Does Belgium's NIS2 law apply to your organisation?

Belgium's NIS2 law of 26 April 2024 has applied since 18 October 2024. The Centre for Cybersecurity Belgium supervises it. Use the form for an indication of essential or important status, then check registration on Safeonweb@Work.

Indicative only, not legal advice.

Check your organisation

Your answers stay in this browser. Submitting the form does not send them to a server, and the page does not store them.

Activity

Annex I is sectors of high criticality. Annex II is other critical sectors. If more than one activity fits, run the check again. Confirm the stricter result with the competent authority.

Size

Use annual figures in euro. Headcount is the number of employees (annual work units if you have them). Medium means 50 or more employees, or turnover and balance sheet total both above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Linked and partner enterprises

Add 100 percent of a linked enterprise: a holding or control above 50 percent. Add only your share of a partner enterprise: a holding from 25 to 50 percent. A holding below 25 percent stays out of the total. This is the simple version of Recommendation 2003/361/EC. NIS2 says a public-sector shareholder does not by itself change the size test.

Country

Choose a Member State to see national notes. Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Slovenia and Sweden show national notes. Every other country says that national details are coming soon.

Possible national designation

Optional. Tick a box only if it might apply. The checker cannot see a Member State's list, so the result will tell you to check the designation.

Indicative result only. This is not a legal determination of your NIS2 status and not legal advice. Your status depends on national law and on any identification by your Member State. Confirm it with the competent authority or a qualified adviser.

Try the live demoBook a gap review

Install free from GitHub (self-hosted). Core is the free self-hosted edition.

Last checked: 1 November 2026.

The NIS2 law of 26 April 2024 and the Royal Decree of 9 June 2024

The law establishing a framework for the cybersecurity of networks and information systems of general interest for public security was published in the Moniteur belge on 17 May 2024. The Royal Decree of 9 June 2024 was published on 24 June 2024. The law has applied since 18 October 2024. This checker uses the Directive's medium and large enterprise test. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Who is covered

Medium-sized and larger entities in the annex sectors are the main group. Public administration at federal and regional level is covered. Size-independent services and national designations still matter.

The CCB and registration on Safeonweb@Work

The Centre for Cybersecurity Belgium (CCB) is the competent authority, with sectoral authorities beside it. Essential and important entities, and domain name registration services, register on Safeonweb@Work within five months of the law's entry into force (by 18 March 2025) or, if identified later under Article 11, within five months of that identification (Art. 13 § 1). DNS, TLD, registration, cloud, data-centre, CDN, managed (security) service and digital-platform providers also had to submit registry information within two months, by 18 December 2024 (Art. 14 § 1). Changes are notified without delay (Art. 13 § 3).

Incident reporting: 24 hours, 72 hours, one month

For a significant incident, send an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the incident notification (Art. 35). Confirm the reporting channel with the CCB.

Management body duties

The management body has liability and training duties. CyberFundamentals (CyFun) or ISO/IEC 27001 can support a presumption of conformity. Confirm the assessment dates with the CCB.

Next steps

Check another country. Read the NIS2 checklist for SMEs and the guide to NIS2 incident reporting deadlines. NIS2 compliance software and the self-hosted install are the product pages. Try the live demo or book a gap review.

Other country pages: Austria, Finland, Germany, Ireland, Italy, Luxembourg, Netherlands, Poland, Slovenia, Sweden.

FAQ

When did NIS2 enter into force in Belgium?

Belgium's NIS2 law of 26 April 2024 was published in the Moniteur belge on 17 May 2024 and has applied since 18 October 2024. The Royal Decree of 9 June 2024 implements it.

Who is the Belgian NIS2 authority?

The Centre for Cybersecurity Belgium (CCB), designated by the Royal Decree of 9 June 2024, together with sectoral authorities.

How do I register?

Essential and important entities, and domain name registration services, register on Safeonweb@Work within five months of the law's entry into force (by 18 March 2025) or, if identified later under Article 11, within five months of that identification (Art. 13 § 1). DNS, TLD, registration, cloud, data-centre, CDN, managed (security) service and digital-platform providers also had to submit registry information within two months, by 18 December 2024 (Art. 14 § 1). Changes are notified without delay (Art. 13 § 3).

What are the incident reporting deadlines?

For a significant incident, send an early warning within 24 hours, an incident notification within 72 hours, and a final report no later than one month after the incident notification (Art. 35). Trust service providers notify within 24 hours. Confirm the channel with the Centre for Cybersecurity Belgium.

Is this checker legal advice?

Indicative only, not legal advice.

Directive text: Directive (EU) 2022/2555 on EUR-Lex. Size test: Commission Recommendation 2003/361/EC. Agency overview: ENISA.

Belgian sources: Law of 26 April 2024, Royal Decree of 9 June 2024, Safeonweb@Work, CCB regulation.