NIS2 in Belgium: the 2026-2027 deadlines for your company

The NIS2 directive was transposed in Belgium by the law of 26 April 2024, which entered into force on 18 October 2024. The Centre for Cybersecurity Belgium (CCB) is the supervisory authority. Entities in scope had to register on Safeonweb@work by 18 December 2024 (digital sector) or 18 March 2025 (other sectors).

The next milestone for essential entities is 18 April 2027. This is no longer a "someday" project.

Did you know?

NIS2 fines can reach €10 million or 2% of worldwide turnover for an essential entity, and €7 million or 1.4% for an important entity. Members of the management body approve cybersecurity measures, oversee their implementation and can be held liable for non-compliance.

Who is affected?

As a rule, medium and large companies active in a sector listed in the law: at least 50 employees, or annual turnover and a balance sheet total both above €10 million. Sectors include energy, transport, healthcare, water, digital infrastructure, managed ICT services, postal services, waste management, chemicals, food, research and certain manufacturing industries (medical devices, electronics, machinery, vehicles…). Some entities are covered regardless of size, such as DNS or trust service providers.

By mid-March 2025, more than 2,400 organisations in critical sectors had registered with the CCB.

A small company outside that scope is not directly subject to NIS2. But if you supply an NIS2 entity, for example a 30-person IT subcontractor working for an energy company, expect cybersecurity clauses in your contracts: supply chain security is one of your clients' obligations.

Not sure? Our free mini-audit helps you get clarity in a few minutes. The CCB also offers a scope test on Safeonweb@work.

The 5 key obligations

1. Risk management and conformity assessment. Risk analysis and proportionate measures: business continuity, encryption, access control, vulnerability management, MFA. For essential entities, the CCB expected an assessment route to be under way by 18 April 2026 (CyberFundamentals Basic or Important verification, or a contract with an assessment body). By 18 April 2027, they must hold a CyberFundamentals certification at Essential level or an ISO/IEC 27001 certification; otherwise a remediation plan is required, with the Essential level reached by 18 April 2028 at the latest. Important entities are supervised after the fact and may opt into this regime voluntarily.

2. Reporting significant incidents. Early warning to the CCB within 24 hours, incident notification within 72 hours, final report within one month. Prepare a response plan now, not during the crisis.

3. Governance and board training. Management bodies approve risk-management measures and oversee their implementation. Belgian law (Article 31) also requires their members to undergo cybersecurity training. This is no longer "an IT thing".

4. Basic hygiene and staff training. Basic cyber hygiene practices and cybersecurity training are among the minimum measures in the directive. Management must ensure that similar training is offered to staff on a regular basis. Priority roles: management, finance, IT, HR.

5. Supply chain security. Assess your suppliers' security practices and include cyber clauses in your contracts. Your security also depends on the weakest link in your chain.

To go further, our GDPR & NIS2 training covers these obligations in detail, including board training. Available as a lunch & learn, half-day or conference.