NIS2: cybersecurity obligations for businesses in Belgium

The Act of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security, published in the Belgian Official Gazette of 17 May 2024, transposes Directive (EU) 2022/2555 (known as « NIS2 ») into Belgian law and repeals the regime of the Act of 7 April 2019. It is supplemented by the Royal Decree of 9 June 2024, which sets out the arrangements for designating the authorities, the conformity-assessment procedures and the applicable reference frameworks. The regime became applicable on 18 October 2024. It raises the level of requirements for cybersecurity risk management and significantly broadens the number of entities concerned compared with the previous regime.

The Centre for Cybersecurity Belgium (CCB) is designated as the national cybersecurity authority and as the national computer security incident response team (CSIRT), supported by sectoral authorities. The CCB handles the registration of entities, supervision, the receipt of incident notifications and methodological guidance. It provides the Safeonweb@Work platform for administrative steps. This centralised architecture aims to offer companies a clear point of contact while preserving the powers of sectoral regulators. Companies would be well advised to identify, without delay, the sectoral authority to which they are subject, since the allocation of powers may vary depending on the sector of activity and the nature of the services provided.

The scope rests on a twofold logic: the nature of the activity and the size of the entity. The Act in principle targets medium-sized and large entities active in the sectors listed in Annexes I (highly critical sectors) and II (other critical sectors), according to the thresholds of Commission Recommendation 2003/361/EC. Entities are divided into « essential » and « important » entities, this classification determining the intensity of the obligations and of the supervision regime. The assessment takes into account linked and partner undertakings. The exact classification of a given company must be verified on a case-by-case basis, as certain sectors or services may be subject to the regime irrespective of any size criterion.

On the methodological side, the CCB has developed the CyberFundamentals (CyFun®) framework, which proposes a set of security measures graded according to the level of risk. This framework is one of the means of demonstrating compliance with risk-management obligations; the ISO/IEC 27001 standard is also accepted. The Royal Decree of 9 June 2024 frames the conformity-assessment procedures and the conditions applicable to assessment bodies. Using CyFun is not an end in itself: it must be tailored to the entity's actual risk profile, and its assurance level must be proportionate to the criticality of the activities concerned. The approach adopted should be documented.

Essential and important entities were required to register with the CCB, via the Safeonweb@Work platform, within five months of the regime becoming applicable, i.e. by 18 March 2025 at the latest. A specific, shorter timetable applied to certain digital-sector providers (notably DNS services, top-level domain name registries, cloud computing, data centres, content delivery networks, online marketplaces, search engines and social networks), whose registration deadline was set at 18 December 2024. Companies that have not yet registered, or that subsequently cross the thresholds, should regularise their situation without delay and document their analysis of whether they fall within the scope.

The regime for notifying significant incidents is structured in several stages. The entity concerned must send the national CSIRT an early warning without undue delay and, in any event, within 24 hours of becoming aware of the incident, then an incident notification within 72 hours (24 hours for trust service providers), and finally a final report no later than one month after the incident notification. An intermediate report may be requested by the authority, and a progress report is provided for if the incident is ongoing. Where applicable, these notifications do not replace the obligation to notify a personal data breach to the Data Protection Authority.

Failure to comply with the obligations may give rise to administrative measures (warnings, binding instructions, or even suspension) and to fines. According to leading analyses, these may reach, for essential entities, EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, and, for important entities, EUR 7 million or 1.4% of turnover; these figures should be verified against the text of the Act. The liability of management bodies is moreover reinforced. This note is informative: the classification of an entity, the exact scope of its obligations and the applicable penalty regime must be assessed on a case-by-case basis, in light of the official CCB sources and the statutory text.

• Centre pour la Cybersécurité Belgique — La loi NIS2 et l'arrêté royal du 9 juin 2024
• Loi du 26 avril 2024 (NIS2), Moniteur belge du 17 mai 2024 (Justel, NUMAC 2024202344)
• CCB — Obligations NIS2 et notifications d'incidents (alerte 24h / 72h / rapport final 1 mois)
• Eubelius — Entrée en vigueur des lois belges transposant NIS2