Strategic Partnership Announcement with Stibbe

Information Development Europe and Stibbe - NIS2 Compliance

Information Development Europe (IDE) is launching its NIS2 compliance service today, with roadmap support for the EU AI Act and the Cyber Resilience Act (CRA) to follow. With an industry leading practice, Stibbe stands ready to advise clients on legal matters relating to NIS2, the EU AI Act, the Cyber Resilience Act, and broader EU digital legislation.

The Power of Collaboration

IDE’s service encompasses deep technical validation—configuration reviews, log and control testing, and evidence capture—with Stibbe’s regulatory and compliance proficiency to translate legal duties into provable system configurations. Together, we accelerate remediation, reduce audit friction, and provide boards and regulators with a single, defensible narrative. Stibbe's regulatory and compliance proficiency is available to clients who require separate legal counsel in this area.

About Stibbe and IDE

Stibbe is a leading, independent law firm, advising clients on complex regulatory, transactional, and contentious matters across sectors.
Strengths relevant to NIS2 / CRA / AI Act

Deep TMT/IP bench covering IP/IT, data protection, AI, and cybersecurity, providing coordinated, cross‑border advice on complex EU digital legislation.
Regulatory compliance for NIS2, CRA, and the AI Act (and more)—from scoping and governance through to operational readiness documentation.
Regulatory defense & investigations and incident/crisis management, including notifications and enforcement engagement.

Stibbe website: www.stibbe.com

Inquiries

For inquiries regarding this collaboration or EU regulatory readiness, please contact us via Contact form

Appendix – Status of each regulation as of this writing

NIS2 Timeline and the Situation in the Netherlands

January 16, 2023 — NIS2 entered into force at EU level.
October 17, 2024 — Member States must transpose NIS2 into national law. In the Netherlands, transposition is delayed; the Cyberbeveiligingswet (Cbw) is expected to enter into force around Q2 2026, subject to parliamentary approval.
October 18, 2024 — Enforcement of NIS2 obligations begins across the EU, with national readiness varying by country.

CRA Timeline (Cyber Resilience Act)

November 20, 2024 — CRA published in the Official Journal of the EU.
December 10, 2024 — CRA entered into force (Regulation (EU) 2024/2847).
June 11, 2026 — conformity assessment body notification obligations begin
September 11, 2026 — Vulnerability and incident reporting obligations start applying for manufacturers.
December 11, 2027 — Main CRA obligations apply in full (placing non-compliant products on the market prohibited).

AI Act Timeline

July 12, 2024 — AI Act published in the Official Journal of the EU.
August 1, 2024 — AI Act entered into force.
February 2, 2025 — Prohibited AI practices become unlawful; AI literacy provisions start to apply.
August 2, 2025 — General-purpose AI (GPAI) obligations, governance, penalties start to apply; designation of national authorities due.
August 2, 2026 — General application date for most provisions, including Annex III high-risk AI systems and transparency obligations.
August 2, 2027 — Additional compliance date for certain high-risk AI systems embedded in regulated products requiring third-party conformity assessment.