Knowledge base · NIS2
Is your business covered by NIS2? A guide for Belgian SMEs
Whether the Belgian NIS2 Act applies to you depends on four things: where you are established, what you do, how big you are and whether an exception applies. This page works through them in order, including the edge cases where SMEs most often go wrong.
The framework
The Act of 26 April 2024, supervision by the CCBNot the sector alone: the combination of four factors decides
The Act of 26 April 2024 transposes the European NIS2 Directive into Belgian law and is enforced by the Centre for Cybersecurity Belgium (CCB). The sector lists follow those of the directive: Annex I for sectors of high criticality and Annex II for other critical sectors. What the obligations involve and how enforcement works is explained on the NIS2 page and the phasing page. Here the question is a single one: are you covered, and if so, as an essential or as an important entity?
Decision aid
Five steps to establish your situation
- 1Check your establishment: the Act applies to entities established in Belgium that provide a service listed in the annexes within the EU. For providers of public electronic communications, what counts is that they provide services in Belgium. For cloud, data centres, DNS, managed services and online platforms, what counts is where the main establishment is located, that is, where the decisions on cyber risks are largely taken.
- 2Look up your activity in Annex I or II. Look at what you actually offer. According to the CCB, a NACE code alone is not a valid basis. If your company is active in several sectors, the strictest obligations apply to the whole entity, not just to that one activity.
- 3Determine your size using the rules in the next block, including your group.
- 4Check the exceptions that apply regardless of size: see the table. The CCB can also designate an entity itself, for example if you are the sole provider of an essential service.
- 5Note your outcome and confirm it with the official CCB scope test. A documented note of that test is useful if someone later asks why you did or did not register.
The sectors
Is your activity listed in Annex I or Annex II?
The Belgian Act adopts the sectors of the European directive. Read the description, not just the sector name: within each sector, only the listed types of entities are covered.
| Annex | Sector | Who is covered |
|---|---|---|
| I | Energy | Electricity (including suppliers, system operators, producers and operators of charging points), district heating and cooling, oil, natural gas, hydrogen |
| I | Transport | Air, rail, water and road: including air carriers, airports, railway undertakings, shipping companies, port managers and operators of intelligent transport systems |
| I | Banking and financial market infrastructure | Credit institutions, operators of trading venues, central counterparties |
| I | Health | Healthcare providers, EU reference laboratories, research and development of medicinal products, manufacture of basic pharmaceutical products and of critical medical devices |
| I | Drinking water and waste water | Suppliers and distributors of drinking water (except distributors for whom drinking water is a non-essential part of the distribution of other goods) and undertakings that collect, dispose of or treat waste water, unless this is a non-essential part of their activity |
| I | Digital infrastructure | Internet exchange points, DNS service providers, TLD name registries, cloud computing, data centres, content delivery networks, trust services, public electronic communications |
| I | ICT service management (business-to-business) | Managed service providers and managed security service providers. Small IT partners themselves usually stay outside the law, while medium-sized and large providers fall under it. Customers do often impose the same measures on their IT partner by contract. |
| I | Public administration | Public administration entities as defined by the Act |
| I | Space | Operators of ground-based infrastructure supporting space-based services |
| II | Postal and courier services | Providers of postal services, including courier services |
| II | Waste management | Undertakings for which waste management is the main economic activity |
| II | Manufacture, production and distribution of chemicals | Manufacture, production and distribution of substances and mixtures |
| II | Production, processing and distribution of food | Food businesses engaged in wholesale distribution and in industrial production and processing |
| II | Manufacturing | Medical devices, computer, electronic and optical products, electrical equipment, machinery, motor vehicles and trailers, other transport equipment |
| II | Digital providers | Online marketplaces, online search engines, social networking service platforms |
| II | Research | Research organisations |
Sector and size
How the combination translates into your category
Essential and important differ mainly in supervision and burden of proof. The substantive obligations for risk management and incident reporting are the same.
