Law / Belgium

Belgium

48 of 49 named instruments researched to a stage, across nine of the ten areas of law we track: 47 in force and 1 proposed. As of .

When each starts47 of 48 carry a date, 1 does not.
2014: 1 instrument (1 in force) ’14 2015: 1 instrument (1 in force) 2016: 0 instruments 2017: 1 instrument (1 in force) 2018: 9 instruments (9 in force) 2019: 0 instruments 2020: 0 instruments ’20 2021: 6 instruments (6 in force) 2022: 7 instruments (7 in force) 2023: 0 instruments 2024: 5 instruments (5 in force) 2025: 16 instruments (16 in force) 2026: 1 instrument (1 in force) ’26 today

in forcenot yet in forceblocked by a courtproposedno longer in force

  1. AI law
  2. Privacy law 10
  3. Scraping law 3
  4. Cybersecurity law 4
  5. Communications law 4
  6. Content moderation law 4
  7. Product and AI liability law 2
  8. Digital accessibility law 17
  9. Age gating law 3
  10. Reuse law 1

Privacy law10 instruments, 10 in force

Research summary (102 words)

Belgium's private-sector personal-data regime is the General Data Protection Regulation (GDPR) as given domestic effect by the Act of , with the supervisory structure sitting in a separate Act of . The Act of adds three Belgium-specific provisions: a criminal-offense chapter at Title 6, Chapter II, an Article 9 access-designation and confidentiality duty for genetic, biometric, and health data, and a switch turning off GDPR Article 83 fines for most public authorities.

On biometrics the GBA/APD has a dedicated recommendation and one Litigation Chamber decision on the merits, which fined an employer 45,000 EUR for fingerprint-based workplace time registration.

Breach notification

GDPR Articles 33-34, Breach Notification

Regulation (EU) 2016/679, Arts. 33-34GDPR Arts. 33-34

In force since . Binds public and private bodies.

What this law does

A controller must notify the GBA/APD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk.

A related but distinct power, Act of Article 100, 7, lets the Litigation Chamber order that a data subject be informed of a security problem, a corrective power over an Article 34 failure rather than a separate notification duty.

What it requires

Comprehensive regime

Act of 30 July 2018 on the Protection of Natural Persons with regard to Personal Data

Loi du 30 juillet 2018 relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel (numac 2018040581)Moniteur belge, , and the consolidated Justel text

In force since . Binds public and private bodies.

What this law does

Belgium gives the General Data Protection Regulation (GDPR) domestic effect through the Act of , published in the Moniteur belge on . Article 6 states Title 1 executes the Regulation; the Act sets the digital-consent age at 13 (Art. 7), designates public-interest processing categories under GDPR Article 9(2)(g) (Art. 8), and adds criminal-conviction-data grounds (Art. 10). The supervisory structure sits in a separate statute, the Act of . The Act has been amended seven times on the Justel record, most recently in 2024.

What it requires

Cross border transfer

GDPR Chapter V and Act Article 222, 4, Cross-Border Transfer Restrictions

Regulation (EU) 2016/679, Arts. 44-49; Loi du 30 juillet 2018, Art. 222, 4Moniteur belge, , Art. 222, 4 (verbatim)

In force since , effective . Binds public and private bodies.

What this law does

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Belgium adds a criminal offense for the same conduct: Article 222, 4, fines a controller, processor, employee, agent, or competent authority 250 to 15,000 EUR for a Chapter V breach carried out by gross negligence or malicious intent. The Act of Article 100, 14 lets the Litigation Chamber order the suspension of cross-border data flows.

What it requires

Data subject rights

GDPR Article 22, Automated Decision-Making in Belgium

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22Official Journal text, EUR-Lex, Regulation (EU) 2016/679

In force since . Binds public and private bodies.

What this law does

General Data Protection Regulation (GDPR) Article 22 gives a person in Belgium the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The Loi du 30 juillet 2018 adds no rule of its own on automated decisions by a private controller.

What it requires

GDPR Articles 12-21 and Act of 30 July 2018 Title 5, Data Subject Rights and Action en Cessation in Belgium

Regulation (EU) 2016/679, Arts. 12-21; Loi du 30 juillet 2018, Arts. 209-211, 220Official Journal text, EUR-Lex, Regulation (EU) 2016/679

In force since , effective . Binds public and private bodies.

