Skip to content

National Annex — Belgium

Status as of October 2026: In force. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.

Review Status
Confidence Maintainer reviewed
Checked line by line against the legal text No
Reviewed by a lawyer No
Last reviewed October 2026
Reviewed by Frederik B. Krogsgaard, maintainer
Second reviewer Wanted, see CONTRIBUTING
Next review due April 2027

NIS2 implementation

Field Value
Implementing law Loi/Wet of 26 April 2024 transposing NIS2, in force 18 October 2024, one of the first in the EU. Registration was due by 18 March 2025. Essential entities had a first conformity assessment due by 18 April 2026 and need CyberFundamentals or ISO 27001 certification by 18 April 2027.
Competent authority Centre for Cybersecurity Belgium (CCB)
National CSIRT / reporting CCB / cert.be
Official starting point https://ccb.belgium.be

Country notes for your CDC

Registration and reporting via the Safeonweb@Work portal. Belgium's CyFun® framework, mapped to NIST CSF, is an accepted route to demonstrate compliance, and highly compatible with this framework's structure.

Standard checklist for all countries

  • GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
  • Entity registration completed with the national authority where required
  • RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
  • Contact established with the national CSIRT before the first incident
  • Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
  • National guidance and frameworks mapped to your control evidence, per the note above

Selector tag

Tick "Belgium" in tools/regulatory-profile.html to include this country's references under the be-nat tag.

Open CDC Framework, licensed CC BY 4.0.