meta_id 3072126

On April 16, 2026, Belgium's Cybersecurity Centre (CCB) confirmed that essential entities operating under the Network and Information Systems Directive 2 (NIS2) must demonstrate full implementation of cybersecurity risk management measures by April 18, 2026. The CCB's inspection service has formally required all essential entities to submit specific information and supporting documentation to enable ex-ante supervision and verification of their cybersecurity posture. Essential entities must satisfy compliance requirements through one of three recognised approaches. Under CyberFundamentals (CyFun), entities must obtain or be in the process of obtaining at least a "Basic" or "Important" level verification, or hold a signed agreement with an accredited assessment body. Under ISO/IEC 27001, entities must submit their certification scope, statement of applicability, and most recent internal audit report, with full certification to be completed by April 2027. Alternatively, entities may pursue direct inspection by providing a self-assessment, relevant supporting documentation, and formally requesting an inspection, though this approach may lead directly to surveillance measures. The April 18, 2026 deadline represents a binding regulatory obligation, not merely a procedural formality. Failure to submit complete information within the specified timeframe may result in administrative measures, financial sanctions, and additional surveillance actions. The NIS2 requirements derive from Belgian law that entered into force on October 18, 2024, aimed at strengthening cybersecurity of essential services through risk management, incident notification, and regulatory supervision. Detailed information on obligations, procedures, and practical aspects is available on the CCB's SafeOnWeb@Work platform at https://atwork.safeonweb.be/fr/frequently-asked-questions-faq-nis2-et-cyberfundamentals.