AI agents and the Dutch Cybersecurity Act: duty of care and incident reporting

Suppose a municipality lets an AI agent sort its incoming mail. The agent can read the entire case management system and send emails. On Friday afternoon it reads a message with a hidden instruction and emails an export of residents' data to an external address. It can edit its own logs, and nobody is watching over the weekend. On Monday someone notices. Who has to report what, to whom, and how fast?

What is the Dutch Cybersecurity Act, and who must comply?

The Dutch Cybersecurity Act is the Dutch implementation of the EU NIS2 Directive (Directive (EU) 2022/2555). It was adopted on 8 July 2026 (Stb. 2026, 187) and has applied since 15 August 2026, as Art. 35 of the Cybersecurity Decree (Cyberbeveiligingsbesluit, Cbb, Stb. 2026, 189), which implements the Act, provides.

It applies to essential and important entities established in the Netherlands: organisations in sectors such as energy, transport, banking, health care, drinking water, digital infrastructure, public administration, postal services, food and manufacturing. Sector and size decide whether you are covered. The Act lists the sectors in two annexes. Essential entities include large organisations from the first annex and, by law, ministries, provinces, municipalities and water authorities; important entities include medium-sized organisations from both annexes and large organisations from the second (Arts. 8 and 12 Cbw). The NCSC speaks of more than 8,000 organisations and of a duty to register in the entity register. If you are not covered but supply an organisation that is, you will feel the Act through its supplier terms: it must secure its supply chain (Art. 21(3)(d) Cbw).

Are AI agents part of what the Act protects?

In our reading, yes. The Act mentions neither AI nor agents and is technology neutral. The duty of care covers the network and information systems an organisation uses for its operations or services (Art. 21(1) Cbw). That includes any device or group of connected devices, one or more of which carry out automatic processing of digital data "pursuant to a programme", plus that data itself (Art. 1 Cbw). An agent is such a programme. That it runs at a vendor does not, in our reading, take it out of scope: the Act is about systems you use.

Malice is not required. An incident is any event that compromises the availability, authenticity, integrity or confidentiality of data or services (Art. 1 Cbw), and the measures follow an all-hazards approach (Art. 21(3) Cbw). An agent that deletes records or sends data to the wrong address can therefore cause an incident.

What does the duty of care ask for an agent?

The Act requires "appropriate and proportionate technical, operational and organisational measures" to manage the risks to your systems and to prevent or minimise the impact of incidents (Art. 21(1) Cbw), depending on the state of the art, the cost and the likelihood and severity of incidents (para 2). So the Act does not ban agents or prescribe measures per agent. Paragraph 3 lists ten subjects to be covered at least, identical to Art. 21(2) NIS2. For agents, these matter most:

The Cybersecurity Decree elaborates this (Arts. 5 to 18 Cbb, not applicable to cloud providers and some other digital providers, Art. 4 Cbb). More on the risks themselves in our article on the security risks of AI agents under OWASP.

What must the management body do?

The measures in Art. 21 Cbw require the approval of the management body (Art. 24(1) Cbw); according to the NCSC, it also oversees implementation. It approves measures, not each agent, but can only approve what it knows. So put agents in the policy and in the overview it sees, for example through the agent register.

Each member must also have the knowledge and skills to identify cyber risks, assess measures and assess their consequences for the services (para 2), within two years of entry into force: for sitting members by 15 August 2028, for later appointees within two years of appointment (para 3). The knowledge must stay demonstrably up to date (para 4), and each member holds a certificate of participation in a training on those topics (para 5). The training does not have to cover AI agents (Art. 21 Cbb). Where the board has executive and non-executive directors (Art. 129a or 239a Book 2 of the Dutch Civil Code), these duties apply to the executive directors only (para 8). In a municipality, as in our example, the board of mayor and aldermen is the management body (para 12(d)): the mayor and each alderman must therefore complete the training.

What do you report when an agent causes an incident?

