Adoption of the Belgian NIS2 Law

Introduction

The NIS 2 law establishing a framework for the cybersecurity of networks and information systems of general interest for public security was published on Friday the 17th of May in the Belgian Official Gazette.

This law transposes into Belgian law Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (the “NIS2 directive”) on measures for a high common level of cybersecurity across the Union.

For whom ?

The NIS2 Law is aimed at organisations of a certain size that provide services in critical sectors.

Provided service

High critical sectors

The sectors of high criticality are

Energy (electricity, district heating and cooling, petroleum, natural gas, hydrogen)
Transport (air, rail, water, road)
Banking
Financial market infrastructure
Health
Drinking water
Waste water
Digital infrastructure
ICT service management
Public administration
Space

Other critical sectors

The additional critical sectors are

Postal and courier services
Waste management
Manufacture, production and distribution of chemicals
Production, processing and distribution of food
Manufacturing (of medical devices and in vitro diagnostic medical devices; computer, electronic and optical products; electrical equipment; machinery and equipment n.e.c., motor vehicles, trailers and semi-trailers; other transport equipment)
Digital providers
Research

The size criterium

With some exceptions, an organisation must be considered to be at least a medium-sized enterprise. A medium-sized enterprise has a workforce equivalent to at least 50 full-time workers and an annual turnover or annual balance sheet total exceeding 10 million euros.

More information

Discover the French version of the law

Discover the Dutch version of the law

News