What this law does

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Belgium can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

The Loi du 30 juillet 2018 adds a court route: on an action en cessation brought by the data subject or the supervisory authority, the president of the court of first instance, sitting as in summary proceedings, can find that processing breaches data-protection law and order it to stop, and can order rectification or erasure or ban the use of inaccurate, incomplete or unlawfully kept data (Arts. 209 to 211). Article 220 lets a person mandate a non-profit body to lodge a complaint and bring those actions on their behalf.

What it requires

Enforcement supervision

Act of 3 December 2017, GBA/APD and Litigation Chamber

Loi du 3 decembre 2017 portant creation de l'Autorite de protection des donnees (numac 2017031916)Act of , Arts. 32, 33, 100 (verbatim)

In force since . Binds public and private bodies.

What this law does

The Act of , enacted and in force , creates the Gegevensbeschermingsautoriteit / Autorite de Protection des Donnees (GBA/APD) and its Chambre Contentieuse / Geschillenkamer (Litigation Chamber, Art. 32). Article 100 lists sixteen measures the Chamber may take, from dismissing a complaint to imposing administrative fines, suspending cross-border data flows, and transferring a file to the public prosecutor. Appeal lies to the Marktenhof.

What it requires

Act of 30 July 2018 Title 6 Chapter II, Criminal Sanctions

Loi du 30 juillet 2018, Arts. 222-230Moniteur belge, , Title 6, Chapter II, Arts. 222-230 (verbatim)

In force since . Binds public and private bodies.

What this law does

Title 6, Chapter II is Belgium's criminal chapter for data-protection violations, distinct from the Act of 's supervisory structure: Article 222 fines a controller, processor, employee, agent, or competent authority 250 to 15,000 EUR on fourteen enumerated grounds including processing without a legal basis and obstructing the supervisory authority; Article 224 fines a member or staffer of the supervisory authority 200 to 10,000 EUR for breaching confidentiality; Article 227 fines 100 to 20,000 EUR on five grounds including using assault, violence, or threats to compel a person's processing authorization; and Article 229 governs the overlap between administrative and criminal routes.

What it requires

Code de Droit Économique Article XVII.37, 10 degrees/1, Collective Redress for GDPR Claims

Code de droit economique Art. XVII.37, 10 degrees/1, as inserted by the Loi du 30 juillet 2018 portant dispositions diverses en matiere d'Economie (numac 2018031589), Art. 43Act of on various economic provisions, Arts. 43, 104 (verbatim)

In force since . Binds private bodies.

What this law does

General Data Protection Regulation (GDPR) Article 82 arms an individual data subject to claim damages directly.

Belgium separately added the GDPR to the Code of Economic Law's collective redress action, Book XVII, Title 2: Article 43(a) of the Act of on various economic provisions inserted point 10 degrees/1 naming Regulation (EU) 2016/679 into Article XVII.37's list of instruments whose breach can found a collective redress action, and Article 104 of the same act gives that insertion retroactive effect from .

What it requires

Sensitive categories

Act of 30 July 2018 Article 10/1, Recorded Commercial Communications

Loi du 30 juillet 2018, Art. 10/1, as inserted by the Act of , article 255Moniteur belge consolidated text of the Act of (Justel), Art. 10/1 as inserted by the Act of

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2018/07/30/2018040581/justel

In force since . Binds public and private bodies.

What this law does

Article 10/1 permits recording an electronic communication and its traffic data in lawful commercial transactions as proof, on condition the parties are informed of the recording, its precise purposes, and the storage period before the recording, with data erased at the latest when the transaction can no longer be challenged in court.

Paragraph 2 separately permits listening to and recording calls solely to monitor service quality in call centres, on prior information to staff, with a maximum retention of one month. This is the Belgian provision most likely to bind a voice-recording product, distinct from the biometric rules above.

What it requires

Act of 30 July 2018 Articles 8-10, Special-Category Processing Grounds

Loi du 30 juillet 2018, Arts. 8-10Moniteur belge, , Arts. 8-10 (verbatim)

In force since . Binds public and private bodies.

What this law does

General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category. Article 9 of the Act requires every controller processing genetic, biometric, or health data to designate the categories of staff with access, keep that list available to the supervisory authority, and bind those staff to confidentiality.

Article 8, paragraph 1's final subparagraph outright prohibits genetic and biometric processing for unique identification by the specific associations and foundations it authorizes under Article 9(2)(g), absent particular legal provisions. Article 10, paragraph 1, point 6 makes processing of criminal-conviction data manifestly made public by the data subject a lawful-basis ground, not a scope exclusion.

