NIS2 Belgium: are accounting firms and fiduciaries in scope?
Accounting appears in neither Annex I nor Annex II of the Belgian Act of 26 April 2024. But a fiduciary that runs its clients' IT can become a managed ICT service provider, and every firm feels the supply chain pressure of its in-scope clients.
The short answer
No, in the vast majority of cases: a Belgian accounting firm or fiduciary is not in NIS2 scope simply because it keeps books. Accounting, tax and advisory activities appear in neither Annex I nor Annex II of the Belgian Act of 26 April 2024 transposing the NIS2 directive, and the Centre for Cybersecurity Belgium (CCB) does not treat them as a regulated sector[1]. In principle you have no Safeonweb@work registration to file and no CyberFundamentals certification to pass.
Three reasons not to close this page. First, a firm can fall into scope through a side activity: if it runs its clients' IT, it may meet the Annex I definition of a managed service provider[1]. Second, your manufacturing, hospital, logistics and energy clients are in scope, and supply chain security is a legal obligation for them, so they will put commitments in front of you[4]. Third, you hold tax mandates, eStox access and, since 1 January 2026, structured electronic invoicing flows[5][6][7]. NIS2 or not, that is the finest set of keys in the Belgian economy.
Are you in scope? Six questions to ask
Answer yes or no. A single yes to questions 1 to 3 justifies a serious analysis; questions 4 to 6 do not trigger NIS2 but set your real level of exposure.
- 1. Do you install, administer or maintain servers, workstations, a network, hosting or a business application for your clients, on site or remotely?
- 2. Do you resell accounting or office software and add operation, monitoring or first-line support on top?
- 3. Does your group have 50 staff or more, or turnover and balance sheet total above 10 million euros? That threshold does not create scope on its own, but it decides the important or essential classification once the sector is established[4].
- 4. Have you received, in the last twelve months, a security questionnaire or a cybersecurity clause from a client that is in scope?
- 5. Do your staff hold active MyMinfin mandates on behalf of clients[7]?
- 6. Have you been exchanging structured electronic invoices for clients since 1 January 2026[5]?
What the Belgian Act of 26 April 2024 requires, and of whom
If one of your activities does fall in scope, here is the Belgian timetable, which is not the one applying elsewhere. The CCB is both the national cybersecurity authority and the supervisory authority, supported by sectoral authorities[1].
| Obligation | Deadline | Who |
|---|---|---|
| Registration on the Safeonweb@work portal | 18 March 2025, five months after the Act entered into force[1] | Essential and important entities |
| CyberFundamentals verification at Basic or Important level by an accredited conformity assessment body | 18 April 2026[1][2] | Essential entities |
| CyberFundamentals certification at Essential level | 18 April 2027 (twelve further months)[1][2] | Essential entities whose risk requires it |
| Early warning of a significant incident to the CCB | 24 hours[3] | All entities in scope |
| Incident notification | 72 hours[3] | All entities in scope |
| Final report | 1 month after the notification[3] | All entities in scope |
The CCB CyberFundamentals framework (CyFun) sets three assurance levels, Basic, Important and Essential, the applicable level being determined by the entity's own risk assessment[1]. On penalties, the directive caps administrative fines at 10 million euros or 2 % of worldwide annual turnover for an essential entity and 7 million euros or 1.4 % for an important entity, whichever is higher[4].
The Belgian trap: when a fiduciary becomes a managed ICT service provider
This is the only realistic route into NIS2 for a Belgian accounting firm, and it is a wide one. Annex I covers ICT service management (B2B), and the CCB defines a managed service provider as an entity that installs, manages, operates or maintains ICT products, networks, infrastructure or applications through active assistance or administration, on site or remotely[1].
What is not enough. Using your own IT tools, or giving a client incidental IT help, does not make you an MSP on its own: the service actually provided has to be examined against the definition[1].
What should worry you. The firm that hosts client files on its own server and opens remote access to them, administers their user accounts, drives their backups or bills a monthly support line has left advisory ground. In Belgium that managed ICT activity is treated as a sector in its own right; see our page on NIS2 Belgium and managed IT services.
The practical consequence is blunt: scope is assessed on activity, not on the company's name. A 60-person firm that has grown a small IT arm for its clients can end up an important entity, with registration, risk management measures and reporting duties, while its 200-person, strictly accounting competitor stays out.
What applies to you even outside NIS2
Being out of scope does not mean being left alone. Four very Belgian pressures bear on your firm.
1. Your in-scope clients' supply chain. The directive requires essential and important entities to take account of supply chain security and the practices of their direct suppliers[4]. Your hospital or industrial client is not asking you to pass CyFun; it is asking you to prove what you do. That is the same movement described in our guide on NIS2 Belgium for manufacturing and industry, seen from the other side of the contract.
