← All resources

NIS2 Belgium: are hotels and tourism firms in scope?

Published November 2, 2026 · 8 min read · CyberNovaLabs.io

Accommodation and restaurants are not in the annexes of the Belgian law of 26 April 2024. Three duties still catch you, and one of them already decides corporate contracts.

The short answer

No. In Belgium, a hotel, a campsite, a restaurant, a travel agency or a tour operator is not, as a rule, an entity under the law of 26 April 2024. That law entered into force on 18 October 2024^[1]. It applies to public or private entities of a type listed in Annex I or II, and only if they are at least a medium-sized enterprise within the meaning of Recommendation 2003/361/EC^[1][2]. The text of the law does not mention hotels, accommodation, restaurants or tourism. Annex II, point 4, covers only food businesses engaged in wholesale distribution and in industrial production and processing^[1]. A hotel kitchen is not that.

For that activity alone you do not register with the national cybersecurity authority, you do not file a 24-hour incident alert, and you do not accrue a NIS2 fine. Three things still apply, and the second one already decides contracts: guest data, supervised by the Data Protection Authority under Regulation (EU) 2016/679^[3][4]; security questionnaires sent by clients who are themselves NIS2 entities; and the rarer case where a side activity, or an identification by the authority, brings you inside the law.

NIS2 Belgium: are you in scope?

One missing criterion takes you out. Take them in the order of the law, not in the order of a sales questionnaire.

1. Is your activity listed in Annex I or II? For a hotel, a guesthouse, a campsite, a restaurant, a banquet caterer or a tour operator: no. Point 4 of Annex II does not change that answer, unless a group entity produces or processes food on an industrial scale, or distributes it wholesale^[1]. A brigade serving the hotel's own guests is not a food factory.
2. Do you meet the size test? Even a listed activity is in scope only if the entity is a medium-sized enterprise, or exceeds the ceilings in Article 2 of the annex to Recommendation 2003/361/EC^[1][2]. The Belgian law does not paste those ceilings into Article 3: it refers to them. Below the line, you are not a NIS2 entity, unless Article 11 applies.
3. Has the authority identified you by name? Article 11 allows the national cybersecurity authority to identify an entity as essential or important regardless of size, in particular if it is the sole provider in Belgium of an essential service, or if a disruption would have a significant impact on public security, public safety or public health^[1]. A city hotel is not, by its rooms, that sole provider. Do not tell a client "yes" on a rumour: ask for the identification decision.
4. Is a side activity listed? An online marketplace selling third-party stays, a data centre, a communications network, a separate industrial plant. The listed activity enters, not the hotel brand by contamination.

What the Belgian law requires, if you really are in it

These duties apply only to an essential or important entity. Quoting them at a hotel outside the annexes is a quoting error, not caution.

Registration is with the national cybersecurity authority, within five months of entry into force or of an Article 11 identification^[1]. The law entered into force on 18 October 2024, so that five-month period fell on 18 March 2025 for entities already in scope on that date. Article 13 asks for the name, the Crossroads Bank for Enterprises number, the address, the email address, the IP ranges and the telephone number, plus the annex sector and, where relevant, the Member States where the service is provided^[1]. A hotel that discovers a listed side activity does not register "as a hotel": it registers for that service.

Article 30 requires appropriate and proportionate technical, operational and organisational measures on the networks and systems used to provide the service in question^[1]. Article 31 puts the management body on the hook: it approves those measures, oversees their implementation, and its members must have enough training to assess the risks^[1]. Article 35 sets the clock for a significant incident: an early warning within twenty-four hours, a notification within seventy-two hours, and a final report no later than one month after that notification^[1].

Article 59 sets the administrative fines, and only for entities in scope. An important entity that fails the risk-management measures or the notification duty faces a fine of 500 to 7,000,000 euros, or 1.4 percent of worldwide annual turnover in the preceding financial year, whichever is higher. For an essential entity, the cap is 500 to 10,000,000 euros, or 2 percent of that same turnover. The fine is doubled for a repeat of the same facts within three years^[1]. Outside the scope, those amounts are not your NIS2 risk. They are the risk of your hospital, bank or transport client, which is why that client sends you a questionnaire.

What still applies to you

Regulation (EU) 2016/679 applies to the guest file, the copy of an identity document, the stay details and the payment, whether or not you are a NIS2 entity^[3]. In Belgium the supervisory authority is the Data Protection Authority^[4]. A personal-data breach is notified to that authority. A NIS2 notification, if one day it applied to you, would not replace it: these are two regimes.

The second channel is contractual. A hospital, a bank, a railway company or a public body blocking rooms may itself be an Annex I entity. Its Article 30 tells it to look at its suppliers. The questionnaire you receive is not a law that applies to the hotel. It is a condition of the contract. Answering "not covered by the law of 26 April 2024" with no attachment loses the room block. Answering "we are NIS2" when the annex does not list you is false, and a false statement comes back.

Door	Does it catch you?	Paper to keep
Annex I or II, accommodation or restaurant activity	No, the text does not list them[1]	One-page note: activity, no annex side line, date, CBE number
Annex II, point 4, food	Only wholesale or industrial, not the hotel kitchen[1]	If an industrial central kitchen exists: take it out of the hotel perimeter and qualify it on its own
Article 11, identification regardless of size	Rare: sole provider, or impact on public security, safety or health[1]	Never assert an identification without the decision
Questionnaire from a client that is itself a NIS2 entity	Yes, by contract, not by a hotel statute	Answer pack: access, backups, incident, PMS subcontractors
Guest data	Yes, Regulation (EU) 2016/679, Belgian authority[3][4]	System list, written retention, path to notify the DPA

The first 5 actions

1. Write the note above and have management sign it. Without a date and a CBE number, it is not a record.
2. List the systems that hold guest data: property system, channel manager, locks, payment terminal, reservations mailbox. For each: who outside the hotel can read it, and how that access is cut.
3. Separate two incident paths. Personal-data breach: the Data Protection Authority^[4]. Incident on an annex service, only if you are in scope: the national cybersecurity authority, on the Article 35 clock^[1]. Do not mix the two forms.
4. Prepare a four-page answer pack for the corporate client: scope, remote access, backup copies, how fast you warn them, and the subcontractors who see the guest file. The question frame is here: supplier security questionnaire.
5. Lock the reservations mailbox. A fake payment change or a fake stay amendment comes from an address that looks like yours. The free check: email security check. The scope test, if a partner says you are in: NIS2 check.

At CyberNovaLabs.io

The same question, asked in Luxembourg and in France, does not get the same authority or the same date. The Luxembourg hotels guide and the France hotels guide do not replace the Belgian law of 26 April 2024. On the Belgian side, the useful neighbour is the real-estate and letting guide, another activity absent from the annexes, and the NIS2 in Belgium page. For Brussels: B2B appointments in Brussels.

CyberNovaLabs.io writes the scope note and the questionnaire answer pack, on a quote, without having you claim a status the law does not give you. If a side activity does bring you in, the management training required by Article 31 is a separate piece of work: team training. To have the note written: ask for the scope note.

Sources

1. Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique — Justel, entrée en vigueur le 18 octobre 2024
2. Recommandation 2003/361/CE de la Commission du 6 mai 2003 concernant la définition des micro, petites et moyennes entreprises
3. Règlement (UE) 2016/679 du 27 avril 2016 (RGPD)
4. Autorité de protection des données / Gegevensbeschermingsautoriteit

Read next