FREE TOOL
Which NIS2 deadlines in Belgium have passed, and which are still ahead?
Seven dates make up the Belgian NIS2 timeline so far: the law itself, the incident-reporting duty, two registration deadlines by sector, and three conformity-assessment dates for essential entities. The list below sorts them from today into passed and upcoming, with a filter by entity type.
Upcoming
- 18 April 2027163 days left
Essential entities: final conformity assessment due
Essential entities must hold a CyFun Essential-equivalent assessment (via CyFun, ISO/IEC 27001 or CCB inspection), or justify and demonstrate a lower level under their own Art. 7 risk analysis, or file a remediation plan instead (see the 2028 row below).
Source: CCB, news item “New communication for NIS2 essential entities” (August 2026)
- 18 April 2028529 days left
Remediation-plan fallback: Essential-equivalent due
An essential entity that filed a remediation plan by 18 April 2027 (proof of CyFun Important-equivalent plus planned measures) must reach Essential-equivalent by this date. This does not change the legal deadline above; it is the Inspection Service’s stated expectation for entities that used the remediation-plan route.
Source: CCB, news item “New communication for NIS2 essential entities” (August 2026)
Passed
- 26 April 2024924 days ago
Belgian NIS2 law enters into force
The law transposing the EU NIS2 directive (EU) 2022/2555 into Belgian law is published and in force.
- 18 October 2024749 days ago
Duty to report significant incidents to the CCB begins
In-scope entities must report significant incidents to the Centre for Cybersecurity Belgium (CCB), via notif.safeonweb.be.
Source: CCB, NIS-2 quickstart guide
- 18 December 2024688 days ago
Registration deadline: digital-sector entities
Digital infrastructure, digital providers and ICT service management entities must register on Safeonweb@Work.
Source: CCB, NIS-2 quickstart guide
- 18 March 2025598 days ago
Registration deadline: all other in-scope sectors
Every other essential or important entity must register its organisation on the Safeonweb@Work portal.
Source: CCB, NIS-2 quickstart guide
- 18 April 2026202 days ago
Essential entities: basic/important assurance level due
Essential entities must be able to show CyFun basic or important assurance (certificate, signed CAB agreement, or equivalent), per the CCB Inspection Service’s 9 April 2026 request for information (NCCA/JK/INS-001).
Source: CCB Inspection Service, RFI of 9 April 2026 (NCCA/JK/INS-001)
What are the Belgian NIS2 deadlines, with sources?
-
26 April 2024: Belgian NIS2 law enters into force
The law transposing the EU NIS2 directive (EU) 2022/2555 into Belgian law is published and in force.
-
18 October 2024: Duty to report significant incidents to the CCB begins
In-scope entities must report significant incidents to the Centre for Cybersecurity Belgium (CCB), via notif.safeonweb.be.
-
18 December 2024: Registration deadline: digital-sector entities
Digital infrastructure, digital providers and ICT service management entities must register on Safeonweb@Work.
-
18 March 2025: Registration deadline: all other in-scope sectors
Every other essential or important entity must register its organisation on the Safeonweb@Work portal.
-
18 April 2026: Essential entities: basic/important assurance level due
Essential entities must be able to show CyFun basic or important assurance (certificate, signed CAB agreement, or equivalent), per the CCB Inspection Service’s 9 April 2026 request for information (NCCA/JK/INS-001).
CCB Inspection Service, RFI of 9 April 2026 (NCCA/JK/INS-001)
-
18 April 2027: Essential entities: final conformity assessment due
Essential entities must hold a CyFun Essential-equivalent assessment (via CyFun, ISO/IEC 27001 or CCB inspection), or justify and demonstrate a lower level under their own Art. 7 risk analysis, or file a remediation plan instead (see the 2028 row below).
CCB, news item “New communication for NIS2 essential entities” (August 2026)
-
18 April 2028: Remediation-plan fallback: Essential-equivalent due
An essential entity that filed a remediation plan by 18 April 2027 (proof of CyFun Important-equivalent plus planned measures) must reach Essential-equivalent by this date. This does not change the legal deadline above; it is the Inspection Service’s stated expectation for entities that used the remediation-plan route.
CCB, news item “New communication for NIS2 essential entities” (August 2026)
Which deadline applies to a given company?
An essential entity (large energy, health, government, telecom or digital infrastructure, or any size for some digital-infrastructure and public-administration services) carries all three 2026-2028 conformity-assessment dates. An important entity carries the registration and incident-reporting duties but no mandatory conformity-assessment date. Supervision is reactive, after an incident, not audited up front.
Not sure which of the two a given company is? The NIS2 scope check below answers that from sector and size in about two minutes, so you do not read these dates against the wrong entity type.
Not sure which rows apply? The NIS2 scope check settles essential, important or out of scope first, and the board duty memo covers what the management body answers for along the way.
Frequently asked questions
- Is 18 April 2027 or 18 April 2028 the real NIS2 deadline for essential entities?
- 18 April 2027 is the legal deadline to hold a CyFun Essential-equivalent conformity assessment. 18 April 2028 is not a new legal deadline: it is the date by which an entity that instead filed a remediation plan (proof of Important-equivalent plus planned measures) must reach Essential-equivalent, per the CCB news item of August 2026.
- What happens if a company missed the registration deadline?
- The registration deadlines (18 December 2024 for digital sectors, 18 March 2025 for everyone else) have passed, so a company that has not registered on Safeonweb@Work is late, not early. The obligation does not expire; registering now is the next step, not a missed opportunity.
- Do important entities have a conformity-assessment deadline?
- No mandatory one. Important entities are supervised reactively, usually after an incident. A voluntary CyFun conformity assessment is still possible and gives a presumption of conformity.
- Since when must incidents be reported?
- Since 18 October 2024. In-scope entities report significant incidents to the Centre for Cybersecurity Belgium (CCB) through notif.safeonweb.be.
- Where do these dates come from?
- The Belgian NIS2 law of 26 April 2024, the CCB’s NIS-2 quickstart guide, and the CCB Inspection Service’s letter of 9 April 2026 and the CCB news item of August 2026; each row above links its own source.
Related free tools
- NIS2 scope check Sector, size and a supply-chain step: see in about two minutes whether a company is an essential or important NIS2 entity, or out of scope, and which customer sectors push requirements down anyway.
- NIS2 board duty memo What a company’s management body itself must approve, oversee, train for and answer for under the Belgian NIS2 law. A one-page memo to print or email, for essential and important entities.
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/nis2-deadlines/, by Easy Cyber Protection.
#CYBERLEARN