In short. The Belgian law of 26 April 2024 transposes the NIS2 directive and has applied since 18 October 2024. Registration with the Centre for Cybersecurity Belgium has been mandatory since 18 March 2025, and essential entities owed their first conformity evidence by 18 April 2026, through one of three routes: a CyberFundamentals verification by an authorised conformity assessment body, an ISO/IEC 27001 package, or a self-assessment submitted to the CCB. The next milestone is 18 April 2027. What decides the outcome of an inspection is not the volume of documentation produced, but whether the organisation can find a control, prove it is applied, and explain why it exists.
Where Belgium stands in October 2026
NIS2 was transposed by the law of 26 April 2024, published in the Moniteur belge on 17 May 2024, with a royal decree of 9 June 2024 as its implementing act and the Centre for Cybersecurity Belgium, the CCB, as national authority1. The obligations have applied since 18 October 2024, and registration on the Safeonweb@Work platform has been mandatory since 18 March 20252. By late 2025 the CCB counted roughly 1,500 essential entities and 2,500 important entities registered, with more than 4,000 registrations across all sectors3.
The date that changed the nature of the subject is 18 April 2026. By then, essential entities needed one of the three forms of evidence set out in the royal decree: a CyberFundamentals verification at Basic or Important level carried out by a conformity assessment body authorised by the CCB, an ISO/IEC 27001 package comprising the information security policy, the scope and the statement of applicability, or a self-assessment sent to the CCB for those who chose the direct inspection route1. Important entities had no administrative formality on that date, which does not exempt them from implementing the measures: the inspection service can ask them for evidence, typically after an incident4.
The CCB inspection service letter of 11 August 2026 sets out what follows: until 18 April 2027, checks will focus first on whether essential entities have measures equivalent to CyFun Important4. Maximum administrative fines under the law reach 10 million euros or 2% of annual worldwide turnover for an essential entity, and 7 million or 1.4% for an important entity, whichever is higher5.
Why NIS2 programmes rarely fail on the technical side
The CyberFundamentals framework has 7 controls at Small level, 34 at Basic, 133 at Important and 218 at Essential3. Faced with those lists, the usual reaction is to launch a documentation exercise: write the policies, fill in the tables, assemble the file. The work is necessary, and it sells well, because it can be planned and invoiced.
Its weakness shows up on inspection day. An auditor asking for proof that a control is applied will not settle for the document describing it. They want to see where it lives: who performs it, how often, and what trace it leaves. An organisation can hold a hundred approved policies and still not know which one answers the question being asked, or who on the team actually applies it. The documentation exists while the control does not hold.
There is a fair objection. Documentation is exactly what the law asks for, and the CCB accepts written files as evidence of conformity. True, and that is the threshold rather than the goal. A file describing controls nobody performs may clear a first deadline, and will survive neither an incident nor an inspection that goes one level deeper.
Four strands that hold over time
The NIS2 and CyberFundamentals programme launched at the client with the Chief Information Security Officer is built around four strands, which most entities in scope can adapt.
Legal documentation. Policies, scope, statement of applicability, evidence register. This is the visible part and the easiest to outsource, provided it describes what is actually done rather than what someone would like to do.
Securing the infrastructure. The technical measures themselves, owned by the operations and security teams, and the real constraint on the programme’s timeline.
Validation and traceability. For each control: who validates it, where the evidence sits, and how a colleague finds it in under a minute. The question looks secondary until someone has to answer an inspector, or a client sending through a supplier questionnaire.
Dissemination and engagement. The strand usually treated last, which decides the fate of the others. A control holds when the people applying it understand why it exists. A memo announcing a new rule produces declared compliance; an explanation of the risk the rule covers produces behaviour.
Artificial intelligence serves these four strands, in its place. Microsoft Copilot, used on this programme, speeds up drafting, cross-checking between documents and maintaining a corpus that ages quickly, and answers staff questions about a policy inside the tools they already use. What it does not do: define the scope, decide on an assurance level, or carry the accountability owed to the management body, which the law places on people.
Three questions before starting
Who in the organisation gets up in the morning with the 18 April 2027 deadline as their objective, and has the authority to arbitrate between security, operations and budget?
If an inspector asked today for evidence of a control picked at random from the framework, how long would it take to produce it?
Do the teams applying the controls know which risk they cover, or only that a rule has changed?
Frequently asked questions
What are the NIS2 deadlines in Belgium?
The obligations have applied since 18 October 2024. Registration on Safeonweb@Work has been mandatory since 18 March 2025. Essential entities owed their first conformity evidence by 18 April 2026, and the second milestone is 18 April 2027.
What is the difference between an essential and an important entity?
Essential entities are subject to proactive supervision and must demonstrate conformity on a set timetable. Important entities fall under ex-post supervision: they must implement the measures and provide evidence if the inspection service intervenes.
What does non-compliance cost?
Maximum administrative fines are 10 million euros or 2% of annual worldwide turnover for an essential entity, and 7 million or 1.4% for an important entity, whichever is higher. The law also makes management bodies accountable for approving and overseeing the measures.
CyberFundamentals or ISO/IEC 27001?
Both routes are accepted. CyberFundamentals, developed by the CCB, is graded across four levels and designed to be workable for mid-sized organisations. ISO/IEC 27001 suits organisations that already run an information security management system, or whose clients require the certificate.
How long does compliance take?
The constraint is rarely the drafting, which is measured in weeks, but the technical measures and the change in working practices, which are measured in quarters. An essential entity starting now for the April 2027 milestone is on a tight but workable timeline, provided one person is accountable for it.
Notes
- Centre for Cybersecurity Belgium, « The NIS2 law », Safeonweb@Work: obligations, registration, conformity routes and sanctions: atwork.safeonweb.be/fr/nis2. ↩
- Law of 26 April 2024, published in the Moniteur belge on 17 May 2024, obligations applicable since 18 October 2024, registration mandatory since 18 March 2025; overview dated 24 September 2026: cloudsoul.net. ↩
- Registration figures (CCB, November 2025) and CyberFundamentals control counts: easycyberprotection.com. ↩
- CCB inspection service letter of 11 August 2026 and the scope of the 18 April 2026 milestone, analysis dated September 2026: easycyberprotection.com. ↩
- Scale of administrative fines under the Belgian law: nisdra.eu. ↩
About the author. Bernard Lecuivre is a management lead in transformation, information systems and NIS2 compliance, based in Brussels. He heads the technology project management office at RTBF and supports executives on the execution of their transformation programmes through Coeos Transformation. Fifteen years of programmes for IBA, the Belgian Ministry of Defence, the European Commission, UCB and Médecins Sans Frontières. Certified Prince2 Practitioner, Agile Project Management, Professional Scrum Product Owner and ITIL Foundation.
Work with Bernard Lecuivre: LinkedIn