Dutch law turns European principles into concrete obligations for key Dutch organisations
Today's interconnected world means disruptions hit hard. Think about power failures in hospitals, supply chains frozen due to cyberattacks and unresponsive payment systems due to IT incidents. These aren't just headlines: they threaten your business's continuity, reputation, and legal standing.
The European Union created the Critical Entities Resilience Directive (CERD) to address this head-on. CERD requires member states to prepare critical sectors to prevent, absorb, and recover from disruptions, whether they stem from cyber threats, physical incidents, natural disasters or hybrid attacks. CERD introduces shared resilience standards and strengthens collaboration between governments and critical organisations across Europe.
CERD sets out the European framework; however, each member state implements it nationally. In the Netherlands, that's the Wet weerbaarheid kritieke entiteiten. This law translates European principles into concrete obligations for organisations essential to Dutch society. It focuses on sectors where failure causes immediate societal and economic damage such as energy, transport, and healthcare.
If you operate in these sectors, you need to demonstrate insight into your risks and resilience measures. And you'll report them to supervisors and competent authorities.
Could your organisation be identified a critical entity? Explore our sector map for sector-specific categories. Click on any sector to learn more.
Credit institutions that collect deposits or other repayable funds from the public and grant credits for their own account.
Healthcare providers (institutions and independent practitioners), EU reference laboratories supporting national diagnostics and monitoring, manufacturers of basic products and preparations (medicines, vaccines), entities with wholesale licences for medicines, and manufacturers and distributors of critical medical devices for public health emergencies.
Operators of ground facilities (owned, managed or operated by member states or private parties) supporting services from space, excluding public electronic communications network providers.
Government institutions under the central government.
Companies operating internet exchange points, providing DNS services, managing top-level domain registries, providing cloud computing and data centre services, operating content distribution networks, providing trust services, and operating public electronic communications networks and services (internet access, interpersonal communication, transmission services).
Suppliers and distributors of water for human consumption, supplied untreated or treated for drinking, cooking, food preparation and household purposes, regardless of origin or delivery method.
Undertakings collecting, discharging or treating municipal, domestic and industrial wastewater (except where these aren't essential business activities).
Operators of trading platforms (regulated markets, MTFs, OTFs) and central counterparties (CCPs) act as intermediaries in financial market contracts.
Food businesses (public and private) active in production, processing and distribution, excluding logistics, wholesale and large-scale industrial production.
The following dates are important for organizations to keep in mind in the coming months and years:
The Wwke requires companies to take the following measures:
Risk and Resilience Assessment
We will work with you to conduct CERD-aligned risk and resilience assessments, identifying vulnerabilities across your essential services. So that you can strengthen defences, meet regulatory requirements, and mature your programs.
Strengthen operational agility
We will help you implement robust measures to prevent and reduce disruptions, so you can maintain seamless operations and protect vital systems.
Regulatory certainty
We will help you stay compliant with evolving legal standards, so you can avoid fines and strengthen both compliance and reputation.
Build a resilient organisation
We will help you develop recovery plans that keep your business running, even under pressure. We'll train your people and run simulations, so you can stay resilient and prepare for unexpected challenges.
You may already have resilience initiatives. But vulnerabilities emerge where there's limited coordination and insight into external dependencies. Align with the CER directive and Wwke to strengthen resilience andimprove your strategic position to gain competitive advantages.
Position resilience as strategic advantage
Resilience isn't just compliance. It's your strategic asset. A readiness workshop can help you evaluate governance and processes aligned with your organisation's size, scope, and regulations.
Build the business case
Run a resilience assessment to measure your maturity. You'll gain clear insights, a maturity score, and a plan to strengthen and improve your capabilities.
Strengthen capabilities
Develop an integrated risk and resilience framework focused on key value drivers. Use horizon scanning and scenario planning to anticipate future disruptions, so you can assess risks and opportunities effectively.
Contact our experts. Discover how building resilience and meeting legal standards can strengthen your competitive advantage and protect your critical operations.
Partner Cybersecurity, resilience & privacy, PwC Netherlands
Tel: +31 (0)62 243 29 62
Diana Vilan
Senior Manager, Crisis Management and Business Continuity, PwC Netherlands
Tel: +31 6 28596102