongoing in nature. In Belgium, the CCB can proactively request evidence; in the Netherlands, the Dutch Rijksinspectie Digitale Infrastructuur will have a similar role alongside sectoral regulators; and in France, ANSSI handles this. The recurring theme: can you demonstrate that your risk assessment is up to date, that incidents are reported promptly, and that your measures are actually being applied?
This burden of proof is not a snapshot in time. After all, attackers don’t stand still. Last year’s phishing email was still recognizable by a strange greeting and awkward language. Today’s variant is written with AI, is flawless, and refers to a real colleague and an ongoing project. Your policy can therefore be perfectly in order on paper while simultaneously lagging behind in practice.
The employee as a moving target
Furthermore, an organization is not a static entity. New colleagues join who never attended last year’s training. Existing employees forget what they learned, as knowledge provided once fades within months. And the attack techniques you train against simply keep evolving in the meantime.
The result is a creeping gap between what your people should recognize and what they actually recognize. That gap is invisible in a compliance file, but it is the first thing an attacker exploits. The human factor remains the starting point for the vast majority of incidents, and that doesn’t change by rolling out an e-learning module just once.
From one-off to continuous
The alternative is to treat awareness not as a session, but as a rhythm. Instead of one annual training session that people click through as quickly as possible, you work with short, recurring moments that fit into the flow of work, interspersed with phishing simulations that measure whether the knowledge actually sticks.
This solves two problems at once. It keeps knowledge fresh, because repetition makes the difference between knowing something and doing something. And it provides exactly the evidence NIS2 requires: completion rates, participation figures, and simulation results that you can present during an audit. An approach with continuous security awareness training turns the training obligation into something you can prove rather than something you hope to defend.
Whether your deadline is behind you or just ahead, the real work only begins afterward. NIS2 rewards organizations that treat the directive as it was intended: as a way of working, not as a checklist.
This is a sponsored commercial contribution from Guardey. The editors are not responsible for the content.