| Sector | Large | Medium-sized | Small or micro |
|---|---|---|---|
| Activity from Annex I | Essential | Important | Out of scope, unless an exception applies |
| Activity from Annex II | Important | Important | Out of scope, unless an exception applies |
| Qualified trust service providers, DNS service providers, TLD name registries, providers of public electronic communications | Essential | Essential | Essential |
| Non-qualified trust service providers | Essential | Important | Important |
| Operators of critical infrastructure (Act of 1 July 2011) and federal public services | Essential | Essential | Essential |
Counting size
Where SMEs misjudge their size
The CCB applies the European SME definition. You are medium-sized as soon as you have 50 to 249 annual work units (AWU), or as soon as your annual turnover and your balance sheet total are both above 10 million euro. You are large from 250 annual work units, or when your annual turnover is above 50 million euro and your balance sheet total is above 43 million euro. Staff figures and financial figures are therefore alternatives: either one is enough to place you in a higher class. There are five pitfalls in this.
Full-time equivalents, not headcount
The CCB counts annual work units (AWU): someone who worked full time counts as one. Part-time and seasonal work count as fractions. The number of names on your staff list and the number of annual work units can therefore be far apart.
Turnover and balance sheet total
For the financial test, both figures must exceed the threshold. If only your turnover or only your balance sheet total is above it, your class does not change. But with 50 annual work units or more you are at least medium-sized in any case, even with a small turnover.
Linked enterprises
If you or someone else holds more than 50 percent, you count the data of that enterprise in full. Family holdings and sister companies can push a small SME over the threshold.
Partner enterprises
With a holding of 25 to 50 percent, you count a proportional share. This is the one most often forgotten.
The CCB looks at independence
In disproportionate cases, the CCB can reclassify an entity as important or exclude it. Counting on a favourable interpretation is not a strategy, a reasoned file is.
Outside the Act, inside the chain
Contractual, not legalNot covered but supplying a NIS2 entity? The requirements reach you through the contract
The NIS2 obligations do not apply directly to a supplier that is not itself covered by the Act. But a NIS2 entity must ensure that its suppliers and direct service providers take similar measures. The CCB recommends imposing a label or certification in contracts, for example a CyFun level or ISO 27001, and assessing supplier risk to choose that level. The CCB itself says that many organisations will be affected indirectly. So ask a customer explicitly which level and which scope it expects, and do not sign a vague reference to "NIS2 compliance" that you cannot live up to later.
If you are covered
First steps for an essential or important entity
- 1Register with the CCB via Safeonweb@Work, providing, among other things, name, enterprise number, address, contact details, IP ranges and sector. The general registration deadlines have passed. Anyone who falls under the Act later gets deadlines from that moment. You report changes within two weeks.
- 2Choose your reference framework: CyFun or ISO 27001 with a scope that covers all network and information systems. This gives a presumption of conformity until proven otherwise. Which CyFun level fits is explained in the article on the levels.
- 3Set up the incident process for significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report no later than one month after the notification, via notif.safeonweb.be. This does not replace the GDPR notification to the Data Protection Authority.
- 4Involve the management body: it approves the risk-management measures, oversees their implementation and must be trained. The management body can be held liable if the entity breaches the risk-management obligations.
- 5Plan the conformity assessment according to your category. Essential entities must have one carried out regularly, important entities can opt for one voluntarily. The dates for essential entities are on the phasing page.
Doubt and the future
Proposal, not yet in forceThe European small mid-cap proposal changes nothing in your answer today
In January 2026 the European Commission published a proposal for a targeted amendment of NIS2, including a new category of small mid-caps. That is a proposal. It has not been approved, not published and not transposed into Belgian law. Until that happens, the Act applies as it stands, and you decide on the basis of the thresholds above. So do not postpone investments for a change that may still change or never come. If you are close to a threshold, or your group structure is complicated, take the official CCB scope test on Safeonweb@Work. If doubt remains after the test, ask the CCB itself.
Frequently asked questions
Briefly answered
Want to know whether NIS2 applies to you?
In a first conversation of 30 minutes we go through your establishment, sector and group structure and what the outcome means for your business. The conversation is free.