Belgium transposed NIS2 through the Law of 26 April 2024, which has applied since 18 October 2024. The Centre for Cybersecurity Belgium (CCB) is the national cybersecurity authority and the national CSIRT. Essential entities had to show a first conformity assessment step by 18 April 2026; the second milestone is 18 April 2027.
This guide covers the law and its royal decree, who is in scope, registration on Safeonweb@work, the eleven measures and management duties, incident reporting to the CCB, the conformity assessment deadlines, which CyberFundamentals level you need, sector authorities, fines, what the law leaves open, and a checklist.
| Obligation | Belgian rule | NIS2 Directive | Status on 24 September 2026 |
|---|---|---|---|
| Scope: sector and size | Law, Art. 3 | Arts. 2 and 3 | Applies since 18 October 2024 |
| Identification by the CCB, regardless of size | Law, Art. 11 | Art. 2(2) | Case by case, with the entity |
| Registration on Safeonweb@work | Law, Arts. 13 and 14 | Arts. 3(4) and 27 | Deadlines passed; changes within two weeks (Art. 14 data: three months) |
| Eleven risk-management measures | Law, Art. 30 §3 | Art. 21(2) (ten measures) | Applies now |
| Risk analysis | Law, Art. 30 §5 | Art. 21(1) and 21(2)(a) | Sets your CyberFundamentals level |
| Management body approval, oversight, training | Law, Art. 31 | Art. 20 | Applies now |
| Incident reporting to the CCB: 24 hours, 72 hours, one month | Law, Arts. 34 and 35 | Art. 23 | Applies now |
| Periodic conformity assessment, essential entities | Law, Arts. 39 to 42; RD Arts. 5 to 10, 22 and 23 | Art. 32 | First step due 18 April 2026 (passed); second milestone 18 April 2027 |
| Voluntary conformity assessment, important entities | Law, Art. 41; RD Art. 5 §2 | Art. 33 | Optional |
| Ex post inspection, important entities | Law, Art. 48 | Art. 33 | After an incident or an indication of non-compliance |
| Administrative measures and fines | Law, Arts. 58 to 62 (fines: Art. 59) | Arts. 32 to 34 | Up to €10M or 2% (essential), €7M or 1.4% (important) |
RD is the royal decree of 9 June 2024.
What is the NIS2 law in Belgium?
The full title is the Law of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security. It was published in the Moniteur belge on 17 May 2024 (page 63179, NUMAC 2024202344). It transposes Directive (EU) 2022/2555 and repealed the Law of 7 April 2019, which had transposed NIS1 (Art. 97). It entered into force on 18 October 2024 (Art. 98), the day NIS2 became applicable across the EU. The law of 19 December 2025 on critical entities amended it from 19 January 2026, for example on sectoral authorities (Art. 15 §2) and security clearances for assessors of critical entities and public administration (Art. 40 §1).
A royal decree of 9 June 2024, published in the Moniteur belge on 24 June 2024, executes the law. It designates the CCB as the national cybersecurity authority (Art. 3 §1), names sectoral authorities (Art. 3 §2) and sets the conformity assessment framework, levels and transitional deadlines (Arts. 4 to 23). The CCB is also the single point of contact with other Member States and the EU.
Three Belgian choices stand out. The law lists eleven minimum measures, not ten. Essential entities must go through periodic conformity assessment. And a successful assessment gives a presumption of conformity (Art. 42).
Who is in scope of NIS2 in Belgium?
Two conditions, as in the directive. The entity provides a service listed in Annex I or Annex II of the law, and it is at least a medium-sized enterprise under Commission Recommendation 2003/361/EC.
In practice, that means 50 or more staff, or an annual turnover and a balance sheet total that both exceed €10 million. Staff are counted in annual work units, and the data of partner and linked enterprises are added in. Belgium softens this: the CCB takes into account how independent the entity is from its partner and linked enterprises, in particular for the network and information systems it uses to provide its services. If it is not medium-sized on its own data, it is not treated as medium-sized (Art. 3 §2). A 40-person company with €12 million turnover and a €6 million balance sheet is still small.
