← All resources

NIS2 Belgium: webshops, marketplaces and the CCB register

Published October 19, 2026 · 8 min read · CyberNovaLabs.io

A Belgian webshop selling its own products is almost never in scope of NIS2. A marketplace is — as an important entity that had to register with the CCB by 18 December 2024, three months ahead of everyone else. What applies, what does not, and what your customers will ask for anyway.

The short answer

For most Belgian online shops the answer is no: NIS2 does not apply to a webshop that sells its own products. The directive never targeted "online retail" as a block. It targeted three specific digital services — online marketplaces, online search engines and social networking platforms^[1][9]. Selling your own shoes, spare parts or cosmetics on your own site does not make you a marketplace: you are not connecting buyers with third-party sellers.

Two exceptions matter to a large part of the sector. First: if third-party sellers trade on your platform, you are an online marketplace and therefore an important entity from 50 staff or EUR 10 million turnover. Second: even out of scope, you will be questioned by customers who are in scope. For Belgian B2B e-commerce, that is the live issue today.

Are you in scope? Four questions

In order. A "no" to the first two takes you out of direct scope.

1. Do third-party sellers sell on your site? This is the deciding test. A marketplace connects buyers with sellers who are not you. A brand site with 40,000 SKUs and dropshipping is still a seller selling.
2. Do you exceed 50 staff, or EUR 10 million turnover and EUR 10 million balance sheet? Below that, a marketplace normally falls out of scope on size, unless specifically designated^[1].
3. Is your main establishment in Belgium? For digital services, jurisdiction does not follow your customers: the country of the main establishment determines the competent authority^[2]. A marketplace whose management and security decisions sit in Ghent answers to the CCB even if 70% of revenue comes from France.
4. Do you run another listed activity? Many e-commerce operators also run their own transport fleet, operate third-party warehousing, or resell hosting. Those activities carry their own thresholds, and that is usually how scope arrives.

NIS2 Belgium e-commerce: what the law of 26 April 2024 requires

In Belgium NIS2 is not just a directive. It was transposed by the law of 26 April 2024, applicable since 18 October 2024^[1][2]. The competent authority is the Centre for Cybersecurity Belgium (CCB), not the data protection authority, which keeps the GDPR. In scope, four blocks of obligations apply.

• Register with the CCB. This is a declaration, not an audit, and it gates everything else: until you are registered you are not on the authority's lists and you do not receive its advisories^[3].
• Put risk management measures in place. The CCB publishes its own framework, CyberFundamentals (CyFun®), with Small, Basic, Important and Essential levels and a free self-assessment tool^[6]. This is a genuinely useful Belgian feature: instead of general recommendations, you get a measurable control set and a documented path to evidence.
• Report significant incidents in three stages: early warning within 24 hours, incident notification within 72 hours, final report no later than one month after the notification^[4]. The e-commerce trap: a customer data breach starts two clocks — the CCB one and the GDPR one, 72 hours to the data protection authority^[10]. Two recipients, two files, one incident.
• Management accountability. Fines are capped at EUR 10 million or 2% of total worldwide annual turnover for an essential entity, and EUR 7 million or 1.4% for an important entity, whichever is higher^[5]. A marketplace is normally an important entity, so the second cap applies.

The 18 December 2024 deadline: e-commerce was called first

Here is the Belgian detail almost nobody in the sector noticed. The CCB registration calendar was not the same for everyone: essential and important entities had until 18 March 2025, but a short list — cloud service providers, online marketplaces, search engines and social networking platforms — had to be registered by 18 December 2024^[2]. Three months earlier, in the middle of Black Friday and Christmas: the worst week of the year for an e-commerce team.

If you sit in row two or three and you are not registered, you are approaching two years late. Registration is still possible, and it is the first move — before any technical measure. The same reasoning applied to your technical suppliers is set out in our guide to NIS2 in Belgium for software vendors and IT providers; and if you also sell from the Grand Duchy, the criteria differ — see NIS2 and e-commerce in Luxembourg.

Out of scope, caught by the supply chain

This is where the "not in scope" webshop becomes concerned again — by contract, not by law. NIS2 requires in-scope entities to manage the security of their suppliers. The practical consequence for a Belgian e-commerce business selling to hospitals, manufacturers, municipalities or transport operators: the security questionnaire arrives, and answering it is a condition of staying on the approved supplier list. A plain "NIS2 does not apply to us" is enough to lose a tender.

The second angle is money, and no directive governs it. Febelfin recorded EUR 93 million stolen through phishing in 2025^[8]: impersonating an online shop, an order confirmation or a payment page is part of that mechanism. A domain protected with SPF, DKIM and DMARC, a back office behind two-factor authentication and a written procedure for supplier bank-detail changes all cost less than one diverted payment. If your market is Brussels and bilingual, our B2B appointment setting in Brussels page shows how these arguments convert into qualified meetings.

The first five actions

1. Settle the classification in writing, on one page. Exact activity, third-party sellers yes or no, headcount, turnover, balance sheet, country of main establishment, other listed activities. Dated and signed by management: this is the document you hand over when the CCB or a customer asks^[1].
2. If you are a marketplace or a cloud provider, register with the CCB this week. It is the simplest and most visible obligation, and its deadline passed on 18 December 2024^[2].
3. Run the CyFun self-assessment at Basic level and keep the gaps in a table with an owner and a date^[6]. Out of scope, it is the best pre-filled answer to your customers' questionnaires.
4. Write the incident procedure with both clocks — 24h and 72h to the CCB, 72h to the data protection authority where personal data is involved — and put a name in it that is reachable on a Sunday. Shops go down at the weekend, not on Tuesday morning.
5. Turn on two-factor authentication on the back office, CMS, payment gateway, DNS and supplier accounts, then disable leavers' supplier accounts on the day they leave.

At CyberNovaLabs.io

CyberNovaLabs.io works with SMEs in the Netherlands, Belgium, France and Luxembourg. On this subject we do three things: the one-page NIS2 classification note, the CyFun self-assessment with a gap plan, and a reusable answer set for customer security questionnaires. Our free tools and our cybersecurity page set out the method; engagements are quoted on request.

Review your NIS2 classification and your customer questionnaires

Sources

1. CCB — NIS2 : champ d'application
2. CCB — FAQ NIS2 (PDF, FR, v2.0.1)
3. CCB — NIS2 obligations
4. CCB — La notification des incidents NIS2
5. CCB — Administrative measures and fines under NIS2
6. Safeonweb@work — FAQ NIS2 et CyberFundamentals (CyFun)
7. Becom — Rapport annuel sur le commerce electronique en Belgique
8. Febelfin — Rapport annuel 2025 (PDF)
9. Directive (UE) 2022/2555 (NIS2)
10. RGPD — Reglement (UE) 2016/679, article 33

Read next