Belgium applied its NIS2 law from 18 October 2024, and essential entities there now have to prove conformity through a recognised assessment pathway, not just claim it. The Law of 26 April 2024 has been in force since 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as the national authority and the CyberFundamentals (CyFun) framework or ISO/IEC 27001 certification as the main routes to show compliance. This guide covers scope and registration, the measures and reporting duties, the conformity assessment timetable that runs to April 2027, sanctions, and what the measures mean for service accounts, API keys and AI agents. It is written for CISOs, compliance leads and auditors in organisations with Belgian entities. The directive itself is covered in the NIS2 Directive Guide; this page covers the Belgian layer.
Status checked 27 October 2026: the NIS2 Law of 26 April 2024 (published in the Moniteur belge on 17 May 2024, as reported) has applied since 18 October 2024, together with an implementing royal decree of 9 June 2024. The 18 April 2026 interim milestone for essential entities has passed; the next milestone is April 2027. Check the CCB NIS2 pages for any later guidance before relying on the dates below.
Key takeaways
- Registration deadlines have passed: essential and important entities had to register on Safeonweb@Work by 18 March 2025, and certain digital providers by 18 December 2024. Changes must be reported to the CCB immediately.
- Essential entities must be assessed: they choose CyFun certification, ISO/IEC 27001 certification, or inspection, and had to show an active pathway by 18 April 2026.
- April 2027 is the next hard date: full ISO/IEC 27001 certification for that pathway, and the higher CyFun level as reported, are due by April 2027.
- Important entities are supervised after the fact: they are inspected after an incident or on evidence of non-compliance, but may opt into the essential-entity regime voluntarily.
- Machine identities are inside the 11 measure areas: access control, MFA, supply chain and incident handling all reach service accounts, keys and AI agents, and certification auditors will sample them.
Scope: who and what is covered
The Belgian law follows the directive's sectors (Annexes I and II) and size-cap rule, distinguishing essential and important entities, and repeals the earlier NIS1 law of 7 April 2019. Organisations self-identify and register; the CCB runs the register and the scope pages and FAQ that explain the tests.
| Group | Registration deadline | Notes |
|---|---|---|
| Essential and important entities generally | Within 5 months of entry into force: 18 March 2025 | Form on Safeonweb@Work |
| Certain digital and cloud-related entities (for example DNS service providers, cloud computing providers, data centre providers, online marketplaces) | Within 2 months: 18 December 2024 | Shorter deadline set by the law |
| Any registered entity | Immediately after a change | Report changes to the registered information to the CCB |
- Late registration: an entity that should have registered and has not is already in breach. Register now and document why it was late.
- Groups: assess each Belgian legal entity, applying the EU SME definition with linked and partner enterprises.
- Financial sector: DORA applies to financial entities on overlapping obligations, with the National Bank of Belgium in a liaison role. See the DORA and NIS2 Overlap Mapping Guide.
- Sectoral authorities: the CCB leads, while sector authorities (for example the BIPT for relevant sectors) can impose additional measures and inspect within their sector, alone or jointly with the CCB.
Key obligations
Cybersecurity risk-management measures
Entities must take appropriate and proportionate measures covering at least 11 areas according to the CCB, including risk analysis, incident handling, business continuity, supply chain security and multi-factor authentication. The directive's ten Article 21(2) areas are the base. The CCB states that CyFun covers these points and can be used for conformity assessment.
Management bodies
- Approve and oversee: management bodies approve the risk-management measures and oversee their implementation, and are liable if the entity breaches these obligations.
- Training: board members must follow training so that they can identify risks and assess cybersecurity practices.
- Responsible persons: those representing the entity must have the power to ensure compliance and can be held liable for failures.
Incident notification
| Stage | Deadline |
|---|---|
| Early warning | Within 24 hours of becoming aware of a significant incident |
| Incident notification | Within 72 hours (24 hours for trust service providers) |
| Interim report | Only on request of the CSIRT or competent authority |
| Final report | No later than one month after the incident notification |
| Progress report | If the incident is still ongoing at the final report date; the final report then follows within one month of handling the incident |
Notifications go to the national CSIRT at the CCB, following the CCB notification guidance. Personal data breaches also go to the Gegevensbeschermingsautoriteit / Autorité de protection des données under GDPR Article 33. See the Cyber Incident Reporting Requirements Map.