What it requires

Scraping law3 instruments, 3 in force

Research summary (309 words)

Belgium recodified its unauthorized-access computer offense into the new Penal Code's Book II, in force since , replacing Articles 550bis and 550ter of the 1867 Penal Code with Articles 524 to 533; the offence turns on the actor knowingly lacking authorisation, and its text does not add a separate requirement that a technical security measure be defeated.

The Code of Economic Law's text-and-data-mining exception, inserted into Article XI.190, 20° by the Act of transposing Directive (EU) 2019/790, permits reproducing a lawfully accessible work for text and data mining unless the rightsholder has reserved that use, and for content available online only a machine-readable reservation counts as an appropriate one.

The new Civil Code's general contract-formation rules require that a party's standard terms be either actually known to the other party or that party have at least a reasonable possibility of becoming aware of them, together with that party's acceptance, and acceptance may be shown by conduct rather than a written statement, though the Code does not let silence alone stand in for it.

The Code of Economic Law's database-producer right (Book XI, Title 7) requires the producer's authorization to extract or reuse a database's content, with a text-and-data-mining exception that the producer can displace by an express reservation, made by machine-readable means for content available online.

No reported decision or settled commentary states whether the knowledge element in Article 524 categorically places an open page with no login or technical barrier outside the offence, as distinct from supporting that conclusion on the facts of a particular case.

Belgian law has no recognised claim equivalent to trespass to chattels for the strain heavy crawling places on a site's servers; the new Civil Code's general fault-based liability rules require a fault and resulting damage rather than treating server load on its own as an actionable wrong.

Computer misuse

Code pénal, Livre II, articles 524 à 533, accès non autorisé et sabotage dans un système informatique

Code pénal Livre II, arts. 524-533 (accès non autorisé et sabotage dans un système informatique), inséré par la loi du 29 février 2024 introduisant le livre II du Code pénal; peines fixées au Livre Ier, art. 36 et 38Belgian Official Gazette, consolidated text of the Law of introducing Book II of the Penal Code

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2024/02/29/2024002088/justel

In force since . Binds public and private bodies.

What this law does

Belgium's new Penal Code Book II criminalises accessing or remaining in a computer system without authorisation (Article 524, external access) and, separately, exceeding one's own access rights with fraudulent intent or intent to harm (Article 525, internal access), each punished at sentencing level 2. The offence is aggravated to level 3 under Article 526 where the offender also retrieves the system's data, uses a third party's system, or causes any damage.

Attempt is punished the same as the completed offence (Article 527), and possessing or supplying a device designed to enable the offence (Article 528) or inciting its commission (Article 529) are separate offences; knowingly holding or disclosing data obtained through the offence is a further offence under Article 530.

Computer sabotage consists of knowingly, without authorization, introducing, modifying or erasing data in a computer system, or changing the normal use of data in it by any technological means (Article 531). It is punished at sentencing level 2, and an attempt is punished the same as the completed offense. It is aggravated to level 3 under Article 532 where the offender acts with fraudulent intent or intent to harm, or commits it against the computer system of a critical infrastructure.

Level 3 also applies under Article 532 where the offender damages data in the system concerned or in another system, or prevents the system concerned or another system from working correctly, in whole or in part. Possessing or making available a device designed or adapted to commit computer sabotage is a further offense punished at level 2 (Article 533).

The access provisions replace Article 550bis of the 1867 Penal Code, which had criminalized the same conduct in materially the same terms since . The sabotage provisions correspond to Article 550ter of that Code, which punished introducing, modifying or erasing data in a computer system without authorization from the same day.

Article 524 turns on the actor knowingly lacking authorisation to access the system; its text does not add a separate requirement that a technical security measure be defeated.

What it requires

Copyright and text and data mining (TDM)

Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données

Code de droit économique art. XI.190, 20°, inséré par la loi du 19 juin 2022 transposant partiellement la directive (UE) 2019/790 (Moniteur belge, 1 août 2022)Belgian Official Gazette, text of the Act of amending the Code of Economic Law

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2022/06/19/2022015053/justel

In force since . Binds public and private bodies.

What this law does

The Act of , transposing Directive (EU) 2019/790, added a text-and-data-mining exception to Article XI.190 of the Code of Economic Law. Point 20° permits reproducing a work that has been made accessible in a lawful manner for the purposes of text and data mining, provided the rightsholder has not expressly reserved that use in an appropriate manner. For content made available online, a reservation counts as appropriate only if it is carried out by machine-readable means.

A reproduction made under the exception may be kept for as long as the text-and-data-mining purpose requires. The same 2022 Act also amended the neighbouring point 19° of Article XI.190.

