Law / Belgium

Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure

Loi du 17 février 2022 (article 105 de la loi du 13 juin 2005 relative aux communications électroniques) mesures de sécurité supplémentaires pour la fourniture de services mobiles 5G

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2022/02/17/2022031089/justel

In force since 21 Mar 2022.

A sector security regimes rule binding public and private bodies.

Obligation class: Security, Governance

As of 12 October 2026.

What it requires

If you are a mobile network operator offering a 5G network, obtain an authorization granted jointly by the ministers concerned before you use an element of your 5G network (Article 105, paragraph 1).NIST CSF 2.0GV.OC-03
If a royal decree extends the authorization duty to your category (a mobile virtual network operator, the public company ASTRID, or a private-network operator designated as critical-infrastructure or essential-service operator), obtain the same authorization before you use an element of your 5G network (Article 105, paragraph 2).NIST CSF 2.0GV.OC-03
If you hold the list of sensitive zones, pass it only to people who need to know it and have access to it for their functions or mission in deploying and operating the 5G network (Article 105, paragraph 7).NIST CSF 2.0PR.AA-05

These lines are LexLint's reading of the law's text, as of 12 October 2026. Also read by: Belgian Institute for Postal Services and Telecommunications (BIPT/IBPT) (guidance, recorded 12 October 2026).

In the frameworks

NIST Privacy Framework

PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.

NIST CSF 2.0

GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

CIS Controls

3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
3.10Encryption of sensitive data as it crosses networks.
3.11Encryption of sensitive data where it is stored on servers and applications.
6.8Access rights defined by job role, and kept up to date.
7.1A documented, reviewed approach to finding and handling weaknesses.
8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

1.1Policy on the security of network and information systems
1.2Roles, responsibilities and authorities
2.1Risk management framework
2.2Compliance monitoring
3.1Incident handling policy
3.2Monitoring and logging

7 more

4.1Business continuity and disaster recovery plan
6.2Secure development life cycle
6.5Security testing
6.10Vulnerability handling and disclosure
9.1Cryptography
11.2Management of access rights
12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Disclosing information about the list of sensitive zones to a person who is not entitled to hold it is punishable by a criminal fine of EUR 1,000 to 100,000 (Article 105, paragraph 7, second subparagraph); breaching the ban on passing on confidential information from an authorization file is punishable under Article 458 of the Criminal Code.

Who enforces it

Enforcement body

The ministers concerned take each authorization decision jointly, and the Belgian Institute for Postal Services and Telecommunications (BIPT) takes the steps needed to prepare it (Article 105, paragraph 6).

Settledness

As of: 12 October 2026
Guidance link: https://www.ibpt.be/operateurs/telecoms/securite/securite-des-reseaux
Guidance body: Belgian Institute for Postal Services and Telecommunications (BIPT/IBPT)
Open questions: From what date does the duty in Article 105, paragraph 8, first subparagraph, of the Electronic Communications Act to keep a 5G network's infrastructure on the territory of the Member States of the European Union bind a mobile network operator, when the Belgian Institute dates only the staff, equipment, software and data location rules to 1 January 2028?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Law of 17 February 2022, published in the Moniteur belge on 11 March 2022, replaces Article 105 of the Law of 13 June 2005 on electronic communications with a security-authorization regime for 5G networks. Under Article 105, paragraph 1, a mobile network operator must obtain an authorization granted jointly by the ministers concerned (the Prime Minister and the ministers for telecommunications, defense, justice, the interior and foreign affairs) before it uses an element of its 5G network.

The King may extend the authorization duty to categories of mobile virtual network operators, to the public company ASTRID, and to private-network operators designated as critical-infrastructure or essential-service operators (Article 105, paragraph 2). An element or service already in use when the royal decree under paragraph 4 takes effect needs a regularization authorization, applied for within two months of that date.

The applicant files with the Institute (BIPT), the ministers concerned take a single joint decision, and a failure to decide within the period the King sets counts as a refusal (Article 105, paragraphs 3 and 6). A person who receives the list of sensitive zones may pass it only to people who need to know it for deploying and operating the 5G network (Article 105, paragraph 7).

A person who discloses information about that list to anyone else faces a criminal fine of EUR 1,000 to 100,000 (Article 105, paragraph 7). A mobile network operator offering services in Belgium over a 5G network must keep that network's infrastructure on the territory of the Member States of the European Union (Article 105, paragraph 8). The royal decree that brings the first three subparagraphs of paragraph 8 into force is to be dated no earlier than 1 January 2026 (Article 8). The Law took effect on 21 March 2022.

When LexLint raises it

When your app profile says your app provides telecom services or runs an essential service.

Back to the example · Lint your app