Annex I covers sectors of high criticality, such as energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Annex II covers other critical sectors, such as waste management, chemicals, food, manufacturing and digital providers. Research is also covered.
Essential or important?
The CCB summarises the split as follows:
- Essential: large enterprises (250 or more staff, or turnover above €50 million and balance sheet above €43 million) providing an Annex I service; and, regardless of size, qualified trust service providers, TLD name registries, DNS service providers, public administration bodies that depend on the State and entities identified as critical at national level under the CER Directive. Providers of public electronic communications networks or services are essential from medium size.
- Important: medium-sized Annex I entities, and medium or large Annex II entities.
The obligations are the same. The difference, in the CCB’s words, “mainly relates to how strictly they are supervised and sanctioned”. The comparison of essential and important entities sets this out at EU level.
Identification by the CCB
The CCB can also identify an organisation as essential or important regardless of its size, in four circumstances, in concertation with the entity and the relevant authorities (Art. 11). For an entity identified later, the conformity assessment clocks run from the date of identification, not from 18 October 2024 (RD Arts. 22 and 23).
Jurisdiction and suppliers
The law applies to entities established in Belgium, with the directive’s exceptions for electronic communications providers and for DNS, cloud, data centre and similar digital providers.
If you are not in scope but may be in the supply chain of a NIS2 entity, the CCB advises you to meet at least the CyberFundamentals Basic level. In practice, customers pass their supply chain duty on to suppliers through contracts and questionnaires.
Not sure where you land? The NIS2 scope checker walks through sector and size.
How do you register with the CCB on Safeonweb@work?
Registration is a form on Safeonweb@work, the CCB’s portal for organisations. Both deadlines have passed:
- 18 December 2024, two months after entry into force, for the data the digital providers send for the ENISA registry (Art. 14 §1): DNS service providers, TLD name registries, domain name registration services, cloud, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, search engines and social networking platforms.
- 18 March 2025, five months after entry into force, for registration by all essential and important entities and domain name registration services (Art. 13 §1).
An entity identified later by the CCB has five months from its identification (Art. 13 §1). If you are in scope and have not registered, do it now. Changes must be reported without delay and in any event within two weeks (Art. 13 §3); for the digital providers’ Article 14 data, within three months (Art. 14 §2). The CCB asks for changes to be reported immediately. The data list, as a record you can keep:
NIS2 REGISTRATION RECORD (CCB, Safeonweb@work)
All essential and important entities (Art. 13)
1. Name and CBE number (or equivalent)
2. Current address
3. Contact details: email, telephone, IP ranges
4. Sector and subsector (Annex I or II of the law)
5. Member States where you provide in-scope services
Digital providers, in addition (Art. 14)
6. Sector, subsector and type of entity
7. Address of main establishment and other EU establishments
8. Representative, if not established in the EU
9. Member States where you provide services
10. IP ranges
Owner: ____________ Last checked: ____________
Change reported to CCB on: ____________ (within 2 weeks)What does the Belgian NIS2 law require?
Eleven risk-management measures (Art. 30 §3)
Article 30 §3 sets the minimum cybersecurity risk-management measures, based on an all-hazards approach. The first ten follow Article 21(2) of the directive. Belgium adds an eleventh:
- Risk analysis and information system security policies.
- Incident handling.
- Business continuity, backup management, disaster recovery and crisis management.
- Supply chain security.
- Security in acquisition, development and maintenance, including vulnerability handling and disclosure.
- Policies to assess the effectiveness of the measures.
- Basic cyber hygiene and cybersecurity training.
- Cryptography and, where appropriate, encryption.
- Human resources security, access control and asset management.
- Multi-factor or continuous authentication and secured communications, where appropriate.
- A coordinated vulnerability disclosure policy.
In practice, the eleventh is the one teams forget. It needs a published way for outsiders to report a vulnerability, and a process behind it: see vulnerability disclosure under NIS2.