The CyberFundamentals framework and conformity assessment
CyFun is the CCB's own framework. For essential entities it is one of three ways to meet the regular conformity assessment obligation.
| Pathway | Who assesses | What was due by 18 April 2026 | What is due by April 2027 |
|---|---|---|---|
| CyFun certification or verification | Conformity assessment body approved by the CCB after BELAC accreditation | Hold, or be actively obtaining, at least a Basic or Important verification, or have a signed agreement with an accredited body | Higher assurance level (reported as the Essential level by 18 April 2027) |
| ISO/IEC 27001 certification | Accredited certification body | Submit the certification scope, Statement of Applicability and most recent internal audit report to the CCB | Full certification |
| Inspection | CCB inspection service or a sector inspection service | Provide a self-assessment and supporting documents and formally request an inspection | Inspection outcome; the CCB warns this route may lead directly to supervisory measures |
Choosing a pathway
- Already ISO/IEC 27001 certified for the right scope: the ISO route is usually fastest. Check that the certificate scope covers the Belgian entity and the services in NIS2 scope, and that the Statement of Applicability includes the identity and supply chain controls.
- No certification and a Belgium-centred business: CyFun is designed for the Belgian regime and is graded, which helps medium-sized organisations progress in steps.
- Multinational groups: ISO/IEC 27001 is reusable across Member States, while CyFun is recognised mainly in Belgium. Many groups keep ISO for the group and check the Belgian scope carefully.
- Inspection route: suitable only when the entity is confident and well documented, because it exposes the entity directly to supervisory measures.
- Important entities: no assessment is required, but adopting CyFun voluntarily gives a defensible position if an incident triggers inspection.
Timeline and current status
| Date | Milestone |
|---|---|
| 26 April 2024 | NIS2 Law adopted |
| 17 May 2024 (as reported) | Published in the Moniteur belge |
| 9 June 2024 (as reported) | Royal decree implementing the law |
| 18 October 2024 | Law in force; NIS1 law of 7 April 2019 repealed |
| 18 December 2024 | Registration deadline for certain digital providers |
| 18 March 2025 | Registration deadline for essential and important entities |
| 18 April 2026 | Essential entities show an active conformity pathway |
| April 2027 | Full ISO/IEC 27001 certification for that route; higher CyFun level as reported |
Compare other Member States in the NIS2 Transposition Tracker.
Enforcement and penalties
The CCB inspection service can inspect essential entities at any time, before or after an incident, and important entities after an incident or on evidence of non-compliance (Article 48 of the Belgian law). Inspectors can visit on site, take minutes and write reports. Measures range from warnings to administrative fines under Articles 58 to 60.
| Measure | Essential entities | Important entities |
|---|---|---|
| Maximum administrative fine | The higher of EUR 10 million or 2% of total worldwide annual turnover | The higher of EUR 7 million or 1.4% of total worldwide annual turnover |
| Procedural failures (for example not cooperating with inspectors or not providing information) | Lower-tier fines | |
| Temporary bar on management functions | Possible where serious risks remain unaddressed, until corrective steps are taken | |
| Late or incomplete conformity submissions | May lead to administrative measures or financial penalties (CCB) | |
The fine maxima above come from a secondary summary because the CCB sanctions page could not be retrieved at the time of writing. Read Articles 58 to 60 of the law on the Belgian Official Journal before quoting figures to a board.
What it means for AI agents and non-human identities
A CyFun assessor or ISO/IEC 27001 auditor samples evidence. When the sample includes privileged access, the most powerful accounts are often service accounts, CI/CD tokens and integration keys. The Salesloft Drift incident shows why supply chain measures must include machine credentials: stolen OAuth tokens from one chatbot integration were used against hundreds of Salesforce tenants (see the Salesloft Drift breach).
| Measure area | NHI and agent control | Evidence an assessor can sample |
|---|---|---|
| Access control | Owner, purpose and least privilege for every service account, key, certificate and agent | NHI inventory, access review records including machine identities |
| Multi-factor and strong authentication | MFA for people; workload identity federation, managed identities or short-lived tokens for machines | Configuration exports, static key exception register |
| Supply chain | Register OAuth grants, API keys and accounts held by suppliers | Supplier access register, revocation records |
| Incident handling | Runbook to revoke and rotate machine credentials | Exercise record with revocation times |
| Logging | Central logs of machine authentication and agent actions | Log source list, retention settings, sample alerts |
- Agents: give each AI agent its own identity, scoped permissions and an audit trail tied to a human owner. See the Agent Identity and Access Guide.