What it requires

Database right

Code de droit économique, livre XI, titre 7, droit des producteurs de bases de données (articles XI.305 à XI.310/1)

Code de droit économique livre XI, titre 7, droit des producteurs de bases de données (arts. XI.305 à XI.310/1), inséré par la loi du 19 avril 2014 et modifié par la loi du 19 juin 2022Belgian Official Gazette, text of the Act of amending the Code of Economic Law

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2022/06/19/2022015053/justel

In force since . Binds public and private bodies.

What this law does

Title 7 of Book XI of the Code of Economic Law protects the producers of databases and transposes Directive 96/9/EC. The producer's authorization is required to extract or reuse a database's content, and Article XI.310 lists the cases where it is not required.

Under Article XI.310, paragraph 3, 2°, the producer's authorization is not required to extract the content of a lawfully accessible database for text and data mining, unless the producers have expressly reserved that use in an appropriate manner. For content made available to the public online, a reservation counts as appropriate only if it is made by machine-readable means.

Research organisations, publicly accessible libraries and museums, archives and film or sound heritage institutions may extract the content of databases to which they have lawful access for text and data mining for scientific research without that authorization (Article XI.310, paragraph 3, 1°).

What it requires

Cybersecurity law4 instruments, 4 in force

Research summary (609 words)

Belgium completed its NIS2 transposition on time to take effect.

The Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique (the NIS2 law), published in the Moniteur belge on (Numéro 2024202344), entered into force on under its own Article 98, and its own Article 97 repeals the predecessor Loi du 7 avril 2019, the original NIS Directive transposition, so no earlier Belgian cybersecurity-framework act remains in force alongside it.

A Royal Decree of designates the Centre for Cybersecurity Belgium (CCB), created by the Royal Decree of , as the national cybersecurity authority under Article 15 of the NIS2 law, and Article 16 gives it the combined roles of competent authority, national computer security incident response team (CSIRT) and single point of contact.

The NIS2 law binds an essential entity and an important entity drawn from its Annex I and Annex II sector lists, which restate the NIS2 Annex I and Annex II sectors, to appropriate and proportionate risk-management measures over their network and information systems (Article 30, an eleven-point list covering risk analysis policy, incident handling, business continuity, supply-chain security, secure acquisition and development including vulnerability handling and disclosure, effectiveness-assessment policy, cyber hygiene and training, cryptography policy, personnel and access-management security, multi-factor or continuous authentication, and its own separate coordinated vulnerability-disclosure policy point, with the management body responsible for approving the measures and answering for a violation under Article 31) and to a graduated significant-incident notification clock to the national CSIRT: a 24-hour early warning, a 72-hour notification, an interim report on request, and a final report within one month (Articles 34 and 35).

Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex I's digital-infrastructure entry separately names a DNS service provider, a top-level-domain name registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a managed service provider and a managed security service provider; the Belgian Institute for Postal Services and Telecommunications (BIPT, called "l'Institut" in the text) holds a parallel supervisory and instruction power over a digital-infrastructure provider specifically, inserted into the Loi du 13 juin 2005 relative aux communications électroniques by the NIS2 law's own Articles 84 to 94, while CCB remains the general competent authority for the rest.

Belgium has no general reasonable-security or information-security-programme statute with no sector gate; the closest general duty is General Data Protection Regulation (GDPR) Article 32's security-of-processing obligation and the Loi du 30 juillet 2018's implementation of GDPR Articles 33 and 34's breach-notification duties to the Autorité de protection des données, both of which sit in the privacy topic rather than here.

Separately, the NIS2 law also inserted a conditional safe harbour into the Code penal's unauthorised-access offences (articles 550bis and 550ter) and into article 145 of the 2005 electronic-communications law, for a good-faith vulnerability finder who notifies the system's operator and the national CSIRT within 24 hours and follows with a complete notification within 72 hours; because that duty runs to the person who discovered the vulnerability by accessing another's system rather than to the entity operating it, it reads as a defence to an unauthorised-access offence, whose home is the scraping topic's computer-misuse family, so it is not filed as an instrument here.

The NIS2 law's own penalty provision is administrative rather than criminal: Title 4, Chapter 2 empowers the national cybersecurity authority or the competent sectoral authority to impose an administrative fine, doubled on recidivism within three years, and Article 54, paragraph 2 bars a further administrative fine for conduct already fined by the data protection authorities under GDPR Article 58(2)(i).

