← All resources

NIS2 Belgium: manufacturing, who is actually in scope?

Published October 14, 2026 · 7 min read · CyberNovaLabs.io

Most Belgian factories are outside the scope of NIS2, and those inside find out through a NACE code, not through their revenue. The six Annex II categories, the Belgian deadlines that have already lapsed, the fine ceilings, and the Flemish grant few manufacturers claim.

The short answer

For NIS2 Belgium manufacturing, everything turns on a closed list of six NACE codes, not on your revenue. If your main activity is the manufacture of computer, electronic and optical products, electrical equipment, machinery, motor vehicles, other transport equipment or medical devices, and you reach 50 full-time equivalents or 10 million euros in turnover or balance sheet total, you are an important entity under the Act of 26 April 2024^[2][3].

If you make metal products, plastics, textiles, paper or furniture, the Annex II manufacturing sector does not cover you. Say so plainly to your board, then move to the real question: your customers who are in scope will ask you for contractual guarantees, because the law obliges them to secure their supply chain.

The third point is the least comfortable. The Belgian deadlines are behind us. Registration on Safeonweb@work was due by 18 March 2025^[1][5], and the CyberFundamentals Basic level had to be verified by an accredited conformity assessment body no later than 18 April 2026^[2]. As of 14 October 2026, that is 179 days ago. Being late does not disappear: it gets documented, costed and caught up in a specific order.

The six NACE codes that decide

Belgium was the first member state to transpose NIS2 in full^[1]. Its Annex II does not talk about industry in general. It lists product categories, which the Centre for Cybersecurity Belgium (CCB) maps to the following NACE Rev. 2 divisions^[2][3].

Two nuances matter. First, food and chemicals are indeed covered by NIS2, but through their own Annex II sectors, with their own definitions: do not treat them as manufacturing^[3]. Second, a manufacturer of medical devices considered critical during a public health emergency, within the meaning of Article 22 of Regulation (EU) 2022/123, falls under Annex I health and leaves the Annex II manufacturing category^[2].

Are you in scope? Four questions

1. Does your main activity sit in one of the six categories above? Check the NACE code filed with the KBO/BCE register, not the one you use internally.
2. Do you reach the medium-enterprise threshold? At least 50 full-time equivalents, or more than 10 million euros in turnover or balance sheet total^[2]. Count at legal entity level, not per production site.
3. Important or essential? For Annex II the usual answer is important, even for a large group: the essential category applies first to the Annex I services^[2]. That changes the fine ceilings and the certification date you owe.
4. If the answer is no, who drags you in anyway? An energy customer, a hospital, a transport operator: their duty to secure suppliers becomes your security questionnaire to complete.

Belgium: who supervises you, against which framework

The CCB is the national authority. Registration and follow-up run through the Safeonweb@work portal^[5]. The Belgian specificity, the one that surprises manufacturers used to ISO 27001 alone, comes from the Royal Decree of 9 June 2024 and the CyberFundamentals (CyFun) framework: Belgium did not only write obligations, it imposed a measurable level and third-party verification by an accredited body^[2][8].

For a machining shop of 80 people the difference is concrete. The job is not to draft a security policy but to put evidence in front of an auditor, on the exact points where production pushes back: segmentation between the office network and the PLCs, maintenance accounts shared with the system integrator, tested restore of a supervision workstation that has been running for twelve years.

The 18 April 2026 deadline has passed: in what order to catch up

If you are discovering the subject today, do not start with the audit. Register first. An unregistered entity is invisible to the CCB; late registration can be put right, whereas a missing registration discovered during an incident is paid for twice. The CyFun gap analysis comes next, and only against the level actually required of you.

Reporting an incident: 24 hours, 72 hours, one month

The clocks start as soon as you become aware of the significant incident, and each step must be completed without undue delay^[4]:

• 24 hours: early warning.
• 72 hours: incident notification, with an initial assessment.
• One month after the notification: final report. If the incident is still ongoing you send a progress report, then the final report within one month of resolution^[4].

Notification goes through the online form at notif.safeonweb.be^[4]. In a factory, 24 hours burn fast: a line stopped on a Friday evening mobilises maintenance first, and nobody thinks about the regulatory clock. Put the procedure on the same sheet as the emergency stop instructions, and name the person who triggers it at night and at weekends.

Fines and director liability

For an important entity the maximum administrative fine reaches 7 million euros or 1.4% of total worldwide annual turnover for the preceding financial year, whichever is higher^[2]. For an essential entity the ceiling rises to 10 million euros or 2%^[2]. At 1.4%, a manufacturer turning over 60 million euros is exposed to 840,000 euros: a worked assumption, to be replaced by your own consolidated turnover.

The point management teams underestimate: the law requires the management body to approve the risk management measures and to undergo training^[2]. Delegating to the IT manager does not transfer that duty. In a family-owned industrial SME it means half a day blocked in the managing director's diary, not only in the technician's.

The Flemish grant few manufacturers claim

Flanders funds compliance through VLAIO's cybersecurity verbetertrajecten. In 2026 the grant covers 50% of the programme price for SMEs, and 35% for non-SME companies subject to NIS2^[6][7]. Programmes are priced between 7,100 and 11,900 euros excluding VAT for START, 16,600 to 28,600 euros for MEDIUM and 26,500 to 39,900 euros for PLUS^[6]. The grant covers guidance by a selected provider, not the purchase of hardware or licences^[6].

For Wallonia and Brussels we are not publishing rates: the 2026 schemes were not confirmed by an official source at the time of writing. Ask your regional agency before you sign a quotation. The difference between 0 and 50% changes the order in which you run the work.

The first five actions

1. Settle your scope on one page. KBO/BCE NACE code, headcount in full-time equivalents, turnover, balance sheet total, dated and signed conclusion. This is the document you will show both to the CCB and to a customer.
2. Register on Safeonweb@work if you are in scope, even late, and keep the acknowledgement.
3. Measure the CyFun gap against the required level, starting with the three points that almost always fail in production: separation of office and PLC networks, inventory of integrators' remote access, genuinely tested restore.
4. Post the notification procedure and its 24-hour deadline next to the emergency stop instructions.
5. Put management body training on the agenda of the next board meeting, and apply for the VLAIO grant before committing the spend if you are in Flanders.

At CyberNovaLabs.io

Start with the free NIS2 check: in a few minutes it tells you whether the six Annex II categories cover you, and at what level. The sector reference points are gathered on the NIS2 Belgium for manufacturing page, and the supplier security questionnaire is for when it is a customer, not the law, putting you under pressure.

Read next: NIS2 Luxembourg for manufacturing and production if you run a site across the border, and NIS2 Belgium for software vendors and IT providers to see what your own IT suppliers owe you.

Management body training is not bought like an audit. Our AI training for teams covers tool governance and usage policy, which is the decision half of the subject; CyFun verification remains the work of an accredited body. If you would rather have someone look at your scope before you commit any spend, write to us and we will review your specific case. Services quoted on request, with no minimum term.

→ Review your NIS2 position

Sources

1. CCB — Belgium sets the standard: first member state to fully implement NIS2
2. CCB — FAQ NIS2 en Belgique (v2.0.1, FR)
3. CCB — Annexes de la loi NIS2 du 26 avril 2024
4. CCB — Guide sur les notifications NIS2 (v1.3, FR)
5. CCB Safeonweb@work — The NIS2 Law
6. VLAIO — Cybersecurity verbetertrajecten
7. VLAIO — Krijg ook in 2026 VLAIO-steun om te investeren in cyberveiligheid
8. CCB — Adoption de l'arrêté royal NIS2

Read next