- Regulatory17 May 2024Belgian NIS2 Act published in the Moniteur belge
Loi du 26 avril 2024 published in the Belgian Official Gazette (Numac 2024202344, p. 63179).
- Regulatory18 Oct 2024NIS2 Act enters into force
Entry into force per the consolidated text on ejustice. Most obligations of the Belgian NIS2 framework apply from this date.
- Regulatory18 Oct 2024Incident notification obligations apply
Early warning ≤24h, incident notification ≤72h (24h for trust service providers), and final report ≤1 month after the notification — channelled via the CCB.
- RegulatoryImportant18 Oct 2024Important entities — ex-post supervision only
Important entities are not subject to a mandatory conformity-assessment deadline. The CCB exercises ex-post supervision (investigations, audits, injunctions) when there is an indication of non-compliance.
- Enforcement18 Oct 2024Administrative fines applicable under the Belgian NIS2 Act
Essential entities: €500 to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. Important entities: €500 to €7,000,000 or 1.4%, whichever is higher. Figures as enacted in the Belgian Act (the €500 minimum is Belgian, not from EU text).
- Regulatory18 Dec 2024Registration deadline — digital-sector entities (2 months)
Entities providing services in the digital sectors listed in art. 14 §1 (DNS providers, TLD registries, cloud, CDN, managed services, online marketplaces, search engines, social networks) must register with the CCB within 2 months of entry into force — by 18 December 2024.
- Regulatory18 Mar 2025Registration deadline — all other entities (5 months)
Essential and important entities outside the digital-sector list must register with the CCB within 5 months of entry into force — by 18 March 2025.
- RegulatoryEssential18 Apr 2026Essential entities — initial CyFun (or ISO 27001) verification (18 months)
All essential entities must obtain at minimum a CyFun Basic or Important verification (or, on the ISO path, submit scope + SoA + internal audit) within 18 months of entry into force — by 18 April 2026.
- Today · 08/08/2026RegulatoryEssential18 Apr 2027Essential entities — full CyFun Essential / ISO 27001 certification (30 months)
Essential entities required to hold the CyFun Essential certification (or a full ISO 27001 certification) have an additional 12 months — total 30 months from entry into force — to obtain it: by 18 April 2027.
Information is curated from public official sources and verified manually. It is not legal advice. Verify dates against the national authority's website before acting on a deadline.