Cybersecurity Act is here, higher education has until 2027, so preparing well now is a smart move

Since 15 August 2026, the Cybersecurity Act has been in force, the Dutch implementation of the European NIS2 Directive. The law obliges organisations in designated sectors to improve their digital resilience, with risk management, mandatory incident reporting, and supervision.

For higher education, a transitional period applies. It is expected that the law will only actually come into effect for universities and universities of applied sciences around March 2027, with the duty of care even three years later. Institutions therefore have time, but are already advised to register and prepare for the requirements that are coming.

This is relevant for EduGPT, as we work together with educational institutions on AI tools that comply with European legislation and regulations from the ground up. In our view, digital resilience and responsible data use are part of this—not as separate obligations afterwards, but as an integral part of how we design technology for education. An institution that is already considering the Cybersecurity Act will be in a much stronger position when the law actually comes into force.

Want to read more about the current state of affairs? You can do so here.
https://sec.surf.nl/cyberbeveiligingswet-stand-van-zaken/

BalticServers.com, CC BY-SA 3.0, via Wikimedia Commons