Sector security regimes

Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure

Loi du 17 février 2022 (article 105 de la loi du 13 juin 2005 relative aux communications électroniques) mesures de sécurité supplémentaires pour la fourniture de services mobiles 5GLoi du 17 février 2022, Justel consolidated text on ejustice.just.fgov.be, Moniteur belge of

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2022/02/17/2022031089/justel

In force since . Binds public and private bodies.

What this law does

The Law of , published in the Moniteur belge on , replaces Article 105 of the Law of on electronic communications with a security-authorization regime for 5G networks. Under Article 105, paragraph 1, a mobile network operator must obtain an authorization granted jointly by the ministers concerned (the Prime Minister and the ministers for telecommunications, defense, justice, the interior and foreign affairs) before it uses an element of its 5G network.

The King may extend the authorization duty to categories of mobile virtual network operators, to the public company ASTRID, and to private-network operators designated as critical-infrastructure or essential-service operators (Article 105, paragraph 2). An element or service already in use when the royal decree under paragraph 4 takes effect needs a regularization authorization, applied for within two months of that date.

The applicant files with the Institute (BIPT), the ministers concerned take a single joint decision, and a failure to decide within the period the King sets counts as a refusal (Article 105, paragraphs 3 and 6). A person who receives the list of sensitive zones may pass it only to people who need to know it for deploying and operating the 5G network (Article 105, paragraph 7).

A person who discloses information about that list to anyone else faces a criminal fine of EUR 1,000 to 100,000 (Article 105, paragraph 7). A mobile network operator offering services in Belgium over a 5G network must keep that network's infrastructure on the territory of the Member States of the European Union (Article 105, paragraph 8). The royal decree that brings the first three subparagraphs of paragraph 8 into force is to be dated no earlier than (Article 8). The Law took effect on .

What it requires

Law of 25 March 2025 on the digital operational resilience of the financial sector (DORA implementation), Competent Authorities

Art. 5 et 13 de la loi du 25 mars 2025 relative à la résilience opérationnelle numérique du secteur financierChamber of Representatives, adopted text of bill 56K0569 (DOC 56 0569/004, identical to the plenary text) and the Chamber's file card

In force since . Binds government bodies.

What this law does

The Law of on the digital operational resilience of the financial sector and containing miscellaneous provisions (Chamber bill 56 0569) gives effect in Belgium to Regulation (EU) 2022/2554 (DORA) and partly transposes Directive (EU) 2022/2556. The Chamber's record gives as the date of the Law and as its publication in the Moniteur belge.

New Article 37undecies of the Law of makes the Financial Services and Markets Authority (FSMA) the competent authority under DORA Article 46 for portfolio-management and investment-advice companies, trading venues and their operators, alternative investment fund managers it has approved, UCITS management companies and self-managed investment companies, insurance intermediaries, occupational pension institutions and crowdfunding service providers.

Article 5 of the Law makes the National Bank of Belgium the relevant competent authority designated under DORA Articles 19(1) and 32(5). Article 5 also requires the Bank to forward to the national computer security incident response team (CSIRT), without delay, the notifications and reports under DORA Article 19(4) that it receives from entities covered by the NIS2 law of . The Law extends the existing supervision and sanction regimes of the Bank and the FSMA to infringements of Regulation (EU) 2022/2554.

The adopted text contains no commencement article, so the general rule applies and the Law took effect on the tenth day after publication, .

What it requires

Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance

Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la… sécurité publique, Artt. 30-33Consolidated text, Internet Archive capture of the ejustice.just.fgov.be Justel database, Loi du 26 avril 2024, updated to

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2024/04/26/2024202344/justel

In force since . Binds public and private bodies.

What this law does

Article 30 requires an essential entity or an important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks threatening the security of the network and information systems it uses for its activities or to provide its services, on an all-hazards approach covering at minimum eleven points: risk-analysis and information-system-security policy, incident handling, business continuity (backup management, disaster recovery and crisis management), supply-chain security, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to assess the effectiveness of the risk-management measures, basic cyber-hygiene practices and training, cryptography and encryption policy, human-resources security and access-control and asset management, multi-factor or continuous authentication and secure voice, video, text and emergency communications, and the entity's own coordinated vulnerability-disclosure policy.

Article 31 requires the management body of an essential or important entity to approve the cybersecurity risk-management measures it takes to comply with Article 30, supervise their implementation, and answer for that entity's violation of Article 30, without prejudice to the liability rules that otherwise apply to a public institution. Article 32 makes the entity itself responsible for the risk analysis it performs and for the choice and implementation of the Article 30 measures.

