Framework · Belgium
Belgian NIS2 Act
The Belgian NIS2 Act imposes security and reporting obligations on essential and important entities, with responsibility resting with the board. We help you work out what the law means for you and how to meet your obligations.
The framework explained
What does NIS2 mean for your organisation?
What is it?
NIS2 is the European directive on the cybersecurity of essential and important services. Belgium transposed it into the NIS2 Act of 26 April 2024, which has applied since 18 October 2024. Its aim is to manage cyber risks and protect the continuity of services.
Who is it for?
Whether you are in scope depends on your services, sector, size and where you are established. Think of energy, healthcare, transport, digital infrastructure and certain manufacturing activities. Linked enterprises may count towards your size, and some entities are exempt from the size criteria. A supplier may also face security requirements from customers without falling under the law itself.
Why take action?
Organisations in scope must register with the CCB, take appropriate security measures and report significant incidents. The board must approve the measures, oversee their implementation and undergo training. A policy on paper is only the start: you must be able to show it works in practice.
Where do you start?
- Check whether you are in scope and confirm your registration with the CCB.
- Assess risks and gaps, and assign owners and priorities.
- Put in place measures, supplier agreements, continuity plans and an incident reporting procedure.
- Keep evidence and organise follow-up at board level. Find out which conformity route and deadlines apply to your entity.
Public sources · content checked on 5 October 2026
Approach
How we help
We start with an assessment against the reference framework that applies to you.
Are you an SME or social enterprise with an establishment in Flanders? Then you may be eligible for a VLAIO programme.
- Determine whether and how the law applies to you.
- Gap analysis and roadmap.
- Build policies, procedures and evidence.
- Prepare for the applicable conformity assessment and supervision. We look at whether a CyberFundamentals (CyFun) or ISO/IEC 27001 route best suits your situation.
Frameworks
Explore the other frameworks
Each framework has its own scope and evidence requirements. Often, several apply at once.
Ready to make your NIS2 approach concrete?
Tell us about your activities, size and current measures. Together we determine what needs clarifying first and what support makes sense.