2. Tax mandates. The ITAA documents a mandate management module through which the firm acts on behalf of its clients[7]. One compromised staff account does not expose a file: it exposes a portfolio.
3. eStox and the UBO register. eStox, built by the ITAA with Fednot, is an electronic register of securities linked to the UBO register: where the function is switched on and a valid mandate is recorded in MyMinfin, certain information is transmitted automatically and the annual reconfirmation is handled from the platform[6]. Registering in the UBO register remains the company's duty, but the access sits with you.
4. Structured electronic invoicing. Since 1 January 2026, Belgian VAT-registered businesses must exchange structured electronic invoices for the B2B transactions concerned[5]. The obligation sits with the business, not its accountant, but the firm is the one setting up the flows, and an invoicing flow is exactly what payment fraud tries to divert.
Add the GDPR, where the Data Protection Authority remains the competent authority in Belgium, independently of NIS2: a payroll or client data breach is handled there, not at the CCB.
The first five actions
- Settle the MSP question in writing. List the IT services you provide to clients, compare them with the CCB definition[1], and record the conclusion, dated and signed by a partner. Cost: half a day. This is the document you will produce if supervised.
- Close leavers' access on the day they leave. MyMinfin mandates, eStox, accounting software, email, VPN: one list, one owner, a quarterly check. Most incidents in a firm start with an account that should have been closed.
- Make two-factor authentication mandatory on email and remote access. No exception for partners. It is the measure that stops the most attacks for the smallest budget.
- Write a one-page bank callback procedure. Any account number change notified by email, from a client or a supplier, is verified by an outbound call to an already known number. Nothing else brings invoice fraud down.
- Prepare a two-page standard answer to security questionnaires. Backups with a dated restore test, device encryption, 2FA, access management, subcontractors and hosting, incident contact. You will answer in twenty minutes instead of three days. Our template is set out on our supplier security questionnaire page.
At CyberNovaLabs.io
CyberNovaLabs.io works in the Netherlands, Belgium, France and Luxembourg, and the answer changes at every border: compare with our guide on NIS2 in Luxembourg for accounting firms and fiduciaries, or with our overview page NIS2 in Belgium. To find out in five minutes whether your IT activity pushes you into scope, use our free NIS2 check.
If your firm is mainly looking to talk to the right decision makers rather than fill in forms, our B2B appointment setting for accounting firms and fiduciaries comes with no minimum term, priced per appointment or as a package, with qualification criteria written down before launch; pricing is on quotation.
Let's talk about your firm: ask for a 20-minute call.
Sources
- CCB - FAQ NIS2 en Belgique, version 2.0.1 (fevrier 2025)
- CCB - NIS2: 18 April 2026 deadline, what essential entities must have in place
- CCB - La notification des incidents NIS2
- Directive (UE) 2022/2555 (NIS2) - champ d'application, mesures et sanctions (art. 2, 3, 21, 34)
- SPF Finances - Facturation electronique (E-invoicing)
- ITAA - eStox et le registre UBO (manuel)
- ITAA - Manuel de gestion des mandats
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Belgian tax portal attacked: deadline moved (28/10/2026)
Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.
Read the article →November 3, 2026 · 9 min readAI Act 2026: what SMEs actually need to know
Applicable since 2 August 2026, the AI Act comes down to three duties for an SME that buys AI. The heavy Annex III rules now wait until 2 December 2027. Here are the dates, the fine ceilings that actually apply to an SME, and who enforces in the Netherlands, Belgium, France and Luxembourg.
Read the article →October 27, 2026 · 7 min readBrotli flaw: Node.js patched, then .NET out-of-band (25/10/2026)
One Brotli flaw triggered two separate fixes in four days, first at Node.js, then at Microsoft. The defect belongs to neither: it comes from a Google library that both of them bundle. For an SME, the useful question is not "do we run Node.js?" but "what is inside the software we run, and who updates it?".
Read the article →October 27, 2026 · 7 min readB2B cold call script: a framework that doesn't sound scripted
A recited script is audible in the first second. Here is a six-block framework with one mandatory sentence per block, the wording the authorities require in four countries, and the formula that tells you how many calls fill a diary.
Read the article →October 26, 2026 · 7 min readBelgium: 47 entities hit by data breaches in 2026 (24/10/2026)
Dark web monitoring, confirmed by the Centre for Cybersecurity Belgium, counts at least 47 Belgian entities hit by a data breach since January 2026. Incident reports received by the CCB have already passed the full-year 2025 total. Here is the useful reading for an SME in our four countries, plus the list to clear this week.
Read the article →October 26, 2026 · 8 min readNIS2 Netherlands: is your manufacturing plant in scope?
In the Netherlands NIS2 is called the Cyberbeveiligingswet, in force since 15 August 2026. For a factory the test is not "we make things": six precise Annex II categories decide, then company size. This guide gives the grid, the regulator, the registration desk and the reporting clock.
Read the article →