Article 33 lets the King, after consulting the national cybersecurity authority, any sectoral authority concerned and the federated entities concerned, impose additional appropriate and proportionate sector- or subsector-specific risk-management measures by decree deliberated in the Council of Ministers. This Act's own Article 97 repeals the predecessor Loi du 7 avril 2019, the original NIS Directive transposition, effective the same date.

Article 6(3) disapplies Titles 3 to 5, which hold these measures, to an entity of the banking or financial-market-infrastructure sector in Annex I that falls within the scope of Regulation (EU) 2022/2554 (DORA).

What it requires

Vulnerability and incident reporting

Loi du 26 avril 2024, Significant-Incident Notification Obligations

Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la… sécurité publique, Artt. 34-37Consolidated text, Internet Archive capture of the ejustice.just.fgov.be Justel database, Loi du 26 avril 2024, updated to

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2024/04/26/2024202344/justel

In force since . Binds public and private bodies.

What this law does

Article 34 requires an essential entity or an important entity to notify any significant incident to the national computer security incident response team (CSIRT) without undue delay, following the arrangements set out in a protocol between the CSIRT and the National Crisis Centre (NCCN).

Article 35 sets the clock: an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact; an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise; an interim report if the national CSIRT or the competent sectoral authority asks for one; and a final report no later than one month after the incident notification, describing the incident, its severity and impact, the likely threat or root cause, the mitigation measures applied, and any cross-border impact.

A trust service provider, by derogation from the 72-hour notification, notifies a significant incident affecting its trust services within 24 hours of becoming aware of it. Article 36 requires the national CSIRT to respond to an early warning within 24 hours where possible, with initial feedback and, on request, operational guidance.

Article 37 lets the national CSIRT, after consulting the entity, the NCCN, any sectoral authority concerned and the responsible minister, inform the public of a significant incident or require the entity to do so, where public awareness is necessary to prevent or manage the incident or where disclosure is otherwise in the public interest. Article 54, paragraph 2 bars a further administrative fine for conduct already fined by the data protection authorities under General Data Protection Regulation (GDPR) Article 58(2)(i).

Article 6(3) disapplies Titles 3 to 5, which hold these notification duties, to an entity of the banking or financial-market-infrastructure sector in Annex I that falls within the scope of Regulation (EU) 2022/2554 (DORA).

What it requires

Communications law4 instruments, 4 in force

Research summary (327 words)

Belgian law governs advertising by electronic mail, storing information on a device, recording communications and the spoofing of Belgian numbers on international calls.

Article XII.13 of the Code de droit économique prohibits advertising by electronic mail without the recipient's prior, free, specific and informed consent, requires an opt-out notice and means in every message, bars third-party addresses and masked origin information, and puts the burden of proving that advertising was solicited on the provider; the Data Protection Authority identifies a soft opt-in for a seller's own customers in the Royal Decree of , and, in the 2013 text, a breach is punishable by a level 3 sanction, or a level 4 sanction in bad faith.

Article 10/2 of the Act of allows storing information on a user's device, or reading it, only after clear information and consent, with an exception for transmission and for a service the user expressly requested where strictly necessary.

Article 10/1 of the same Act allows recording an electronic communication in a lawful commercial transaction as proof of it, and listening to call-center calls solely to monitor service quality, on stated conditions of prior information and retention; the Data Protection Authority supervises Articles 10/1 and 10/2.

According to the Data Protection Authority, Article VI.110, paragraph 1 of the Code prohibits automated calling systems and fax machines for direct marketing without prior, free, specific and informed consent, and Articles VI.110, paragraphs 2 and 3, VI.111, VI.112 and VI.114 allow live telephone marketing unless the recipient has objected directly or by registering on the "Ne m'appelez plus" list.

The Royal Decree of requires operators to block international voice calls carrying a Belgian number, with exceptions for certain bona fide services such as cloud-based telephone direct marketing. A data subject's right to object to direct marketing is held in the privacy row for General Data Protection Regulation (GDPR) Articles 12 to 21 and Title 5 of the Act of .

Commercial messages

Code de droit économique, Article XII.13, Advertising by Electronic Mail

Code de droit économique, art. XII.13; arts. XV.120-XV.121Act of inserting Book XII into the Code de droit économique

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://www.ejustice.just.fgov.be/cgi_loi/loi_a1.pl?language=fr&la=F&table_name=loi&cn=2013121551&&caller=list&F&fromtab=loi&tri=dd+AS+RANK&r…

In force since . Binds private bodies.

