If your business has fewer than 50 staff counted in full-time equivalents, and either your annual turnover or your balance sheet total is no more than 10 million euros, the Belgian NIS2 law almost certainly does not apply to you directly. It covers organisations that are at least medium-sized and work in one of the sectors listed in its two annexes, plus a short list of exceptions where size does not matter. The way NIS2 is more likely to reach a small business is indirectly: a client that is in scope has to look at the security of its suppliers, and you may be one of them.

Three questions settle whether you are in scope. If a client has already sent you a security questionnaire, the supply chain section further down is the one you want.

What NIS2 is in Belgium

NIS2 is an EU directive, Directive (EU) 2022/2555. Belgium transposed it with the Law of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security, usually called the NIS2 law, and a royal decree of 9 June 2024. According to the Centre for Cybersecurity Belgium (CCB), the law entered into force on 18 October 2024. The CCB is the national cybersecurity authority, and its Safeonweb@Work site is where entities register and where most of the practical guidance lives.

Am I in scope? Three questions

The CCB's NIS2 page puts it simply: in principle you are in scope if you provide a service listed in annex I or II of the law, you are at least a medium-sized enterprise, and you are established in Belgium.

1. Do you provide a service from annex I or II?

Annex I ("highly critical sectors") covers energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space. Annex II ("other critical sectors") covers postal and courier services, waste management, chemicals, food production, processing and distribution, manufacturing of certain products (medical devices, electronics, electrical equipment, machinery, vehicles), digital providers and research.

Two of these sound broader than they are:

"Digital providers" means online marketplaces, online search engines and social networking platforms. A web shop that sells its own products is not an online marketplace.
"ICT service management (B2B)" means managed service providers and managed security service providers. A small IT firm that manages clients' systems can fit the definition but is usually below the size cap.

Every sector is defined by reference to EU legislation, and the details matter. The CCB publishes a definition matrix and an Excel NIS2 scope test that walks you through it.

2. Are you at least medium-sized?

The size rule comes from Commission Recommendation 2003/361/EC, the EU definition of an SME. As the CCB explains it, you look at staff first, counted in full-time equivalents:

Staff (FTE)	Annual turnover	Balance sheet total	Size
fewer than 50	up to €10 million	up to €10 million	micro or small
50 to 249	up to €50 million	up to €43 million	medium
250 or more	over €50 million	over €43 million	large

For the money, you may use whichever of turnover or balance sheet total is lower. In practice you are at least medium-sized if you have 50 FTE or more, or if both your turnover and your balance sheet total exceed €10 million. The CCB's own examples: a company with 35 FTE, €1 million turnover and a €50 million balance sheet is small; a company with 80 FTE and €1 million turnover is medium.

One trap: if your company belongs to a group, the Recommendation consolidates the figures of partner and linked enterprises. A small Belgian subsidiary of a larger group can count as medium or large on paper, although art. 3 §2 of the Belgian law lets the CCB take into account how independent the subsidiary is from the group, in particular for the systems it uses and the services it provides. The CCB's NIS2 page links the Commission's SME user guide for this calculation.

3. Does an exception apply regardless of size?

Some entities are in scope whatever their size. The CCB lists them:

qualified and non-qualified trust service providers;
DNS service providers and top-level domain name registries;
providers of public electronic communications networks or publicly available electronic communications services;
entities identified as critical entities under Belgian critical-entity resilience law;
public administration entities that depend on the federal State.

Entities that provide domain name registration services, such as registrars, have to register even when they are small, but that is the only obligation the size exception gives them.

On top of that, under art. 11 of the law the CCB can identify an organisation as essential or important regardless of size, for example when it is the sole provider in Belgium of a service essential for critical societal or economic activities. That happens in consultation with the organisation. If it has not happened to you, it does not apply to you.

Quick check

My business provides a service listed in annex I or II (checked against the definitions, not just the sector name).
We have 50 FTE or more, or both our turnover and balance sheet exceed €10 million.
I counted group companies where the SME rules require it.
We are a trust service provider, DNS provider, TLD registry or public electronic communications provider.
The CCB has contacted us to identify us as an essential or important entity.

If you ticked the first two boxes together, or any of the last two, read the next section and run the CCB scope test. If you ticked none, you are very likely not a NIS2 entity, and the section after next is the one for you.

If you are in scope

Entities in scope are either "essential" or "important". The difference, in the CCB's words, mainly relates to how strictly they are supervised and sanctioned: essential entities face regular conformity assessments, while important entities are in principle checked after the fact, for example after an incident.

The main obligations in the law:

Registration with the CCB on Safeonweb@Work. Under art. 13, entities had five months from entry into force, which the CCB puts at 18 March 2025. Digital-sector providers such as cloud and data-centre providers had until 18 December 2024. If you have just realised you are in scope, contact the CCB rather than waiting.
Risk-management measures (art. 30): eleven minimum areas, from risk analysis and incident handling to backups, supply chain security, multi-factor authentication and encryption. The CCB recommends its CyberFundamentals (CyFun) framework to implement them.
Incident notification to the CCB for significant incidents (art. 35): an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after that notification.
Management responsibility (art. 31): the management body approves the measures, oversees them and is liable for breaches, and its members must follow cybersecurity training.

The fines in art. 59 go up to €7 million or 1.4% of total worldwide annual turnover for important entities, and up to €10 million or 2% for essential entities, whichever is higher. They double for the same facts repeated within three years.

At this point you need the CCB's guidance and, most likely, a specialist. We are not lawyers or NIS2 auditors, and this article is not an assessment of your situation.

If you are not in scope: the supply chain

Art. 30 §3, 4° of the Belgian law, which transposes art. 21(2)(d) of the directive, requires every NIS2 entity to manage the security of its supply chain, "including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers".

In practice, if you supply a hospital, an energy supplier, a food producer or a mid-sized manufacturer, you may receive a questionnaire, a new contract clause or a request to show what you do about security. The CCB says so directly on its NIS2 page: a NIS2 entity could impose a CyFun level on its direct suppliers, and the CCB advises any organisation that may be in such a supply chain to meet at least CyFun Basic.

The CyFun framework has four levels. Small is a starting point for micro-organisations or those with limited technical knowledge, meant for a first self-assessment. Basic contains the standard security measures for all enterprises and is the first level that a conformity assessment body verifies. Important and Essential go further. The tools (a selection tool, a self-assessment spreadsheet) are free on the CyFun page; the 2023 and 2025 versions of the framework both remain usable until 18 April 2027.

In Flanders, the KMO-portefeuille used to subsidise cybersecurity advice. That door is closed: VLAIO says the 2026 budget was used up on 15 October 2026, and the government is stopping the scheme from 1 January 2027. For cybersecurity, VLAIO now points to its cybersecurity improvement trajectories. What is still open is in our article on the end of the KMO-portefeuille.

What to ask your software and website supplier

If you are the one sending the questionnaire, or simply want to know where you stand, these are the questions we would ask any supplier who builds or runs software for you:

Who owns the code, the domain and the hosting account, and can you get them handed over in writing?
Who has admin access to the site, the server and the database, is it personal (not a shared login), and is multi-factor authentication on?
How often are the CMS, plugins and server software updated, and who does it?
Where is the data hosted, and is it in the EU?

A supplier who can answer all four in writing is easier to put in front of a client's security team.

How we can help

We build websites and web applications, so these four questions are ones we expect to answer about our own work. Our website development page and the pricing page say what is included, such as EU hosting, updates and backups in the monthly care plan. We do not provide NIS2 compliance services or audits. What we can do is take a free look at what your current website shows the outside world.