"We're not allowed to use freelancers anymore." We hear it almost weekly, usually from a security manager who has to run a NIS2 project with a team that's already full. Procurement sent a memo, legal said "false self-employment", and the door to freelancers is shut. Even though the law asks for nothing of the kind.
What has actually changed
Since 1 January 2025 the Dutch tax authority has resumed enforcement on false self-employment, after almost ten years of moratorium. That's the news, and it's true. But the small print is milder than the headline. In 2026 the authority imposes no default penalties; back assessments for wage tax remain possible, but only for work after 1 January 2025, and an audit generally starts with a company visit rather than a books examination (ZiPconomy, 7 January 2026). Only in cases of intent or gross negligence are penalty surcharges on the table.
The law that was supposed to "clarify" everything, the VBAR, has largely been dropped. The new cabinet scrapped the clarification part and the minister confirmed this on 6 March 2026 (Van Doorne). So the assessment framework remains what it was: the criteria from the Deliveroo ruling. And in the Uber case of 21 February 2025 the Supreme Court added something that works out well for security professionals: there is no ranking among those criteria, and whether someone behaves as an entrepreneur counts fully (Hoge Raad).
What is new: the legal presumption based on hourly rate. Anyone earning less than €36 per hour will be presumed to be an employee; the Senate passed that law on 16 June 2026, with the commencement date to follow by royal decree (Eerste Kamer, 36.783). For a security engineer at €95 or an interim CISO at €140 that's irrelevant. That threshold was written for the food courier, not the pentester.
What really matters
Not the contract, but the assignment. A security freelancer who delivers a DORA implementation, decides how to approach it, brings their own laptop and certifications and sits at another client next quarter, is an entrepreneur. The same person running the SOC rota for three years, joining every team meeting and coordinating leave with the team lead, is not — however nice the model agreement.
That's why we look at four things at every intake:
- Does the work have a beginning and an end? A project, an audit, a migration, a certification. Not "just joining the team".
- Does the professional decide how? You say what needs to happen and when it must be done. Not what time someone starts.
- Is the person not embedded as a colleague? No performance review, no place in the headcount, no leave requests.
- Does the freelancer behave as an entrepreneur? Multiple clients, own tools, own risk, own rate.
If that picture holds, a freelance construction is perfectly defensible. If it doesn't, the honest conclusion is that you have a job, not an assignment. Then we'll say so, and a permanent role through recruitment is usually the better route; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. Also fine. Better than a falsely self-employed contractor with a nice contract.
That happens to be exactly what we do with interim in security: first find out what's really needed, then propose someone. We have no stake in freelance, permanent or secondment. We have a stake in an assignment that still holds up after three months.