New rules affect the digital basis of buildings
Europe and the Netherlands set more and more requirements for the digital infrastructure, security and data of buildings. Here you read per rule what is happening, what it means for your building and what the IT-Label makes visible.
Latest developments
Last updated: 4 October 2026.
- 12 September 2026. The Data Act design requirements apply to new connected products.
- 11 September 2026. The Cyber Resilience Act reporting obligation applies: manufacturers report actively exploited vulnerabilities.
- 15 August 2026. The Dutch Cybersecurity Act (Cyberbeveiligingswet) and the Critical Entities Resilience Act are in force.
- 29 May 2026. The first part of the revised Energy Performance of Buildings Directive (EPBD) is in the Dutch building decree (Bbl).
- 31 March 2026. The fibre requirements for buildings from the Gigabit Infrastructure Act are set out in the Dutch Omgevingsregeling.
- 18 March 2026. The CSRD has been slimmed down by the Omnibus I package.
Dutch Cybersecurity Act (NIS2)
- What is it? The Dutch implementation of the European NIS2 directive, in force since 15 August 2026. Organisations in 18 sectors have a registration obligation, a duty of care and a reporting obligation.
- What does it mean for buildings? The duty of care also covers the physical surroundings of networks: technical rooms, cable routes and who has access to them. Also read who can physically reach your network?.
- What does the IT-Label show? How the technical rooms, backup connections and the separation between building systems and users are arranged.
Gigabit Infrastructure Act
- What is it? A European regulation for faster rollout of fibre and mobile networks. Largely applicable since 12 November 2025; the requirements for buildings apply since 12 February 2026.
- What does it mean for buildings? New buildings and buildings undergoing major renovation must be fibre-ready. Buildings with several homes get a central access point and conduits of at least 40 mm to each home. In the Netherlands set out in the Bbl and the Omgevingsregeling.
- What does the IT-Label show? Whether a building actually has the fibre basis, and how well it performs. See also fibre in buildings.
Energy Performance of Buildings Directive (EPBD) and SRI
- What is it? The revised European directive on the energy performance of buildings. The first part of the Dutch implementation applies since 29 May 2026; two further parts follow up to 2030.
- What does it mean for buildings? Building automation is mandatory for non-residential buildings with installations above 290 kW; that threshold drops to 70 kW at the end of 2029. The Smart Readiness Indicator (SRI) becomes mandatory for large non-residential buildings, and a digital building logbook is coming.
- What does the IT-Label show? Whether building systems work well on the network and work together. The SRI measures how smart a building can be; the IT-Label measures the digital delivery level. Read the difference.
Cyber Resilience Act (CRA)
- What is it? European security requirements for products with digital elements. The reporting obligation applies since 11 September 2026; most other requirements from 11 December 2027.
- What does it mean for buildings? Smart building systems, such as access control, cameras and building management, must be secure and stay secure. Also read what the CRA means for real estate.
- What does the IT-Label show? Which smart systems are in the building and whether they are separated from the users' network.
Data Act
- What is it? European rules on who may use the data of connected products. Largely applicable since 12 September 2025; design requirements for new products since 12 September 2026.
- What does it mean for buildings? Users get a right to the data of sensors and building systems. That affects agreements between owner, tenant and supplier.
- What does the IT-Label show? Which smart systems there are. Then record in the IT Demarcation List who manages which data.
GDPR
- What is it? The European privacy law. Unchanged, but increasingly important in buildings full of sensors.
- What does it mean for buildings? Cameras, access systems and occupancy sensors often process personal data. The privacy rules apply to them.
- What does the IT-Label show? Which systems there are, so that owner and tenant know where privacy plays a role.
CSRD and ESG
- What is it? The European rules for sustainability reporting. Since 18 March 2026 greatly slimmed down by the Omnibus I package: only companies with more than 1,000 employees and more than € 450 million turnover still have to report.
- What does it mean for buildings? Fewer companies have to report. For large investors, digital quality remains part of value and risk. Also read digital infrastructure, ESG and the value of real estate.
- What does the IT-Label show? An objective substantiation of digital quality, alongside energy and other ESG data.
Timeline
When which rule applies
12 September 2025
Data Act largely applicable.
12 November 2025
Gigabit Infrastructure Act largely applicable.
12 February 2026
Fibre requirements for new and majorly renovated buildings.
29 May 2026
First part of the EPBD in the Dutch Bbl.
15 August 2026
Dutch Cybersecurity Act in force.
11 September 2026
Cyber Resilience Act reporting obligation.
11 December 2027
Most Cyber Resilience Act requirements.
End of 2029
Building automation from 70 kW; SRI for large non-residential buildings.
Not legal advice
The IT-Label shows how the digital basis of a building is. Whether you comply with a law is something you assess with your adviser. This page gives an overview and is updated regularly.
Frequently asked questions
Know where your building stands
A Certified Partner objectively maps the digital basis of your building.
Related information
Cybersecurity in real estate
Every system connected to the network is a possible entry point. What cybersecurity means for a building, and how the IT-Label looks at it.
Glossary: IT-Label and digital infrastructure
From audit to wifi coverage: the key terms about the IT-Label, digital infrastructure and real estate, explained briefly and simply.
The IT-Label for real estate lawyers and notaries
A standard Dutch ROZ lease rarely says anything about digital infrastructure. The IT-Label gives you an objective description to refer to.
Digital Due Diligence for property deals
Research into the digital infrastructure at purchase, sale or a major lease transaction. An advisory report that underpins the decision and the negotiation.