NIS2 Belgium: are software vendors and IT providers in scope?
Software publishing is not listed in the Belgian NIS2 law. Managed services, hosting and SaaS are. Here is how to settle your own case in ten minutes, with the Belgian dates, the CyberFundamentals framework, and what still reaches you if you are out of scope.
The short answer
In Belgium, the law of 26 April 2024 transposes the NIS2 directive and has applied since 18 October 2024[5]. To decide whether NIS2 Belgium covers you, ignore your NACE code and look at the service you sell. "Software publishing" appears in neither Annex I nor Annex II of the law. Three profiles that are very common in IT, however, fall in directly: managed service providers (MSPs) and managed security service providers (MSSPs), placed under "ICT service management (B2B)" in Annex I; cloud computing, data centre, CDN and DNS providers, also Annex I; and online marketplaces, search engines and social networks, in Annex II[1].
Put plainly: if you sell a licence the customer installs and runs themselves, you are probably outside NIS2. If you host, monitor, patch or administer on the customer's behalf, you are very probably inside. And being out of scope does not mean being free of obligations — the Cyber Resilience Act and your customers' security questionnaires catch up with you, as we show below.
Are you in scope? The boxes to tick
- Size threshold: at least 50 full-time employees, or more than EUR 10 million in annual turnover, or more than EUR 10 million on the balance sheet[1]. These are alternatives: one is enough.
- Managed service: do you install, manage, operate or maintain ICT products, networks, infrastructure or applications on behalf of customers? That is the legal definition of a managed service, and it places you under "ICT service management (B2B)"[1]. Selling IT hours is not enough; taking the controls of the customer's infrastructure is.
- SaaS: if you host and operate your own software, you are not selling a licence, you are providing a cloud computing service — Annex I, digital infrastructure.
- Establishment: the Belgian law targets entities established in Belgium that provide an Annex I or Annex II service in the Union[1].
- No size threshold: some categories are in scope regardless of size, notably DNS service providers, top-level domain name registries and trust service providers[1].
Essential or important status does not follow from size alone: it depends on the sector and the category. As a rule, large Annex I entities fall under the essential regime; other Annex I entities and Annex II entities are important, subject to the statutory exceptions[5].
What the NIS2 law requires in Belgium: the dates that matter
The national authority is the Centre for Cybersecurity Belgium (CCB): single point of contact, CSIRT and competent authority, alongside sectoral authorities depending on the activity[2]. Registration runs through its Safeonweb@work portal. One quirk hits our sector head-on: the two-month registration window in Article 13 brought digital players in before everyone else.
| Deadline | Who | What |
|---|---|---|
| 18/12/2024 | Cloud, data centres, DNS, CDN, managed and managed security services | Registration on Safeonweb@work, two-month window (Art. 13)[3] |
| 18/03/2025 | All other covered sectors | Registration on Safeonweb@work[3] |
| 18/04/2026 | Basic, Important and Essential levels | First CyberFundamentals verification, at Basic or Important level[5][6] |
| 18/04/2027 | Essential entities targeting the Essential level | CyFun Essential certification[5][6] |
| 11/09/2026 then 11/12/2027 | Every software vendor, even outside NIS2 | Cyber Resilience Act: reporting of actively exploited vulnerabilities, then general application[7] |
The CCB's reference framework is CyberFundamentals (CyFun). It covers risk management, incidents, continuity, the supply chain, and the security of development and maintenance — the last point is literally your job if you write code. A CyFun or ISO/IEC 27001 certification can create a presumption of conformity[6]. If you already hold ISO 27001 to win tenders, most of the work is behind you.
The administrative fines in Article 37 of the Belgian law: at least EUR 10,000,000 or 2% of total worldwide annual turnover for an essential entity, at least EUR 7,000,000 or 1.4% for an important entity, whichever is higher[3].
The out-of-scope software vendor
You publish software installed on the customer's premises, you are under 50 people and under EUR 10 million? You are probably not a NIS2 entity. Three obligations still reach you.
(1) Through your customers. A NIS2 entity must address supply-chain security, including risks from its direct suppliers[2]. In practice that lands on you as contract clauses and questionnaires. A Belgian hospital under NIS2 cannot keep a software supplier who cannot state how fast it ships a fix: we set this out in our guide to NIS2 for healthcare, hospitals and labs in Belgium.
