NIS2 obligations in Belgium (NIS2 Law of 26 April 2024)

Competent authority & CSIRT Legal ref: Art. 17, 19

• Centre for Cybersecurity Belgium (CCB) is the national cybersecurity authority and national CSIRT; registration via Safeonweb@Work. atwork.safeonweb.be · 28 Oct 2026 · source-checked
• Centre for Cybersecurity Belgium (CCB) – designated as the national cybersecurity authority and national CSIRT. National Crisis Centre (NCCN) – collaborates closely with CCB in crisis management. Sectoral authorities have competences linked to supervision, administrative measures, additional identification of entities, and managing incidents’ impact. ecs-org.eu · 28 Oct 2026 · secondary source
• For frequently asked questions about the NIS2 legal framework in Belgium, consult the following link ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: link

Who's in scope (national deviations) Legal ref: Art. 3, 6(3)

• NIS 2 (the banking and financial market sectors are out of scope as they are covered by DORA). ecs-org.eu · 28 Oct 2026 · secondary source
• The Centre for Cybersecurity Belgium assesses this independence, and the King has the authority to define the evaluation criteria. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 13

• All NIS2 entities register on Safeonweb@Work. Digital-sector entities had until 18 Dec 2024; all other entities until 18 Mar 2025. atwork.safeonweb.be · 28 Oct 2026 · source-checked
• Upon entry into force, companies have 5 months to register with the CCB through the registration platform (via an online form). The deadline for registration depends on the type of entity. Essential, important entities and domain name registration service providers have 5 months from the entry into force of the law to register (March 18, 2025). ecs-org.eu · 28 Oct 2026 · secondary source
• Entities are required to provide the following details: ecs-org.eu · 28 Oct 2026 · secondary source
• Name and registration number. ecs-org.eu · 28 Oct 2026 · secondary source
• Up-tp-date address and contact details, including e-mail address, IP ranges and telephone number. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• List of Member States in which they provide the services, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: online form

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 25, 35

• Significant incidents are reported to the national CSIRT via an online form. Reporting requirements (significant incidents): ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours or 24 hours (providers of trust services). ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT or the relevant sectoral authority (as designated by the King). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. In the event of a significant cyber threat, essential and important entities must promptly inform the recipients of their services. Significant incidents are defined as incidents that cause serious operational disruption of services or financial losses for the concerned entity or affect other natural or legal persons by significant cause material or immaterial damage. Providers of trust services will report the incident within 24 hours when the incident has consequences for the provision of their trust services. ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: online form

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

• Management bodies must approve cybersecurity risk-management measures, oversee their implementation and are liable if the entity breaches those obligations; members must follow training sufficient to identify risks and assess practices. atwork.safeonweb.be · 28 Oct 2026 · source-checked

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 59

• From 500 to 125,000 EUR (violation of obligations under Art. 12). ecs-org.eu · 28 Oct 2026 · secondary source
• From 500 to 200,000 EUR (or an entity that has sanctioned employees or subcontractors for performing the obligations of the law in good faith and within the scope of their duties). ecs-org.eu · 28 Oct 2026 · secondary source
• From 500 to 200,000 EUR (failure to comply with supervision obligations). ecs-org.eu · 28 Oct 2026 · secondary source
• From 500 to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities; failure to comply with the obligations relating to the cybersecurity risk management measures and/or incident reporting under Art. 3). ecs-org.eu · 28 Oct 2026 · secondary source
• From 500 up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities; failure to comply with the obligations relating to the cybersecurity risk management measures and/or incident reporting under Art.3). ecs-org.eu · 28 Oct 2026 · secondary source
• The national cybersecurity authority is responsible for infringements of the provisions of the bill. The administrative fine is doubled in the event of a repeat offence for the same acts within three years. The combination of several breaches may give rise to a single administrative fine proportional to the seriousness of all the breaches. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 30

• Essential entities: by 18 Apr 2026 obtain (or be obtaining) at least a CyFun Basic/Important verification or hold a signed agreement with an accredited CAB; ISO/IEC 27001 route: submit scope, SoA and latest internal audit, full certification by Apr 2027; or request direct inspection. atwork.safeonweb.be · 28 Oct 2026 · source-checked
• Final CyFun assurance level must be certified by 18 Apr 2027. atwork.safeonweb.be · 28 Oct 2026 · source-checked
• Belgian Cyber Fundamentals Framework (CyFun) based on: NIST CSF, ISO 27001, ISO 27002, CIS Controls, IEC 62443. Link: Link ecs-org.eu · 28 Oct 2026 · secondary source
• Conformity against the requirements of the respective assurance levels in the CyberFundamentals Framework will be assessed according to the requirements set out in the CyberFundamentals Conformity Assessment Scheme (CAS). The assessment shall be performed by an accredited and authorised conformity assessment body. ecs-org.eu · 28 Oct 2026 · secondary source
• The Cybersecurity Fundamentals methodology can provide a comprehensive approach to addressing all risks that exist in IT, operational, supply chain, business continuity, and physical environments. Risk assessment must include the whole company. Management of vulnerabilities and the secure development lifecycle must be explicitly considered. This methodology requires continuous adaptation and periodic reviews, although there is no mention of specific minimum or maximum periods for these reviews. Belgium’s NIS2 Authority CCB will request evidence of risk analysis conducted, including the date of last update, scope, and application of risk-based controls, as part of their general audit process ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Link

Supervisory guidance

• CCB – The NIS2 Law atwork.safeonweb.be
• CCB – NIS2 Quickstart Guide atwork.safeonweb.be
• CCB – FAQ NIS2 and CyberFundamentals atwork.safeonweb.be

Key dates

• 18 Apr 2026 Belgium: essential entities – first CyFun verification / ISO 27001 evidence / inspection request
  atwork.safeonweb.be source-checked
• 18 Apr 2027 Belgium: essential entities – final CyFun level certified / ISO 27001 certification complete
  atwork.safeonweb.be source-checked

What changed recently

1. 16 Apr 2026
   CCB publishes what essential entities must have in place by 18 Apr 2026 atwork.safeonweb.be source-checked
2. 18 Oct 2024
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source