Risk analysis (Art. 30 §5)
The risk analysis under Article 30 §5 is not a formality in Belgium. On the CyberFundamentals route, it set the level an essential entity had to be verified at by April 2026, and it decides whether the entity may stay below the Essential level afterwards (RD Arts. 7 and 22). It is also sent to the CCB with the conformity attestation (RD Art. 9).
Management bodies
Under Article 31 §1, management bodies approve the risk-management measures taken to comply with Article 30, oversee their implementation and are responsible for the entity’s breaches of that article. Under Article 31 §2, members must follow training so that their knowledge and skills are sufficient to identify risks and assess risk-management practices and their impact on the entity’s services.
Citing the explanatory memorandum, the CCB reads “member of a management body” broadly, including persons who control the entity. In a Belgian company, control is determined under Articles 1:14 to 1:18 of the Companies and Associations Code. Article 61 adds personal responsibility: any natural person responsible for an essential or important entity, or acting as its legal representative, has the power to ensure the entity complies with the law and is responsible for failing in that duty. In essential entities that do not act in time, a temporary ban on exercising management functions can be requested (Art. 60).
How do you report an incident to the CCB?
Significant incidents go without undue delay to the national CSIRT, which is the CCB (Art. 34 §1), through the notification procedure the CCB provides for NIS2 entities. An incident is significant when it causes, or can cause, serious operational disruption or financial loss for the entity, or considerable damage to others. The stages (Art. 35):
- Early warning: without undue delay and at the latest within 24 hours of becoming aware of the significant incident.
- Incident notification: within 72 hours of becoming aware. Trust service providers have 24 hours (Art. 35 §2).
- Intermediate report: on request of the CSIRT or the sectoral authority.
- Final report: at the latest one month after the incident notification.
- Progress report: if the incident is still ongoing at that point, followed by a final report within one month of handling it.
Where appropriate, entities must also inform the recipients of their services of significant incidents that may affect those services. The mechanics of the clocks are in the NIS2 incident reporting timeline.
What are the CCB deadlines for essential entities?
Essential entities must undergo periodic conformity assessment (Art. 39). They choose between an assessment by a conformity assessment body approved by the CCB, on a reference framework set by the King (Art. 39, first paragraph, 1°, and Art. 40), or inspection by the CCB (Art. 39, first paragraph, 2°). Two reference frameworks are allowed: CyberFundamentals (CyFun) and NBN EN ISO/IEC 27001. Whichever they choose, its scope must cover all of the entity’s network and information systems (RD Art. 5 §1).
The royal decree phased this in: a first step within 18 months of entry into force, full compliance within 30 months.
| Route | By 18 April 2026 (18 months, passed) | By 18 April 2027 (30 months) |
|---|---|---|
| CyberFundamentals | Verification at Basic or Important level by a CCB-approved body, according to the risk analysis | Certification at Essential level, or a lower-level verification where the risk analysis justifies it |
| ISO/IEC 27001 | Scope and Statement of Applicability sent to the CCB | Certification by an accredited body |
| CCB inspection | Self-assessment at Basic or Important level, or information security policy, scope and SoA | Progress report on compliance |
The CCB’s update of 16 April 2026 set out what it accepted at the first milestone. On the CyFun route, a Basic or Important verification obtained or in progress, or an agreement signed with an accredited body. On the ISO route, the scope, the Statement of Applicability and the latest internal audit report. On the inspection route, a self-assessment with a request for inspection. The CCB warned that failing to submit complete or timely information may result in administrative measures or financial penalties.
Two further rules come from the royal decree. Inspection by the CCB takes place at most once a year (RD Art. 10), and the entity pays €150 an hour, indexed; public administration entities are generally exempt from the fee (RD Art. 20). And all essential and important entities must demonstrate continuous improvement, whatever route they chose (RD Art. 23 §3).
The reward is legal certainty. Essential and important entities that go through a periodic conformity assessment by an approved body are presumed, until proven otherwise, to meet their Article 30 obligations (Art. 42).
Important entities have no mandatory assessment. They can opt in to a voluntary assessment with the same frameworks (Art. 41), and are otherwise inspected ex post, after an incident or on indications of non-compliance (Art. 48).
Which CyberFundamentals level do you need?
