Dutch law turns European principles into concrete obligations for key Dutch organisations

Wet weerbaarheid kritieke entiteiten (Wwke)

Wwke

Today's interconnected world means disruptions hit hard. Think about power failures in hospitals, supply chains frozen due to cyberattacks and unresponsive payment systems due to IT incidents. These aren't just headlines: they threaten your business's continuity, reputation, and legal standing.

The European Union created the Critical Entities Resilience Directive (CERD) to address this head-on. CERD requires member states to prepare critical sectors to prevent, absorb, and recover from disruptions, whether they stem from cyber threats, physical incidents, natural disasters or hybrid attacks. CERD introduces shared resilience standards and strengthens collaboration between governments and critical organisations across Europe. 

CERD sets out the European framework; however, each member state implements it nationally. In the Netherlands, that's the Wet weerbaarheid kritieke entiteiten. This law translates European principles into concrete obligations for organisations essential to Dutch society. It focuses on sectors where failure causes immediate societal and economic damage such as energy, transport, and healthcare. 

If you operate in these sectors, you need to demonstrate insight into your risks and resilience measures. And you'll report them to supervisors and competent authorities. 

What does the Wwke mean for your organisation? 

Could your organisation be identified a critical entity? Explore our sector map for sector-specific categories. Click on any sector to learn more. 

Banking

Credit institutions that collect deposits or other repayable funds from the public and grant credits for their own account.

Energy

  • Electricity
    Companies that generate electricity, transport it via transmission or distribution networks, supply or purchase it, manage networks, provide aggregation services, manage demand (demand response), store energy or participate in electricity markets as buyers, sellers or market operators. 
  • Distric heating and cooling
    Companies that distribute thermal energy (steam, hot water or cooled liquids) from central or decentralised sources via networks serving multiple buildings or locations. 
  • Oil
    Companies that operate oil pipelines, manage facilities for production, refining, treatment, storage and transport, and central storage facilities authorised to purchase, hold and sell oil stocks. 
  • Gas
    Gas companies that supply gas, operate distribution or transmission systems, operate storage facilities or LNG facilities (liquefaction, import, transhipment, regasification). They handle the commercial, technical, and maintenance activities these functions require. 
  • Hydrogen
    Companies that operate facilities for hydrogen production, storage, and transport. 

Healthcare

Healthcare providers (institutions and independent practitioners), EU reference laboratories supporting national diagnostics and monitoring, manufacturers of basic products and preparations (medicines, vaccines), entities with wholesale licences for medicines, and manufacturers and distributors of critical medical devices for public health emergencies. 

Transport

  • Air
    Airlines with valid operating licences, airport operators coordinating infrastructure and activities, airports equipped for aircraft operations, and air traffic control services preventing collisions and ensuring orderly traffic flow. 
  • Rail
    Infrastructure managers who construct, manage and maintain railway networks, recognised railway undertakings providing freight or passenger transport, and operators of service facilities supporting railway undertakings. 
  • Water
    Companies providing maritime transport (inland waterways, coastal and sea navigation), port and port facility managers, and operators of vessel traffic management systems (VTS) ensuring safety, efficiency and environmental protection through monitoring and control. 
  • Road
    Road authorities responsible for planning, control and management within their jurisdiction, and operators of intelligent transport systems (ITS) applying ICT to road transport, traffic and mobility management, and integration with other transport modes. 
  • Public transport
    Public or private operators providing public passenger transport services. 

Space and satellite systems 

Operators of ground facilities (owned, managed or operated by member states or private parties) supporting services from space, excluding public electronic communications network providers. 

Public administration 

Government institutions under the central government. 

Digital infrastructure 

Companies operating internet exchange points, providing DNS services, managing top-level domain registries, providing cloud computing and data centre services, operating content distribution networks, providing trust services, and operating public electronic communications networks and services (internet access, interpersonal communication, transmission services). 

Drinking water

Suppliers and distributors of water for human consumption, supplied untreated or treated for drinking, cooking, food preparation and household purposes, regardless of origin or delivery method. 

Wastewater

Undertakings collecting, discharging or treating municipal, domestic and industrial wastewater (except where these aren't essential business activities). 

Financial market infrastructure

Operators of trading platforms (regulated markets, MTFs, OTFs) and central counterparties (CCPs) act as intermediaries in financial market contracts. 

Food production and distribution

Food businesses (public and private) active in production, processing and distribution, excluding logistics, wholesale and large-scale industrial production. 

When does the Wwke take effect?

The following dates are important for organizations to keep in mind in the coming months and years:

  • January 2026: The Netherlands adopts a strategy for strengthening critical entity resilience. 
  • July 2026: The Netherlands identifies critical entities and notifies them within one month. 
  • April-May 2027: Designated entities complete risk assessments within nine months and demonstrate Wwke compliance within ten months. 
  • July 2027: The European Commission reports to Parliament and Council, assessing CERD compliance. 

Your obligations under Wwke 

The Wwke requires companies to take the following measures:

Risk assessment

Periodically assess all relevant threats to your essential services, accounting for interdependencies. 

Resilience measures

Take appropriate measures to prevent incidents, absorb them, and ensure continuity of essential services. 

Incident notification

Report significant incidents to the competent authority within 24 hours. Provide further updates as required. 

How can we help?

Risk and resillience Assessment

Risk and Resilience Assessment
We will work with you to conduct CERD-aligned risk and resilience assessments, identifying vulnerabilities across your essential services.  So that you can strengthen defences, meet regulatory requirements, and mature your programs. 

Risk and resillience Assessment

Strengthen operational agility
We will help you implement robust measures to prevent and reduce disruptions, so you can maintain seamless operations and protect vital systems. 

Risk and resillience Assessment

Regulatory certainty
We will help you stay compliant with evolving legal standards, so you can avoid fines and strengthen both compliance and reputation. 

Risk and resillience Assessment

Build a resilient organisation
We will help you develop recovery plans that keep your business running, even under pressure. We'll train your people and run simulations, so you can stay resilient and prepare for unexpected challenges. 

No Regret steps

You may already have resilience initiatives. But vulnerabilities emerge where there's limited coordination and insight into external dependencies. Align with the CER directive and Wwke to strengthen resilience andimprove your strategic position to gain competitive advantages.

Position resilience as strategic advantage
Resilience isn't just compliance. It's your strategic asset. A readiness workshop can help you evaluate governance and processes aligned with your organisation's size, scope, and regulations. 

Build the business case
Run a resilience assessment to measure your maturity. You'll gain clear insights, a maturity score, and a plan to strengthen and improve your capabilities. 

Strengthen capabilities
Develop an integrated risk and resilience framework focused on key value drivers. Use horizon scanning and scenario planning to anticipate future disruptions, so you can assess risks and opportunities effectively.

Ready to build resilience?

Contact our experts. Discover how building resilience and meeting legal standards can strengthen your competitive advantage and protect your critical operations. 

Contact us

Bram van Tiel

Bram van Tiel

Partner Cybersecurity, resilience & privacy, PwC Netherlands

Tel: +31 (0)62 243 29 62

Diana  Vilan

Diana Vilan

Senior Manager, Crisis Management and Business Continuity, PwC Netherlands

Tel: +31 6 28596102

Follow us