(2) Through the Cyber Resilience Act. Regulation (EU) 2024/2847 makes you a manufacturer as soon as you place a product with digital elements on the market under your own name or brand — whether the software is sold, otherwise monetised, or supplied free of charge[7]. In force since 10 December 2024, reporting obligations from 11 September 2026, general application from 11 December 2027[7].
(3) Through the GDPR, if your software processes personal data on your customers' behalf: you are a processor, with the contract and notification duties that follow.
Reporting an incident: 24 hours, 72 hours, one month
If you are a NIS2 entity, notification to the CCB is staged: an early warning within 24 hours, an incident notification within 72 hours, then a final report no later than one month after that notification. The first two clocks start when you become aware of the incident; if the incident is ongoing, you send a progress report and the final report follows within a month of final handling[4].
For an MSP the hard part is not the form: it is knowing, at 3 a.m. on a Sunday, which customer is affected and who decides. The three-week lag seen in a recent breach at a public-sector supplier shows exactly where this breaks — we analysed it in this review of the 72-hour deadline. And when the flaw sits in a tool you host yourself, the clock is yours: see the Atlassian flaw in self-hosted Jira and Confluence.
The first five actions
- Settle your status in writing, service by service: on-premise licence, SaaS, managed service, hosting. One company can have one activity in scope and another out. Keep the note — it is what you will show a customer's questionnaire or a CCB query.
- Check your Safeonweb@work registration. If you fall under cloud, DNS or managed services, your deadline was 18 December 2024[3]: lateness can be fixed, not ignored.
- Pick your CyFun level (Basic, Important, Essential) and book the verification before 18 April 2026[6]. If you are aiming at Essential, certification is due by 18 April 2027.
- Write your disclosure and patch process: security contact point, target fix times by severity, customer notification channel. CyFun requires it under secure development, your NIS2 customers require it under supply chain, and the Cyber Resilience Act requires the reporting part.
- Rehearse the notification: who fills in the CCB form, who warns customers, who speaks publicly. A two-hour drill beats a twelve-page procedure.
At CyberNovaLabs.io
Start with the free NIS2 check: a handful of questions and you know whether you are in scope and on what basis. The reference points for your sector sit on our NIS2 Belgium for managed IT services page, and the supplier security questionnaire gives you the answers your customers expect. If it is the product itself that needs work — logging, patch management, tenant isolation — our custom software development service works on the existing code rather than rewriting it. Pricing on quotation, no minimum term.
Ask for a 20-minute review of your case: we start from your customer contracts and your architecture, not from a generic checklist.
Sources
- CCB — NIS2 : champ d'application (scope)
- CCB — NIS2 : obligations
- CCB — FAQ NIS2 en Belgique (v2.0.1, FR)
- CCB — La notification des incidents NIS2
- CCB — Brochure « The NIS2 directive in Belgium »
- Safeonweb@work — FAQ NIS2 et CyberFundamentals
- Règlement (UE) 2024/2847 — Cyber Resilience Act
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 12, 2026 · 7 min readNIS2 Netherlands: healthcare and labs under the Cbw
In the Netherlands, the question "are we in scope?" is settled faster than in most sectors: a care provider with 50 FTE is in, and there is no transition period. Here are the exact thresholds, the regulator, the sector CSIRT, and the five actions to take this week.
Read the article →October 11, 2026 · 7 min readNIS2 France: are transport and logistics firms in scope?
A road haulier is not in NIS2 scope because it moves freight. But two regimes already bind French operators today, and a third arrives through their customers. The texts, the dates and the figures, with no invented fines.
Read the article →October 9, 2026 · 7 min readCNIL closes France Travail injunction, no penalty (08/10/2026)
On 8 October 2026 the CNIL closed its injunction against France Travail without applying the 5,000 EUR daily penalty. For an SME, the useful part is not the 5 million fine but the four security measures the regulator treated as mandatory.
Read the article →October 9, 2026 · 7 min readHow many B2B meetings does it take to sign one client?
If one qualified meeting in four closes, you need four meetings per client. That number means nothing in your business. Here is the six-stage model, the reverse formula, and public cost benchmarks to size outbound without guessing.
Read the article →