NIS2by country

NIS2 in Belgium

Wet van 26 april 2024 / Loi du 26 avril 2024 (NIS2)

Law in force since

Law
NIS2 Law
Authority
Centre for Cybersecurity Belgium (CCB)
Classes
essential entity (essentiële entiteit / entité essentielle) (essential), important entity (belangrijke entiteit / entité importante) (important)
Register
Safeonweb@Work
ISO 27001
Presumption of conformity

Check your company for Belgium

Get the NIS2 dates for Belgium

  • 2 dates as a calendar file.
  • An alert when the rules change.

This site stores your email and emails you when the NIS2 rules in Belgium change. Unsubscribe at any time.

The law

The law took effect on 2024-10-18. A Royal Decree of 9 June 2024 sets the details.

Name
Wet van 26 april 2024 / Loi du 26 avril 2024 (NIS2)NIS2 Law of 26 April 2024
In force
2024-10-18
Text
Read the NIS2 Law

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

The Belgian law keeps the Directive's size and class rules.

Also note

  • The CCB advises every supplier of an NIS2 entity to meet at least the CyFun Basic level.

Registration

Entities in scope at the start had to register by 2025-03-18. Digital providers had until 2024-12-18. If you are in scope and not registered, register now.

Portal
Safeonweb@Work
Rule
Fixed deadline
Deadline
2025-03-18
You need
Access to Safeonweb@Work for your organisation.

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the notification

Send the reports to the CCB (national CSIRT).

If you are a trust service provider: 24 hours for the notification.

Measures and proof

Essential
Regular conformity assessment by one of 3 routes: CyberFundamentals (CyFun) certification, ISO 27001 certification from a CCB-authorised body, or a CCB inspection.
Important
No formalities with the CCB. Supervision after the fact. You can join the conformity assessment regime voluntarily.

The dates, in order

  1. Registration deadline
  2. Essential entities: first conformity assessment stepEssential entities only
  3. Essential entities on the ISO 27001 route: certificationEssential entities only Next
  4. Essential entities on the CyFun route: reach the CyFun Essential levelEssential entities only

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, NIS2 Law. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The minimum fine is EUR 500. Fines can double for a repeat breach within 3 years.