You report every significant incident (Art. 25 Cbw): one that has caused or can cause severe operational disruption of your services or financial loss, or that has affected or can affect other entities, including individuals, by causing considerable material or non-material damage. The steps then go to the CSIRT (the national incident response team, usually the NCSC) and the competent authority (the minister designated for your sector; for a municipality, the Minister of the Interior and Kingdom Relations, Art. 15 Cbw). You report through the reporting point set up for this by the Minister of Justice and Security (Art. 25 Cbb):

• Early warning (Art. 26 Cbw): without delay or, if that is not possible, within 24 hours of becoming aware of the incident. You state whether an unlawful or malicious act is suspected, whether there may be cross-border effects, and who the contact person is.
• Notification (Art. 27 Cbw): without delay or, if that is not possible, within 72 hours, with an update, an initial assessment of severity and impact and, where available, indicators of compromise.
• Final report (Art. 29 Cbw): no later than one month after the notification, describing the incident, its root cause or type of threat, the mitigation applied and any cross-border impact. If the incident is still ongoing, a progress report comes first.

Why do permissions and logs decide whether you can report?

The clock runs from the moment you become aware of the incident, and the Cybersecurity Decree requires you to detect incidents in good time and to log events (Art. 8 Cbb). The early warning asks whether a malicious act is suspected, and the final report asks for the root cause. You can only answer that if you can see what the agent read, which tools it called and with what permissions. You must keep logs and protect them against unauthorised changes (Art. 8(6) Cbb). So never give an agent write access to its own logs.

How do the reporting duties under the Cbw, the GDPR and the AI Act compare?

One incident involving an agent can fall under three reporting duties, each with its own trigger, reporter and deadline. One incident process with one triage works better than three separate tracks; see our article on the AI Act, NIS2 and DORA in one control set.

In our example, the export is a personal data breach: the municipality reports it to the AP unless it is unlikely to result in a risk, informs the residents too if the risk is high (Article 34 GDPR), and records the breach in any case. It may also be a significant incident. Article 73 AI Act does not apply, because a mail agent is as a rule not a high-risk system. A deployer of a high-risk system that identifies a serious incident immediately informs first the provider and then the importer or distributor and the market surveillance authority; if it cannot reach the provider, it reports under Article 73 AI Act itself (Article 26(5) AI Act). If you build an agent, or have one built, and put it into service under your own name, you are a provider (Article 3(3) AI Act). See when you are a deployer of an AI agent and Praxikon's free incident response plan, which puts the three routes into one triage.

What do the six cyber agencies and the UK NCSC advise?

Neither is Dutch or EU law, but both show what "appropriate" can mean for agents. The joint guidance Careful adoption of agentic AI services (1 May 2026) comes from the cyber agencies of Australia, the United States (CISA and NSA), Canada, New Zealand and the United Kingdom. For the Cbw these points matter most:

• Treat AI security within existing cyber security frameworks: AI systems are "fundamentally IT systems".
• Use agents only for low-risk, non-sensitive tasks, with minimal permissions, short-lived credentials and a separate identity per agent.
• Allow only approved tools and versions and log every tool use. Monitor all agent operations, not only inputs and outputs, and give agents no write access to logs.
• Develop and test incident response procedures for a compromised agent and define accountability in policy.

The guidance also admits its limits: comprehensive logging of agents is hard, and compromised third-party components are difficult to detect.

The UK NCSC, not to be confused with the Dutch NCSC, co-authored it. In a blog of 15 May 2026 it says many agent risks are not new (access control, supply chain risk, monitoring, incident response) and that you should define in advance who owns the agent, who approves its access and "ultimately who can stop it". Its interim advice of 20 August 2026 asks for agent activity in 24/7 security monitoring, immutable logs where possible and an emergency shutdown, and for overnight or weekend autonomous runs only once all controls work. Detection after the fact alone will not be enough, says a statement of 4 August 2026.

What should you do now?

• Put every agent in a register, with owner, vendor, model, MCP servers, plug-ins and permissions. That register can be the part of your asset inventory that covers agents (Art. 16(4) Cbb). The free Agent check assesses logging, kill switch and vendors, among other things, but does not test the Cbw itself.
• Limit permissions, protect logs and rehearse the kill switch, and include agents in your incident process.
• Sort out the chain and the management body. Agree with vendors how fast they warn you, see the article on the contract when buying an AI agent, and have the management body approve the measures and complete the training.

The wider framework is in our guide AI agents and the law. If you want someone to look over your agents and your incident process under the Cbw, the GDPR and the AI Act together, you can hire Zahed Ashkara as an AI and privacy legal adviser.