What this law does

Article XII.13, paragraph 1 of the Code de droit économique, inserted by the Act of , prohibits the use of electronic mail for advertising without the prior, free, specific and informed consent of the recipient of the messages. The King may, on a joint proposal of the Minister and the Minister of Justice, provide for exceptions to that prohibition.

The Data Protection Authority identifies the Royal Decree of , Article 1, point 1° as such an exception: a provider need not ask for prior consent to send advertising by electronic mail to its customers, natural or legal persons, when it obtained their electronic contact details directly in the sale of a product or service, in compliance with privacy requirements, uses them for advertising exclusively for analogous products or services that it supplies itself, and gives its customers, when the details are collected, the means to object, free of charge and in a simple manner, to that use.

Under Article XII.13, paragraph 2, when sending any advertising by electronic mail the provider gives clear and comprehensible information on the right to object to receiving advertising in the future and indicates and makes available an appropriate means of exercising that right electronically.

Under paragraph 3, it is prohibited, when sending advertising by electronic mail, to use the electronic address or the identity of a third party, to falsify or mask any information that identifies the origin of the message or its transmission path, or to encourage the recipient to visit websites that breach Article XII.12. Under paragraph 4, the provider bears the burden of proving that advertising by electronic mail was solicited.

Article XV.120, inserted by the same Act, punishes with a level 3 sanction those who send advertising by electronic mail in breach of Article XII.13. Article XV.121, inserted by the same Act, punishes with a level 4 sanction those who commit a breach of Article XII.13 in bad faith.

Article I.18, point 2° of the Code defines electronic mail as any message in the form of text, voice, sound or image sent by a public communications network that can be stored in the network or in the recipient's terminal equipment until the recipient retrieves it. The Data Protection Authority considers that this definition clearly covers emails and SMS messages. The Act inserting Book XII provides that the King sets the date on which each of its provisions enters into force.

What it requires

Device storage and tracking consent

Act of 30 July 2018, Article 10/2, Consent for Storing or Reading Information on Terminal Equipment

Loi du 30 juillet 2018, art. 10/2Jurion legislation database of the Federal Agency for Nuclear Control (fanc.fgov.be)

In force since . Binds public and private bodies.

What this law does

Article 10/2 of the Act of allows the storage of information in the terminal equipment of a subscriber or user, or access to information already stored there, only on two conditions. The first is that the subscriber or user concerned receives clear and precise information about the purposes of the processing and their rights under the Regulation and the Act. The second is that the subscriber or end user has given consent after being informed in that way.

The first paragraph does not apply to the technical recording of information, or access to information stored in terminal equipment, whose sole purpose is to carry out the sending of a communication over an electronic communications network or to provide a service the subscriber or end user expressly requested, where that is strictly necessary for that purpose.

The article is made in application of Article 125, paragraph 1, point 1° of the Act of on electronic communications and without prejudice to the Regulation and the Act. The Data Protection Authority's guidance states that the consent must meet all the conditions for the validity of a consent. The same guidance treats other tracking techniques, such as local storage, as covered by the rules on storing and reading information on the device.

The Data Protection Authority's opinion on the bill that inserted Articles 10/1 and 10/2 records that their content is almost identical to that of Articles 128 and 129 of the Act of .

What it requires

Interception and recording consent

Act of 30 July 2018, Article 10/1, Recording of Electronic Communications in Lawful Commercial Transactions

Loi du 30 juillet 2018, art. 10/1Jurion legislation database of the Federal Agency for Nuclear Control (fanc.fgov.be)

In force since . Binds public and private bodies.

What this law does

Article 10/1, paragraph 1 of the Act of allows the recording of an electronic communication and of the traffic data relating to it, made in lawful commercial transactions as proof of a commercial transaction or of another professional communication, on condition that the parties to the communication are informed, before the recording, of the recording, of its precise purposes and of the storage period.

The data are erased at the latest at the end of the period during which the transaction can be challenged in court. Paragraph 2 allows the listening to and recording of electronic communications and traffic data whose sole aim is to monitor the quality of service in call centers, on condition that the people who work in the call center are informed beforehand of the possibility of listening and recording, of the precise purpose and of the retention period.

Those data may be kept for a maximum of one month. Both paragraphs are made in application of Article 125, paragraph 1, point 1° of the Act of on electronic communications and without prejudice to the Regulation and the Act. The Data Protection Authority's opinion on the bill that inserted Articles 10/1 and 10/2 records that their content is almost identical to that of Articles 128 and 129 of the Act of .

