Matthias De Smet

NIS2 in Belgium: why doing nothing is the most expensive option

For many Belgian mid-sized companies, NIS2 still feels like something that can wait. The registration deadline has passed for most in-scope entities, incident reporting obligations have applied since 18 October 2024, and Belgium’s framework is now very much operational. Essential entities also face a first major evidence milestone on 18 April 2026. In other words, this is no longer a future compliance project. It is a current management issue.