On this page
The last six months before the certificate
The NIS2 Belgium deadline of 18 April 2027 is the day essential entities under Belgium's NIS2 law must be certified: with CyFun Essential or with ISO 27001. A year earlier, on 18 April 2026, they already needed a verified CyFun Basic or Important, or, on the ISO route, to send their scope and statement of applicability to the Centre for Cybersecurity Belgium (CCB).
Six months remain, and a certification audit is not booked in a week. If your company has a Belgian entity in scope, or supplies software, hosting or managed services to one from abroad, the requirements reach you too. Below: who is affected, which route fits and what an auditor wants to see.
Essential entity in Belgium
Certificate by 18 April 2027
Needs CyFun Essential or ISO 27001, or must submit a remediation plan.
Book the audit with an accredited body now.
Belgian branch of a foreign group
Certificate by 18 April 2027
Follows the Belgian law, even if the group answers to another country's rules.
Check which entity is registered and on which route.
Important entity
Duties of its own
Measures and incident reporting apply, a certificate is voluntary.
Consider a CyFun assessment as evidence.
IT or software supplier of a NIS2 entity
Duties of its own
The customer must manage its supply chain.
Be able to show access control, logging and backups.
Agency running platforms or sites
Through a customer
A link in the customer's chain, without a certificate of its own.
Document your own access and switch on two-factor sign-in.
Online shop or SME outside the NIS2 sectors
Not reached
Not in scope of the law.
Good maintenance and secure access.
Whether you are essential or important depends on sector and size; your registration with the CCB says which.
Belgium's stepped path, for readers abroad
NIS2 is an EU directive covering 18 critical sectors, transposed by each member state. Belgium did it on time: its law dates from 26 April 2024 and applies since 18 October 2024, the EU deadline. The CCB is the national authority and runs the Safeonweb@Work platform where entities register and find guidance. What sets Belgium apart is the stepped path for essential entities, with a first verified level in 2026 and certification in 2027, instead of a single deadline. A Belgian subsidiary follows this Belgian path even when the rest of the group answers to another country's NIS2 law. The NIS2 glossary entry explains the sectors and the difference between essential and important.
CyFun or ISO 27001
| Question | CyFun Essential | ISO 27001 |
|---|---|---|
| What it is | Belgian framework with fixed measures per level | International standard for an information security management system |
| What you need by 18 April 2027 | Certification at the top level, Essential | A certificate whose scope covers the NIS2 services |
| Who checks it | An accredited certification body | An accredited certification body |
| Fits best | Organisations working mainly in Belgium that want a fixed list | Groups working internationally or already on ISO |
Companies with customers in several countries usually choose ISO 27001, because buyers outside Belgium recognise it.
What the CCB said about falling behind
The CCB's Inspection Service wrote to essential entities about their mandatory conformity assessment. An entity that cannot show CyFun Essential level on 18 April 2027 must submit a remediation plan: evidence that it meets CyFun Important, and the measures to reach Essential by 18 April 2028. That applies on every route, including ISO 27001 and an inspection by the CCB itself. The CCB stresses that the legal obligations and deadlines do not change.
A remediation plan is not a delay
The plan sets how and when you get there. The obligation stays and a fine stays possible: up to EUR 10 million or 2 percent of worldwide turnover for an essential entity, doubled for a repeat within three years.
A six-month plan to 18 April
| When | What |
|---|---|
| Late October and November 2026 | Gap analysis against CyFun Essential or ISO 27001 |
| December 2026 | Choose a certification body and book the audit |
| January and February 2027 | Put missing measures in place: access, logging, backups, suppliers |
| March 2027 | Internal check, documents and evidence in order |
| Before 18 April 2027 | Certification audit completed |
The tightest step is the auditor's calendar: whoever looks for one in March shares it with every other entity that started late.
What an auditor wants to see in your software
A certifier does not ask whether you are secure, but whether you can show it. The directive names multi-factor authentication, backups, supply chain security and incident handling among the measures. For every system the business runs on, that means:
- who has access, and how you remove it when someone leaves;
- whether sign-in uses two-factor authentication;
- what is encrypted, in the database and in transit;
- what the activity log holds and for how long;
- where and how often backups are made, and when you last restored one;
- how you report an incident: an early warning within 24 hours, a notification within 72 hours and a final report within a month.
A web application or client portal you commission must answer those questions. Write them into the brief, for example with our software requirements template.
Supplying a Belgian NIS2 entity from abroad
The Belgian law does not bind a foreign supplier directly, but your customer must secure its supply chain. A Dutch SaaS company, a German hosting provider or a Polish development team serving a Belgian hospital or energy company should expect security questionnaires, incident reporting clauses, a data processing agreement that covers incidents and sometimes an audit. Software you place on the EU market also falls under the Cyber Resilience Act reporting duty and the new product liability rules for software.
An ordinary online shop is rarely a NIS2 entity. What counts there is a site that is updated and secured: read is WordPress safe and see what website maintenance covers.
What companies ask us about NIS2 in Belgium
How do I know whether my Belgian entity is essential or important?
It depends on sector and size, and the registration with the CCB says so. Essential entities are larger players in high-risk sectors. Important entities follow lighter rules.
Must an important entity be certified too?
No, a conformity assessment is voluntary for important entities in Belgium. The security measures and the reporting duty still apply.
Our group already holds ISO 27001 at headquarters. Is that enough?
Only if the scope of the certificate covers the services of the Belgian entity that falls under NIS2. Check the scope before April, not during the audit.
What does non-compliance cost an important entity?
Up to EUR 7 million or 1.4 percent of worldwide turnover, doubled for a repeat within three years.
What is still moving in Brussels
On 20 January 2026 the European Commission proposed targeted amendments to the NIS2 Directive to make the rules clearer and lighter. It is a proposal: Belgium's deadline of 18 April 2027 stands. In the Digital Omnibus, the Council chose on 21 October 2026 for a national entry point per member state, where incidents under different EU laws are reported in one place; read what the Council decided on cookies and breaches. Every other date for next year is in new EU rules in 2027.