YTYK You think you know

Card 16 of 18 Belgium — the local layer ●○○ Foundational

The law of 26 April 2024

Belgium transposed NIS2 in the law of 26 April 2024, in force since 18 October 2024 — one day after the directive's transposition deadline, and ahead of most Member States.

Why it is like this

The directive binds the State; the national law binds you. Deadlines, the supervisory authority, the registration route and the conformity options are all set here, not in the directive.

Not to be confused with

A copy of the directive. The Belgian law makes choices the directive leaves open — notably naming the CCB as both CSIRT and competent authority, and recognising CyberFundamentals as a conformity route.

In practice

Belgian entities that read only the directive routinely miss the CyFun path and the Safeonweb@Work registration, both of which exist only in the national layer.

Source: Belgian law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems — Entry into force and scope. Read on .

Predict Check yourself

Where does a Belgian entity find its actual deadlines and its supervisory authority?

  1. In the Belgian law of 26 April 2024, which transposes the directive and makes the national choices.
  2. In the directive — transposition cannot change any of it.
  3. In ENISA's implementing guidance.
  4. In the Commission's implementing regulation on reporting thresholds.
Show the answer

In the Belgian law of 26 April 2024, which transposes the directive and makes the national choices.

A directive binds Member States as to the result. The obligations that reach an entity come from the national transposition — here, the law of 26 April 2024.