Cybersecurity law & regulation in Belgium (2026)

Legal framework

Law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems of general interest for public security (Belgian NIS2 Law), transposing EU Directive 2022/2555; supervised by the Centre for Cybersecurity Belgium (CCB) as national competent authority and CSIRT.

NIS2 & cybersecurity law in Belgium

In Belgium, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Belgium implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Belgium

1. 01NIS2 transposition and competent authority

   The Law of 26 April 2024 (published in the Belgian Official Gazette on 17 May 2024, in force 18 October 2024) transposes NIS2. The Centre for Cybersecurity Belgium (CCB) is the horizontal national competent authority, single point of contact and national CSIRT; essential and important entities were required to register by 18 March 2025.

   ccb.belgium.be ccb.belgium.be

2. 02Scope: essential vs. important entities

   The law applies to 18 sectors of high criticality and other critical sectors (energy, transport, banking, financial market infrastructures, health, drinking and waste water, digital infrastructure, ICT service management, public administration, space, postal, waste management, chemicals, food, manufacturing, digital providers, research), distinguishing 'essential' and 'important' entities based on size and criticality.

   atwork.safeonweb.be freshfields.com

3. 03Incident notification duties (24h / 72h / 1 month)

   Significant incidents must be notified to the CCB (via its portal) with an early warning without undue delay and at most 24 hours after awareness, a full incident notification within 72 hours (24 hours for trust service providers), an intermediate report upon request, and a final report within one month.

   ccb.belgium.be ccb.belgium.be

4. 04CyberFundamentals (CyFun) framework

   The CCB has issued the CyberFundamentals framework with four assurance levels (Small, Basic, Important, Essential) mapped to NIST CSF, ISO/IEC 27001/27002, CIS Controls and IEC 62443; CyFun verification/certification or ISO/IEC 27001 certification provides a presumption of conformity with NIS2 risk-management obligations.

   atwork.safeonweb.be ccb.belgium.be

5. 05Sectoral overlay: DORA for financial entities

   The EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to Belgian banks, insurers, investment firms and ICT third-party providers since 17 January 2025, supervised by the National Bank of Belgium (NBB) and FSMA; DORA acts as lex specialis over NIS2 for the financial sector.

   nbb.be nbb.be

6. 06Critical Entities Resilience (CER) Directive transposition

   Belgium transposed the CER Directive (2022/2557) through the Law of 19 December 2025 (published in the Belgisch Staatsblad on 19 January 2026), creating a national framework for identifying and supervising critical entities; those designated as critical are automatically deemed 'essential' under NIS2.

   cms.law kpmg.com

NIS2 in Belgium: FAQ

Timeline of decisions

1. 18 Oct 2024Law · official
   NIS2 Law and implementing Royal Decree enter into force

   Belgium's NIS2 regime became effective: in-scope essential and important entities must apply risk-management measures and report significant incidents to the CCB (24h early warning, 72h update, 30-day final report), with registration required by 18 March 2025.

   Centre for Cybersecurity Belgium (CCB)

2. 9 Jun 2024Law · official
   Royal Decree implementing NIS2 designates CCB as national authority and CSIRT

   The Royal Decree completed transposition of EU Directive 2022/2555, named the CCB the national cybersecurity authority and national CSIRT, set conformity-assessment procedures, and recognised the CyberFundamentals (CyFun) framework and ISO/IEC 27001 as compliance references.

   Centre for Cybersecurity Belgium (CCB)

3. 5 Dec 2022Incident
   Play ransomware attack cripples the City of Antwerp

   Attackers breached the systems of Antwerp's IT provider Digipolis, encrypting data and disrupting municipal services, libraries, museums and elderly-care medication systems, a landmark public-sector incident underscoring supply-chain cyber risk in Belgium.

   VRT NWS

4. 20 May 2021Guidance · official
   National Security Council approves Cybersecurity Strategy 2.0 (2021-2025)

   Belgium's renewed national strategy set six objectives to make the country one of the least cyber-vulnerable in Europe, prioritising critical-infrastructure protection, incident response and public-private-academic cooperation, with the CCB at the centre.

   Centre for Cybersecurity Belgium (CCB)

5. 7 Apr 2019Law
   NIS Law transposes the first EU NIS Directive

   The Law of 7 April 2019 (published 3 May 2019) created Belgium's first horizontal framework for the security of networks and information systems of general interest, imposing security and incident-reporting duties on operators of essential services and digital service providers.

   Fieldfisher

6. 14 Oct 2014Law · official
   Centre for Cybersecurity Belgium (CCB) established by Royal Decree

   The Royal Decree of 14 October 2014 created the CCB as the national authority to monitor, coordinate and strengthen Belgian cybersecurity; it became operational in 2015 and is now the country's central cyber authority and CSIRT.

   Centre for Cybersecurity Belgium (CCB)

Sources

1. 1.ccb.belgium.be/regulation/nis2
2. 2.ccb.belgium.be/news/publication-nis2-law-belgian-official-journal
3. 3.ccb.belgium.be/sites/default/files/2025-08/NIS2_Notification_guide_v1.3-EN.pdf
4. 4.atwork.safeonweb.be/nis2
5. 5.atwork.safeonweb.be/tools-resources/cyberfundamentals-framework
6. 6.ccb.belgium.be/ncca
7. 7.nbb.be/en/financial-supervision-and-resolution/digital-resilience-and-cyber-
8. 8.cms.law/en/bel/legal-updates/new-legislation-for-critical-entities-belgium-s-
9. 9.freshfields.com/en/our-thinking/blogs/technology-quotient/nis2-directive-transposed-i
10. 10.ccb.belgium.be/news/notification-nis2-incidents
11. 11.nbb.be/en/news-events/cyber-resilience-top-priority-financial-market-infrast
12. 12.kpmg.com/be/en/insights/risk/the-critical-entities-resilience-cer-directive-an