BelgiumLoi du 26 avril 2024, Significant-Incident Notification Obligations
Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la… sécurité publique, Artt. 34-37
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2024/04/26/2024202344/justelIn force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds the same essential and important entities as this jurisdiction's companion risk-management row, on the same Annex I and Annex II scope.
- Notify the national computer security incident response team (CSIRT) of any significant incident without undue delay, following the arrangements set out in the protocol between the CSIRT and the National Crisis Centre.NIST CSF 2.0RS.CO-02
- Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact.NIST CSF 2.0RS.CO-02
- Follow with an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise.NIST CSF 2.0RS.CO-02
- Submit an interim report if the national CSIRT or the competent sectoral authority asks for one, and a final report no later than one month after the incident notification, describing the incident in detail, its severity and impact, the likely threat or root cause, the mitigation measures applied and in progress, and any cross-border impact.NIST CSF 2.0RS.CO-03NIST CSF 2.0RC.RP-06
- If the incident is still ongoing when the final report falls due, submit a progress report at that point, followed by a final report within one month of the final handling of the incident (Article 35, paragraph 1, point 5).NIST CSF 2.0RS.CO-03
- If you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant incident that affects your trust services (Article 35, paragraph 2).NIST CSF 2.0RS.CO-02
- Where public awareness is necessary to prevent or manage the significant incident, or where disclosure is otherwise in the public interest, the national CSIRT may itself inform the public of the incident or require you to do so.
These lines are LexLint's reading of the law's text. Also read by: Centre for Cybersecurity Belgium (CCB), Safeonweb at Work (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Title 4, Chapter 2 of the NIS2 law is the Act's own sanction for an Article 34-38 violation: an administrative fine under Article 59, doubled on recidivism for the same facts within three years. The Act creates no criminal offence for a reporting failure.
Penalty structure
Article 59, 5 sets the ceiling for an essential entity that does not comply with the Article 30 risk-management or Article 34-38 notification obligations at EUR 10,000,000 or 2 percent of the undertaking's total worldwide annual turnover for the preceding financial year, whichever is higher; Article 59, 4 sets the ceiling for an important entity at EUR 7,000,000 or 1.4 percent of that turnover, whichever is higher; both fines start at a floor of EUR 500 and are doubled on recidivism for the same facts within three years (Article 59, final paragraph).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The national cybersecurity authority, the Centre for Cybersecurity Belgium (CCB), which also serves as the national CSIRT receiving the notifications, or the competent sectoral authority for the entity's sector.
Settledness
- As of
- Guidance link
- https://atwork.safeonweb.be/nis2
- Guidance body
- Centre for Cybersecurity Belgium (CCB), Safeonweb at Work
What this law does
Article 34 requires an essential entity or an important entity to notify any significant incident to the national computer security incident response team (CSIRT) without undue delay, following the arrangements set out in a protocol between the CSIRT and the National Crisis Centre (NCCN).
Article 35 sets the clock: an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact; an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise; an interim report if the national CSIRT or the competent sectoral authority asks for one; and a final report no later than one month after the incident notification, describing the incident, its severity and impact, the likely threat or root cause, the mitigation measures applied, and any cross-border impact.
A trust service provider, by derogation from the 72-hour notification, notifies a significant incident affecting its trust services within 24 hours of becoming aware of it. Article 36 requires the national CSIRT to respond to an early warning within 24 hours where possible, with initial feedback and, on request, operational guidance.
Article 37 lets the national CSIRT, after consulting the entity, the NCCN, any sectoral authority concerned and the responsible minister, inform the public of a significant incident or require the entity to do so, where public awareness is necessary to prevent or manage the incident or where disclosure is otherwise in the public interest. Article 54, paragraph 2 bars a further administrative fine for conduct already fined by the data protection authorities under General Data Protection Regulation (GDPR) Article 58(2)(i).
Article 6(3) disapplies Titles 3 to 5, which hold these notification duties, to an entity of the banking or financial-market-infrastructure sector in Annex I that falls within the scope of Regulation (EU) 2022/2554 (DORA).
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .