NIS2 in Belgium: CCB, CyberFundamentals & Deadlines

Yes. Belgium transposed NIS2 into national law on April 26, 2024. The law gives the Centre for Cybersecurity Belgium (CCB) authority over registration, compliance and enforcement. Belgium was one of the first EU countries to complete transposition.

CyberFundamentals (CyFun) is a tiered cybersecurity framework developed by the CCB. It has 3 cumulative levels: Basic (34 controls), Important (133 controls), and Essential (218 controls). Belgium created it as a practical alternative to ISO 27001. Three quarters of registered entities have chosen a framework, and the CCB says most picked CyFun.

The deadline was April 18, 2026, and it has passed. By that date, essential entities on the CyFun route needed a Basic or Important verification from a CCB-authorised conformity assessment body. Those that chose supervision by the CCB inspection service sent a Basic or Important self-assessment instead. Those on the ISO 27001 route sent their scope and Statement of Applicability (Royal Decree of 9 June 2024, Art. 22 and 23). An Essential-equivalent conformity assessment is due by April 18, 2027, and that deadline is unchanged. These dates count from the law's entry into force; for an entity identified later, they count from its identification date (Royal Decree, Art. 22 and 23). Entities that cannot reach that level in time are asked to file a remediation plan with the CCB Inspection Service. That plan should preferably consist of proof of compliance at CyFun Important level plus the measures planned to reach Essential by April 18, 2028 (CCB Inspection Service letter ref. NCCA/JK/INS/2026-002, 11 August 2026). An entity whose own risk assessment justifies a lower CyFun level may choose it instead, without prior CCB approval but at its own responsibility. It must then show by 18 April 2027 that it meets that level (on the CyFun route, through a CAB verification). Member States had to identify critical entities under the CER Directive by July 17, 2026; an entity identified as critical is an essential entity under NIS2 (Art. 3(1)(f)).

One year after the law took effect, about 1,500 essential and 2,500 important entities had registered, so about 4,000 in total (CCB, November 2025). Belgium extended the scope beyond the EU minimum, so more organizations are included than in most other member states.

Start by registering at Safeonweb@Work if you have not already. Your CyFun level follows from your NIS2 class and your own risk assessment: essential entities default to Essential. Many start with CyFun Basic (34 controls) and work upward. Document your controls and gather evidence. Easy Cyber Protection helps you track progress and build your audit trail.