Belgium: what happens if you miss 18 April 2027, written down by the CCB

What was published

On 18 August 2026 the inspection service of the Centre for Cybersecurity Belgium — acting as the national cybersecurity certification authority — published a general communication, together with a request for information, addressed to Belgian NIS2 essential entities. It concerns the mandatory conformity assessment that falls due on 18 April 2027. The page was updated on 24 August.

Until now the Belgian calendar read as a cliff. Essential entities had to show something by 18 April 2026 — a CyFun Basic or Important verification, or an ISO/IEC 27001 Statement of Applicability handed to the CCB — and then be certified at their target level by 18 April 2027, externally, by an accredited body. What happened to an entity that would not be there on the second date was not written anywhere. Now it is.

The compliance plan

By 18 April 2027, an essential entity that cannot demonstrate that it has implemented the NIS2 cybersecurity measures required by Belgian law — measures equivalent to the Essential assurance level of CyFun — must present a compliance plan instead.

The plan has two required parts, and the first is the one that carries the weight. It is not a statement of intent.

• Proof of conformity with the NIS2 cybersecurity measures equivalent to the CyFun Important assurance level. The CCB points at the column named "Relation avec la loi belge NIS2 IMPORTANT" in the CyFun mapping table for the identification of those measures.
• A description of the measures planned to reach an assurance level equivalent to CyFun Essential by 18 April 2028.

So the floor does not drop. An entity that files a plan is still asserting, with evidence, that it meets Important-equivalent measures today. What it gains is twelve months to close the gap between Important and Essential, on a described route rather than in silence.

It applies whichever route you took

Belgium accepts three ways of evidencing conformity, and the same approach applies to all three. This matters because the ISO/IEC 27001 route is the one most multinational groups are on, and it would have been easy to assume a CyFun-worded communication only bound CyFun users.

• CyFun certification or verification by an accredited conformity assessment body.
• ISO/IEC 27001 certification by an accredited conformity assessment body.
• Conformity assessment carried out directly by the CCB inspection service.

This is not a postponement

The CCB is explicit, and the sentence is worth quoting because the temptation to read this as relief is strong.

Read it for what it is: a supervisor telling you, in advance, what it will expect to receive from you if you are late, and what it will consider an acceptable answer. That is a good deal more useful than silence, and it is not the same thing as moving a deadline. The legal duty of care under article 30 of the Belgian law — the ten measures of article 21(2) of the directive plus an eleventh, a coordinated vulnerability disclosure policy — has been owed since 18 October 2024, and the CCB has been inspecting since April 2026.

Who does not need a plan

No compliance plan is required of an essential entity that can demonstrate, by 18 April 2027, either of two things. The first is the obvious one: that it already meets the NIS2 measures equivalent to CyFun Essential. The second is not obvious at all, and is the more interesting of the two: that it meets duly verified cybersecurity measures equivalent to a lower CyFun assurance level, on the basis of its own risk analysis.

That second limb is a reminder of how the Belgian scheme is built. The target assurance level is not handed to you because you are an essential entity; it comes out of a risk assessment, and a defensible assessment can land below Essential. What the CCB will not accept is a level that nobody verified and no analysis supports. If your target level is below Essential, the artefact you need on 18 April 2027 is the risk analysis that justifies it, together with the verification of the level you did reach.

The letter itself is not public

One limit worth stating plainly. The CCB published the summary above; the complete communication, carrying the detailed requirements applicable to each of the three assessment routes, was sent directly to every essential entity. If you are an essential entity in Belgium and nobody in your organisation can produce that letter, that is the first thing to chase — not because the deadline moves, but because the detail you will be assessed against is in a document that was already delivered to you.