CyberFundamentals is the CCB’s framework. It has four levels: Small, for an initial assessment by micro-organisations; Basic; Important, against targeted attacks by actors with common skills; and Essential, against advanced attacks by well-resourced actors. Basic and Important are verified; Essential is certified. The royal decree requires the framework to contain at least three assurance levels: basic, important and essential (RD Art. 4 §2).
| Who you are | Level | Basis |
|---|---|---|
| Essential entity, CyFun route | Basic or Important verification by 18 April 2026; Essential certification by 18 April 2027, or a lower-level verification if the risk analysis justifies it, on the entity’s responsibility | RD Arts. 6, 7 and 22 |
| Important entity | No mandatory level; voluntary assessment possible | Law, Art. 41 |
| Supplier to a NIS2 entity, not in scope | At least Basic, as advised by the CCB | CCB guidance |
| Micro-organisation starting out | Small, as a first self-assessment | CCB guidance |
If you already hold ISO/IEC 27001 with an appropriate scope, the CCB lets you obtain a CyFun label by having your conformity assessment body verify the certificate’s scope. How certificates and national schemes relate to NIS2 more broadly is in NIS2 and ISO 27001 certification.
Who supervises your sector?
The CCB leads supervision, runs the inspection service, receives incident notifications and handles registration. The royal decree, as published in June 2024, names sectoral authorities alongside it (RD Art. 3 §2). The ministers can delegate to a senior official of their administration.
| Sector | Sectoral authority |
|---|---|
| Energy | Federal minister for Energy |
| Transport, except water | Federal minister for Transport |
| Water transport | Federal minister for Maritime Mobility |
| Health: medicines R&D, basic pharmaceuticals, critical medical devices | Federal Agency for Medicines and Health Products (FAMHP) |
| Health: other entities | Federal minister for Public Health |
| Digital infrastructure: trust service providers only | Federal minister for the Economy |
| Digital providers | Federal minister for the Economy |
| Space and research | Federal minister for Science Policy |
| Manufacture of medical devices and in vitro diagnostics | FAMHP |
Sectoral authorities can inspect entities in their sector on sector-specific measures, and joint or delegated inspections with the CCB are possible. The incident front door stays the CCB.
What are the NIS2 fines in Belgium?
Administrative measures are in Articles 58 and 60 of the law; the fines are in Article 59. They are doubled for a repeat of the same facts within three years:
| Breach | Fine (Art. 59) |
|---|---|
| Information obligations under Art. 12 | €500 to €125,000 |
| Negative consequences for a person acting for the entity who carried out the law’s obligations in good faith | €500 to €200,000 |
| Obligations towards supervision | €500 to €200,000 |
| Important entities: risk-management or incident notification obligations | €500 to €7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher |
| Essential entities: risk-management or incident notification obligations | €500 to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher |
The two top ceilings match the minimums the directive requires (Art. 34). Besides fines, the CCB can issue warnings or binding instructions, order an entity to end a breach or comply, and order it to inform affected parties or make the breach public. Three measures are reserved for essential entities: appointing a monitoring officer and, where the entity does not act in time, a temporary suspension of a certification or authorisation and a temporary ban on exercising management functions, both of which can be requested (Art. 60). The measures and fines of Articles 59 and 60 do not apply to public administration entities (Art. 62). The EU-level picture is in NIS2 administrative fines.
What the Belgian model leaves open
The law and the royal decree set routes and dates. They do not say what an assessor or inspector will accept as evidence, and that is where the work sits.
Scope is the first trap. In practice, many ISO/IEC 27001 certificates cover one product, one site or one service. The royal decree requires the chosen framework to cover all the entity’s network and information systems. For an essential entity with a narrow certificate, the 2027 project is often a scope extension, not a new framework.
The risk analysis carries more weight than it looks. It sets the CyFun level and goes to the CCB with the attestation. A decision to stay below Essential rests on it, and on the entity alone. A generic register copied from a template will not support that decision under inspection.
Continuous improvement needs a trend. Showing improvement year on year means measuring the same things over time: MFA coverage, patch times, restore tests, open findings. A one-off audit snapshot cannot show a direction.
