Belgium: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Reg. (EU) 2023/1114) as implemented by the Belgian Act of 11 December 2025 (published in the Belgian Official Gazette on 24 December 2025; in force 3 January 2026); twin-peaks supervision by the FSMA (Financial Services and Markets Authority) and the National Bank of Belgium (NBB). AML/CFT is governed by the Act of 18 September 2017 and the EU AML package; taxation by the Income Tax Code as amended by the 2026 capital-gains tax law.

Crypto and digital-asset activities are legal in Belgium and now sit under a comprehensive, in-force regulatory regime built on EU MiCA. The Implementing Act of 11 December 2025 entered into force on 3 January 2026, designating the FSMA as the competent authority for CASPs and crypto-asset public offerings, and the NBB as prudential supervisor for asset-referenced and e-money token issuers and credit-institution CASPs. A transitional grandfathering period allows pre-30 December 2024 service providers to continue until 1 July 2026 or until their MiCA authorisation is granted/refused.

Framework: EU Artificial Intelligence Act (Regulation (EU) 2024/1689), directly applicable in Belgium, with the Belgian Institute for Postal Services and Telecommunications (BIPT) designated as the main national competent authority and the FPS Economy coordinating implementation. The Belgian Data Protection Authority (APD/GBA) supervises AI systems processing personal data under the GDPR.

Belgium is governed primarily by the directly-applicable EU AI Act, whose obligations are phasing in (prohibitions and AI-literacy duties since 2 February 2025; general-purpose AI, governance and penalty rules since 2 August 2025; and the bulk of high-risk-system obligations applying from 2 August 2026). Under the January 2025 Federal Government Declaration and the 2025–2029 coalition agreement, BIPT is designated as the lead market-surveillance authority for the AI Act, alongside a granular list of sectoral authorities for Article 77 fundamental-rights supervision, though Belgium missed the 2 August 2025 governance deadline and formal designation is still being finalised. National-level activity is supplemented by the APD/GBA's September 2024 guidelines on AI and the GDPR, regional AI strategies (Flanders, Wallonia, Brussels/Innoviris) and the federal AI convergence plan.

Framework: EU General Data Protection Regulation (Regulation 2016/679) as directly applicable, supplemented by the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (Framework Act) and the Act of 3 December 2017 establishing the Data Protection Authority (as amended in 2023). Supervised by the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit, APD/GBA).

Belgium operates a fully comprehensive, GDPR-based personal data protection regime. The directly applicable GDPR is transposed and supplemented domestically by the Framework Act of 30 July 2018 (which also implements the Law Enforcement Directive 2016/680 and consolidated a previously patchy landscape replacing the 1992 Privacy Act), while the DPA itself is constituted under the Act of 3 December 2017 (amended by Acts of 7 September and 25 December 2023 to reinforce independence and permit third-party appeals). The APD/GBA has published a 2026-2028 Strategic Plan focusing enforcement on large-scale high-risk processing (adtech, data brokers, health, banking, tax databases) and processing of minors' data.

Framework: Act of 11 March 2018 on the legal status and supervision of payment institutions and electronic money institutions (transposing PSD2/EMD2), supervised by the National Bank of Belgium (NBB); FSMA oversees conduct-of-business. EU-level rules (SEPA Instant Payments Regulation 2024/886) apply directly, with PSD3/PSR reforms progressing at EU level in 2026.

Belgium operates a fully in-force, EU-harmonised licensing regime for payment institutions (PIs) and electronic money institutions (ELMIs/EMIs), administered by the National Bank of Belgium under the Act of 11 March 2018. Open banking is live under PSD2 (with NBB TPP registration), SEPA instant payments obligations apply since January/October 2025, and BNPL is tightly constrained by the Belgian Code of Economic Law. The upcoming EU PSD3/PSR package (provisional agreement Nov 2025; expected OJ publication in 2026) will refresh this framework once adopted.

Framework: Royal Decree of 2 August 2026 creating a Digital Nomad Visa (announced by State Secretary for Digitalisation Mathieu Michel); administered together with the general long-stay (Type D) visa / single-permit framework run by the Immigration Office (Office des Étrangers / Dienst Vreemdelingenzaken - IBZ) under FPS Home Affairs. EU baseline: Schengen Borders Code, EU Blue Card Directive and Single Permit Directive as transposed into Belgian law.

Belgium published a Royal Decree on 2 August 2026 creating a dedicated Digital Nomad Visa for non-EU remote workers, allowing a 12-month stay renewable once, with a €42,000 gross annual income threshold, proof of a foreign employment contract or foreign company ownership, and private health insurance. Before this scheme, remote relocators had to fall back on the Professional Card (self-employed route) or the single-permit for highly skilled workers, and both routes remain available. Belgium has no classic golden-visa programme, but the Professional Card can serve as an investor pathway on a discretionary basis.

Framework: EU Digital Services Act (Regulation 2022/2065), implemented nationally by the Act of 21 April 2024 and the Cooperation Agreement of 3 May 2024, with the Belgian Institute for Postal Services and Telecommunications (BIPT) designated as Digital Services Coordinator; complemented by the EU Terrorist Content Online Regulation (2021/784) and the NIS2 Law of 26 April 2024

Belgium's online-safety/platform regime is anchored in the fully-applicable EU Digital Services Act (DSA), operationalised nationally through the federal Act of 21 April 2024 and a 3 May 2024 cooperation agreement between the Federal State and the three Communities. BIPT is the national Digital Services Coordinator and single point of contact, working alongside the Flemish (VRM), French (CSA) and German-speaking (Medienrat) community media regulators. BIPT is also the competent authority for the EU Terrorist Content Online Regulation and can fine hosts up to 4% of global turnover; there is no dedicated Belgian age-verification statute, with age assurance instead following the emerging EU framework.

Framework: Law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security (Belgian NIS2 Law), transposing EU Directive 2022/2555; supervised by the Centre for Cybersecurity Belgium (CCB) as national competent authority and CSIRT.

Belgium has a comprehensive horizontal cybersecurity regime built on the NIS2 Law of 26 April 2024, which entered into force on 18 October 2024 and is enforced by the Centre for Cybersecurity Belgium (CCB). It is complemented by the sector-specific EU Digital Operational Resilience Act (DORA, applicable since 17 January 2025) supervised by the National Bank of Belgium and FSMA, and the recent Law of 19 December 2025 transposing the Critical Entities Resilience (CER) Directive. Belgium also operates its own CyberFundamentals (CyFun) framework providing a presumption of NIS2 conformity.

Framework: Belgian Code of Companies and Associations (CCA/CSA, 2019 reform); Crossroads Bank for Enterprises (CBE / KBO-BCE) at FPS Economy; notarial incorporation; regional professional-card regimes for non-EU self-employed; Interfederal Screening Committee (ISC) for non-EU FDI under the 1 July 2023 cooperation agreement.

Belgium allows 100% foreign ownership of Belgian companies and imposes no nationality restriction on shareholders or directors, but the setup is a multi-step notarial process rather than a fully online one-stop registration. The most-used vehicle, the BV/SRL, has no legal minimum capital since the 2019 CCA reform (a €1 nominal share is possible), yet it still requires a notarial deed, a two-year financial plan, CBE registration via an accredited enterprise counter, and VAT activation — typically completed in a few weeks. Non-EU/EEA/Swiss founders acting as self-employed or company managers additionally need a regional 'professional card', and non-EU investors in sensitive sectors face mandatory FDI screening.