- Safeonweb@Work access: the account used to manage registration is itself a privileged identity: named holders, deputy, MFA.
Compliance steps
- Confirm registration: check the Safeonweb@Work record for every Belgian entity and correct any changes now.
- Confirm classification: essential or important, with reasoning on file.
- Pick and record the pathway: CyFun, ISO/IEC 27001 or inspection, with the evidence submitted for 18 April 2026.
- Plan to April 2027: schedule the certification audit or CyFun assessment with an accredited body, allowing time for remediation.
- Brief and train management: minute approval of measures and record training.
- Rehearse reporting: 24-hour early warning, 72-hour notification and one-month final report, plus the GDPR route.
- Bring NHIs into scope: include service accounts and agents in the ISO/IEC 27001 Statement of Applicability evidence or the CyFun access control assessment. The Service Account Inventory Template helps.
- Important entities: decide whether to adopt CyFun voluntarily, and keep evidence ready for an incident-driven inspection.
Small versus large organisations
- Medium-sized important entities: registration, management training, MFA for staff, a vault for the production secrets that matter, and a written reporting route cover most of the exposure. A voluntary CyFun Basic self-assessment gives a structured gap list at low cost.
- Large essential entities: treat the April 2027 milestone as a certification project with a fixed audit date. Assign control owners, automate evidence collection, and run machine identity discovery continuously so the sample an assessor pulls is current.
- Managed service customers: where an IT provider runs your systems, its accounts and keys are part of your evidence. Put the provider's access, logging and revocation duties in the contract and test them.
Framework mapping
| Belgian obligation | NIST CSF 2.0 | NIST SP 800-53 r5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Management approval and training | GV.RR-01, GV.OV-01 | PM-2, AT-2 | A.5.1, A.6.3 |
| Access control and MFA | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-4, IA-5 | A.5.15 to A.5.18, A.8.2 |
| Supply chain security | GV.SC-01 | SR-3 | A.5.19 to A.5.21 |
| Logging and detection | DE.CM-01, PR.PS-04 | AU-2, AU-6 | A.8.15, A.8.16 |
| Incident notification | RS.CO-02 | IR-6 | A.5.24, A.5.26 |
| Regular conformity assessment | GV.OV-01 | CA-7 | Clause 9.2 internal audit |
Detection and measurement
- Pathway progress: percentage of CyFun or ISO/IEC 27001 requirements evidenced, tracked against April 2027.
- Audit findings on identity: number of open findings on access control and authentication, including machine identities.
- NHI ownership: share of machine identities and agents with owner and review within 12 months.
- Early warning time: detection to draft early warning in exercises, against 24 hours.
- Registration freshness: days since the Safeonweb@Work record was last verified.
Common failure patterns
- Certificate scope gaps: an ISO/IEC 27001 certificate that covers the group's head office but not the Belgian entity's in-scope services.
- Human-only access evidence: auditors sample privileged access and find service accounts with no owner or review.
- Leaving April 2027 too late: accredited bodies and remediation take months; the interim submission was not the finish line.
- Registration drift: mergers, new services or new contacts not reported to the CCB.
- Important entities doing nothing: ex post supervision still means a full inspection after the first significant incident.
Practitioner checklist
- Verify Safeonweb@Work registration and contacts for each Belgian entity.
- Record classification and chosen conformity pathway.
- Book the assessment or certification audit needed by April 2027.
- Minute management approval and keep training evidence.
- Rehearse the 24-hour, 72-hour and one-month reporting steps.
- Include non-human identities and AI agents in access control evidence.
- Register supplier-held credentials and OAuth grants.
- Read Articles 58 to 60 of the law and brief management on sanctions.
Standards and references
- Centre for Cybersecurity Belgium: NIS2
- Centre for Cybersecurity Belgium: NIS2 obligations
- Centre for Cybersecurity Belgium: NIS2 supervision
- Centre for Cybersecurity Belgium: NIS2 18 April 2026 deadline for essential entities
- EUR-Lex: Directive (EU) 2022/2555 (NIS 2)
- Copla: NIS2 implementation in Belgium
Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Readiness Checklist · ISO 27001 Certification Guide · Non-Human Identity (NHI) Guide. This guide summarises the Belgian NIS2 Law as it stood on 27 October 2026 and is not legal advice.