Registration data goes stale quietly. IP ranges change with every cloud migration, and contacts leave. The law allows two weeks to report a change, so a sensible approach is to tie the registration record to your asset inventory.
Closing these gaps is mostly an evidence problem. The evidence lives in identity providers, endpoint tools, cloud accounts and ticketing systems. Collected by hand once a year, it is out of date on arrival. CloudSoul is an automated platform with human-in-the-loop expertise: the platform collects control evidence from those systems continuously and a person reviews the exceptions. The wider programme is on the NIS2 compliance page.
NIS2 Belgium checklist
- Confirm your scope and entity type against Annexes I and II and the size test, including partner and linked enterprises.
- Check that your Safeonweb@work registration, contacts and IP ranges are current, and report changes within two weeks.
- Record management body approval of the measures and its members’ training.
- Map your controls to the eleven measures of Article 30 §3, including a published vulnerability disclosure policy.
- Test the route to the CCB notification form against the 24-hour and 72-hour clocks.
- Essential entities: confirm your route, check that your framework’s scope covers all network and information systems, and plan certification before 18 April 2027.
- Important entities: decide whether a voluntary CyberFundamentals assessment is worth it for your customers.
- Review the risk analysis at least yearly; it sets your CyberFundamentals level.
Sources
- Law of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security, Moniteur belge 17 May 2024, p. 63179, NUMAC 2024202344, consolidated text as amended by the law of 19 December 2025 on Justel (Arts. 3, 11 to 15, 30, 31, 34, 35, 39 to 42, 58 to 62, 97 and 98); overview on the CCB NIS2 page.
- Royal decree of 9 June 2024 executing the Law of 26 April 2024, Moniteur belge 24 June 2024, NUMAC 2024005260, etaamb mirror of the Moniteur belge.
- Centre for Cybersecurity Belgium, NIS2 scope, obligations and supervision and sanctions.
- Centre for Cybersecurity Belgium, “NIS2: 18 April 2026 deadline, what essential entities must have in place”, updated 16 April 2026, CCB.
- Safeonweb@work, The NIS2 law and La loi NIS2 (fines, registration, conformity assessment), and CyberFundamentals Framework.
- Centre for Cybersecurity Belgium, report an incident.
- European Commission, NIS2 Directive: Belgium.
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 27 and 32 to 34, EUR-Lex.
- Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises, EUR-Lex.
Frequently asked questions
What is the NIS2 law in Belgium?
It is the Law of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security. It transposes Directive (EU) 2022/2555, replaced the NIS1 law of 7 April 2019 and has applied since 18 October 2024. The Centre for Cybersecurity Belgium (CCB) is the national cybersecurity authority.
Who is in scope of NIS2 in Belgium?
Entities that provide a service listed in Annex I or II of the law and are at least medium-sized: 50 or more staff, or annual turnover and balance sheet total both above €10 million. Some types, such as qualified trust service providers, TLD registries and DNS service providers, are in scope regardless of size, and the CCB can identify further entities under Article 11.
What were the NIS2 deadlines in Belgium?
Digital providers had to send their registry data by 18 December 2024, and essential and important entities had to register on Safeonweb@work by 18 March 2025. Essential entities had to show a first conformity assessment step by 18 April 2026. By 18 April 2027, those on the ISO/IEC 27001 route must be certified, and those on CyberFundamentals certified at Essential level unless their risk analysis justifies a lower-level verification.
Is CyberFundamentals mandatory under NIS2 in Belgium?
No. Essential entities must undergo periodic conformity assessment under Article 39 and can choose CyberFundamentals, ISO/IEC 27001 or inspection by the CCB. Important entities have no mandatory assessment but can opt in voluntarily under Article 41.
What are the NIS2 fines in Belgium?
Under Article 59, up to €10 million or 2% of total worldwide annual turnover for essential entities and up to €7 million or 1.4% for important entities, whichever is higher. Lower bands of €500 to €125,000 and €500 to €200,000 apply to other breaches, and fines are doubled for a repeat within three years.
