NIS2 directive regulations and implementation in Belgium

When the NIS2 Directive—short for the European Union’s “Directive on measures for a high common level of cybersecurity across the Union”—was adopted in December 2022, it marked a turning point in Europe’s approach to digital resilience. For Belgium, this evolution isn’t just theoretical. It’s legislative, operational, and rapidly becoming very real.

As we move through 2025, Belgium’s response to NIS2 is not only active but also ambitious. The new legislation dramatically expands the scope of regulated entities, redefines responsibilities, and raises the stakes for compliance. For financial institutions, ICT leaders, municipal governments, and medium-sized manufacturers alike, the Belgium NIS2 directive is reshaping how cyber risk is managed and governed.

Let’s dive into the milestones, scope, sanctions, and sectoral impacts that define the Belgium NIS2 implementation, and most importantly, what your organization needs to do about it.

Key takeaways on where Belgium stands with NIS2

The Belgian transposition of NIS2 is more than a legal update—it’s a total overhaul of the country’s cybersecurity governance framework. The Law of 26 April 2024—known colloquially as the NIS2-wet / loi NIS2—replaces the 2019 NIS-1 Act and centralizes implementation under the Centre for Cybersecurity Belgium (CCB).

The CCB functions not only as the national CSIRT (Computer Security Incident Response Team) but also as the principal registry and supervisory authority, supported by sector-specific regulators such as the FSMA (Financial Services and Markets Authority) and BIPT (Belgian Institute for Postal Services and Telecommunications).

To help illustrate the legislative and operational trajectory, the table below captures the timeline for Belgium’s transposition of NIS2.

A new regulatory framework with broader reach

Unlike its predecessor, the Belgium NIS2 law does not simply tweak definitions. It introduces a radically broader scope. Instead of roughly 1,000 operators, the law now covers between 10,000 and 12,000 entities, spanning 18 sectors. Nearly all medium-sized manufacturers and every municipality with over 50,000 residents are now in scope.

The law classifies organizations into two tiers:

• Essential Entities (EE): ≥ 250 full-time employees or €50 million turnover
• Important Entities (BE): ≥ 50 employees or €10 million turnover

PRO TIP

Already regulated under the old Wbni? Don’t assume continuity—you may now be automatically reclassified as an Essential Entity (EE), with tougher controls and higher fines.

Regardless of size, entities providing cloud, telecoms, DNS, and trust services are always in scope. Importantly, some previously unregulated entities under the Wbni framework are now automatically classified as EE under transitional provisions.

These designations are not just labels—they determine your reporting duties, regulatory scrutiny, and potential sanctions.

Sanctions and liability: compliance is no longer optional

Non-compliance under the Belgium NIS2 directive carries significant financial and reputational risk. The sanctions regime introduced by the law is rigorous and applies graduated enforcement, starting with warnings and ending with fines or even disqualification of directors for repeat failures.

Public authorities are exempt from fines but remain under the jurisdiction of the CCB for binding directives and audits.

For executives, the stakes are personal. Directors are required to formally approve and monitor their organization’s cybersecurity programs. Repeated negligence can trigger a three-year management ban, making board-level engagement non-negotiable.

PRO TIP

Use board resolutions to formally document cybersecurity strategy approval. This helps satisfy Article 20 obligations and can shield directors from personal liability during audits.

Sector-specific impacts: who is most affected?

The NIS2 Belgium transposition has far-reaching implications for multiple sectors. Entities that had previously flown under the radar now face specific obligations—from annual penetration testing to real-time incident notification protocols. Let’s take a closer look.

What Belgian companies should do next

With the law entering into force this October and mandatory registration due by 31 March 2025, the clock is ticking. Companies should immediately take the following actions:

• Run the CCB’s Scope Tool to determine whether you qualify as EE or BE.
• Prepare for registration by gathering your enterprise number, NACE code, and cyber contact details.
• Conduct a gap analysis against Article 21 requirements, focusing on areas like supply chain risk, multi-factor authentication, and incident response playbooks.
• Build a standard operating procedure for 24-hour, 72-hour, and 30-day incident reporting using CCB templates.
• Brief the board and begin cyber KPI reporting to mitigate liability risks.

These steps are not just good practice—they’re your new legal obligation.

Accelerate Belgium’s NIS2 readiness with CyberUpgrade

Belgium’s NIS2-wet brings 10,000–12,000 entities into scope by October 2024, with registration closing March 31, 2025 and formal audits kicking off in Q3 2025. CyberUpgrade aligns its plug-and-play workflows directly to Belgium’s Essential/Important tiers, 24 h/72 h/30 day reporting templates—so you can start remediating gaps today, not tomorrow.

Our Slack and Teams chatbot walks every team member through live, Article 21–aligned checks keyed to your enterprise number and NACE code, automatically capturing evidence in a central, regulator-ready vault. Layer in continuous vulnerability scans, penetration tests, SBOM exchanges and real-time monitoring, and you’ll spot threats long before they trigger fines up to €10 million, public naming or director bans.

Combine that with our EU-based CISO-as-a-Service for hands-on support—from gap analyses and board-level policy sign-off to pre-approved incident-response playbooks—and you’ll offload 80 % of your compliance work, save over €60 K annually, strengthen your security culture, and keep your focus on growth while Belgium’s audits loom. Let CyberUpgrade turn Belgium’s NIS2 compliance complexity into your compliance advantage.

Are you prepared for NIS2 enforcement?

Belgium has not only met the EU deadline for transposing the NIS2 directive—it has done so with an ambitious, structured framework designed to scale cybersecurity across its public and private sectors. The reach of the Belgium NIS2 directive extends far beyond traditional critical infrastructure and touches nearly every mid-sized organization in the country.

With the enforcement clock already ticking, organizations must act now to avoid legal, financial, and operational consequences. From regulatory alignment to executive responsibility, the burden of cybersecurity has officially moved from IT departments to the boardroom.

The path to compliance is clearly marked—what remains is your move.