Israel publishes National Cybersecurity draft bill (2026): new obligations, enforcement authorities and broad implications

The draft National Cybersecurity Law (2026) was published in January 2026. This significant regulatory measure is likely to have broad impacts on organizations across the economy, especially digital service providers and entities that provide technological infrastructure.

The draft bill sets out cybersecurity and reporting obligations and introduces significant enforcement mechanisms, including, in certain cases, criminal liability. Its purposes are to regulate the activities of the National Cyber Directorate and strengthen cyber defense in Israel by imposing binding standards.

Applicability of the proposed law

The proposed National Cybersecurity Law will mainly apply to essential organizations, including government bodies and organizations in key sectors such  as communications, energy, health, and transportation, as described in the Third Addendum and related classification mechanisms The draft bill may also indirectly affect other public entities and entities that work with, or provide services to, essential organizations.

The draft bill also includes regulations relating to “providers of digital services or storage services” – especially where these services may affect the functioning of essential services in the economy. The draft bill is applicable, inter alia, to cloud computing services, data centers, hosting services, authentication and signing services, SMS services, identity and access management (IAM), cybersecurity services, data brokers, SaaS and PaaS and online platforms, such as search engines and social networks.

Providers of digital services or storage services may be included in the regulation if they meet at least one threshold criterion (annual turnover of at least ILS 40 million or at least 50 employees), or if they provide services to the Israeli government or to a service entity of the types specified in the draft bill.

What is the impact on companies subject to the law?

According to the draft bill, entities subject to the law will be required to fulfill cybersecurity requirements based on their business and the nature of their activities. These may include compliance with stringent information security and cybersecurity standards, the obligation to report cyber incidents, ongoing documentation and supervision by the competent authorities.

As stated above, the draft bill also prescribes significant enforcement mechanisms, including pecuniary sanctions of up to ILS 640,000 for violations and, in certain cases, exposure to criminal liability. Please note: the draft bill takes a proportionate approach to regulation. the more essential the entity is, or the greater its exposure to cybersecurity risks, the more robust the obligations that will apply to that entity.

The proposed law could have broad impacts not only on organizations defined as “essential organizations,” but also on their supply chains. In practice, entities subject to the law will also be required to impose stringent standards on suppliers and third parties, including through contractual provisions requiring cooperation in relevant audits and reports.

Recommended preparations

Although it is still only a draft bill, it reflects a clear intent to expand the powers of the National Cyber Directorate and introduce nationwide rules on cybersecurity duties, incident and incident response. If enacted in a similar form, the proposed law is likely to apply broadly and significantly affect Israel’s digital services market. These obligations are reminiscent of regulatory approaches in Europe (such as the Network and Information Systems Directive – NIS2) and elsewhere, but the proposed scope of applicability in Israel appears particularly broad.

We recommend that potentially affected companies start by carrying out a preliminary review of the draft bill’s requirements and assessing what changes may be needed.

• Perform a gap analysis between existing capabilities and the bill’s stricter information security and cybersecurity standards;
• Examine and update the organization’s information security procedures (including event management and reporting, authorizations management, etc.).

***

Barnea Jaffa Lande’s Privacy Protection, AI and Cybersecurity Department is at your service to advise you about the risks deriving from the proposed information security requirements, about the applicability of the law to your activities and about necessary preparations for the inception of the National Cybersecurity Law.

Dr. Avishay Klein is a partner and heads our firm’s Privacy Protection, Cybersecurity and AI Department.

Adv. Masha Yudashkin is an associate in our firm’s Privacy Protection, Cybersecurity and AI Department.