NIS2 refers to Directive (EU) 2022/2555 of 14 December 2022, which Member States have applied since 18 October 2024. Belgium transposed it through the Law of 26 April 2024, in force since that same date, and the Royal Decree of 9 June 2024 designates the Centre for Cybersecurity Belgium (CCB) as the national cybersecurity authority. The CCB's NIS2 page remains the official reference.
Who falls under the NIS2 law in Belgium
An organisation is in principle in scope when it provides a service listed in Annex I or II of the law within the European Union, exceeds the thresholds for a medium-sized enterprise with at least 50 full-time equivalents or more than 10 million euros in annual turnover and balance sheet total, and is established in Belgium. The services concerned span 18 sectors:
- Annex I, highly critical sectors: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space
- Annex II, other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research
Some entities are covered whatever their size, such as DNS service providers or federal public administration. Even out of scope, you can be affected through your NIS2 customers, who must secure their supply chain, and the CCB advises their suppliers to apply at least CyFun® Basic.
Essential or important entity, a difference in supervision
Both categories share the same substantive obligations. Essential entities are in principle the large enterprises in Annex I sectors, with at least 250 full-time equivalents or with both more than 50 million euros in turnover and more than 43 million euros in balance sheet total, alongside a few categories named in the law, and the other entities in scope are important entities.
Essential entities are supervised ex ante and ex post with mandatory regular conformity assessments, whereas important entities are in principle only supervised ex post, after an incident or when there are indications that they are not complying. The CyFun® level you aim for follows from your risk assessment instead, as we explain in our article on the CyFun® Basic, Important and Essential levels.
The role of the CCB, from registration to inspection
The CCB is both the national cybersecurity authority and the national CSIRT, so you will deal with it at every stage:
- it manages registration on Safeonweb@Work, which was due by 18 March 2025 at the latest or as early as 18 December 2024 for certain digital providers, and any change must be reported to it within two weeks
- it receives notifications of significant incidents
- its inspection service can check entities on site, run ad hoc audits or security scans and request any relevant evidence
- it can identify an organisation as an essential or important entity, for example when it is the sole provider of an essential service in Belgium
What the law expects you to put in place
Entities take technical, operational and organisational measures proportionate to their risks, based on an all-hazards approach that covers at least eleven areas:
- policies on risk analysis and information system security
- incident handling
- business continuity and crisis management
- supply chain security
- security in system acquisition, development and maintenance
- assessment of the effectiveness of the measures
- cyber hygiene and cybersecurity training
- cryptography and encryption
- human resources security, access control and asset management
- multi-factor authentication and secured communications
- coordinated vulnerability disclosure
The management body approves these measures, oversees their implementation and is liable for the entity's breaches, and its members follow cybersecurity training. Finally, every significant incident is notified to the CCB with an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report no later than one month after that notification.
Demonstrating conformity and avoiding sanctions
For their regular assessment, essential entities choose between CyFun® (Essential certification or Basic or Important verification) and ISO/IEC 27001, in both cases through an accredited conformity assessment body (CAB) authorised by the CCB, or an inspection by the CCB. The resulting attestation gives them a presumption of conformity, and important entities may voluntarily follow the same route.
After a first milestone on 18 April 2026, the next deadline falls on 18 April 2027 for ISO/IEC 27001 certification or, if you aim for that level, CyFun® Essential certification, and a communication from the CCB's inspection service in August 2026 allows a transitional approach with a plan to reach the Essential level by 18 April 2028.
Failing to meet the risk-management or incident notification obligations can lead to an administrative fine of up to 10 million euros or 2% of total worldwide annual turnover for an essential entity, and up to 7 million euros or 1.4% for an important entity, whichever is higher, with the amount doubled for a repeat within three years.
How Sinplify helps you move forward
Sinplify structures and accelerates your NIS2 work by starting from what you already have, since our European AI reads your policies, procedures and audit reports, recognises the good practices already in place and prepares what is missing, with every piece of evidence counting for CyFun®, ISO 27001 and ReCyF at once. Your colleagues answer short questions by email without an account, the incident notification to the CCB comes pre-filled with its 24 hour, 72 hour and one month deadlines, and one click produces your audit file for each framework.
The assessment itself remains the job of an accredited body or the CCB, but you arrive with a file that is ready, so explore the platform or book a demo.