Missed the Belgian NIS2 Deadline of April 18, 2026? What Now

What April 18, 2026 Actually Required

The Royal Decree of 9 June 2024, which implements the Belgian NIS2 law, sets the steps. They differ by entity class:

• 1
  Essential entities, April 18, 2026 or 18 months after identification: on the CyFun certification route, a Basic or Important verification by a CCB-authorised conformity assessment body, at the level their risk analysis supports (Art. 22 §1). If they chose supervision by the CCB inspection service, a Basic or Important self-assessment (Art. 23 §1). On the ISO 27001 route, the scope and Statement of Applicability of the future certification.
• 2
  Important entities, April 18, 2026: no administrative formality with the CCB (CCB FAQ). They must still implement all NIS2 measures, and the CCB can ask for evidence, for example after an incident. A voluntary CyFun assessment is a self-assessment verified by a CAB at Important level or higher (Art. 11).

If you are not sure whether your organization is classified as important or essential, start with who must comply with NIS2.

What Comes Next for an Essential Entity

Missing the April 2026 step does not move the next dates. Three facts from the sources:

Your Route, and the 2027 Remediation Plan

The first three blocks are the routes the Royal Decree sets. Stay on the route you chose for your regular conformity assessment. The fourth block is the remediation plan for the 2027 date.

How to Prepare Your Catch-Up

Whatever your route, the same groundwork applies:

1. 1

   Confirm your entity class

   Essential or important depends on sector and size (NIS2 Directive, Art. 3). The April 2026 step applied to essential entities only.

2. 2

   Confirm your route

   CyFun with a conformity assessment body, CyFun under CCB inspection, or ISO 27001. The route decides what you owe.

3. 3

   Run the risk analysis

   The Royal Decree ties the level of your first verification to it (Art. 22 §1), and it is what can justify a level below Essential (Art. 7). Essential entities send it to the CCB with their conformity attestation (Art. 9).

4. 4

   Fill the CyberFundamentals workbook with evidence

   Score each control honestly and keep an evidence reference per control. A CAB or the inspection service will read it, and a wall of top scores without evidence helps nobody.

5. 5

   Contact the CCB inspection service

   The sources describe no late procedure for the April 2026 step. Ask the inspection service (inspection@ccb.belgium.be) how to regularise your position, and keep a written record of the answer.

No time to start from a blank workbook? Our instant on-screen scope check gives a rough estimate of scope, entity class and CyFun level in two minutes, no email required. Want a prioritized BASIC control list (30/90/180-day buckets) as the starting point for your catch-up? The written report is €395 flat, delivered in 48 hours.

What the CCB Has Said

Two points from the CCB sources we read:

• Priority until April 2027. The inspection service will prioritise checking that essential entities have measures equivalent to CyFun Important by April 18, 2027. Its letter of 11 August 2026 gives new threats from advanced AI as the reason.
• Evidence on request. For important entities, the CCB can ask for evidence that the measures are implemented, for example after an incident (CCB FAQ).

Our reading: neither point is a grace period, and a documented catch-up is the position you can show when someone asks.