What it requires

Telephone contact

Royal Decree of 12 May 2024, Blocking of International Voice Calls with Spoofed Belgian Telephone Numbers

Koninklijk besluit van 12 mei 2024 ter bestrijding van internationale spraakoproepen met gespoofde Belgische telefoonnummersText published in the Belgisch Staatsblad of , Federal Public Service Justice (ejustice.just.fgov.be)

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.ejustice.just.fgov.be/cgi/article_body.pl?language=nl&caller=summary&pub_date=24-06-13&numac=2024005253

In force since . Binds private bodies.

What this law does

Article 1 of the Royal Decree of requires operators that directly receive incoming international telephone calls through their international network interfaces to take measures to block calls that do not comply with ITU-T Recommendation E.157 and calls that show a Belgian geographic or non-geographic E.164 telephone number as the identification of the calling party.

Under point 3 of Article 1, after verifying that the caller is not roaming abroad with a Belgian mobile E.164 telephone number, they must block all calls, and they may suppress the identification of the calling party instead only if it can be shown that such verification is technically infeasible. Under point 4 of Article 1, they must block all calls that show a short telephone number as the identification of the calling party.

Article 2 allows international telephone calls to be received only on circuits dedicated to them and clearly separate from national calls. Article 3 provides that calls from a Belgian geographic or mobile number that originate in Belgium may not be blocked when they are destined for an incoming roamer, for an outgoing roamer with a late conditional call forwarding to a Belgian number, or for a user of a foreign number who has a forwarding to a Belgian number.

Article 4, paragraph 1 allows nomadic calls and calls from cloud-based conference dial-out, customer support and telephone direct marketing services made with Belgian geographic numbers only if they reach the operators that first receive incoming international calls through a special interface under the full control of the originating operator.

Article 4, paragraph 2 requires the receiving operators to give the Institute, within 24 hours of a simple request, the name, address and contact details of the user who made a given call, and to block all incoming calls of that user within 24 hours if the answer is late, incomplete or incorrect. Article 4, paragraph 3 lets those operators rely on the exception only after they meet the provisions of that Article in an agreement with the caller's operator.

Under Article 6 the Decree takes effect on the first day of the third month after the month of its publication in the Belgisch Staatsblad, and Article 1, point 3 takes effect on the first day of the sixth month after that month. The Belgian Institute for Postal Services and Telecommunications states that operators must take the measures for geographic numbers from and for mobile numbers from .

What it requires

Content moderation law4 instruments, 4 in force

Research summary (233 words)

Belgium applies the Digital Services Act (Regulation (EU) 2022/2065) directly and adds a national layer in three parts.

The Act of makes the Belgian Institute for Postal Services and Telecommunications (BIPT) a competent authority under Article 49 of the Regulation for the federal competences, gives it powers of inspection, interim measures and binding commitments, and ties its maximum administrative fine and periodic penalty payment for a breach of the Regulation to the amounts in Article 52(3) and (4).

The same Act replaced Article XII.20 of the Code de droit économique with a duty on intermediary services to make content inaccessible, and to give information, when a competent authority asks, and repealed Articles XII.17 to XII.19, which had transposed Articles 12 to 14 of Directive 2000/31.

A cooperation agreement between the federal State and the Flemish, French and German-speaking Communities designates the BIPT as Digital Services Coordinator, while the media regulators of the three Communities, the VRM, the CSA and the Medienrat, are competent authorities for their own competences. Articles XI.228/2, XI.228/3 and XI.228/5 to XI.228/9 of the Code set the duties of online content-sharing service providers under Article 17 of the Copyright Directive.

The Regulation's own duties are held with the European Union's page and are not restated here. The media decrees of the Communities and other Belgian regimes aimed at one kind of illegal content are not described here.

Notice and action

Code de droit économique, Article XII.20 (Orders to Make Content Inaccessible and to Provide Information) and Repeal of Articles XII.17 to XII.19

Code de droit économique, art. XII.20; Loi du 21 avril 2024, arts. 2-5 and 15-18Chamber of Representatives, DOC 55 3799/006, text of the bill implementing Regulation (EU) 2022/2065 as adopted in second reading

In force since . Binds private bodies.

What this law does

Article 4 of the Act of replaces Article XII.20 of the Code de droit économique. Under Article XII.20, paragraph 1, when a competent judicial or administrative authority establishes an infringement relating to specific content, the providers of the services named in Article 3, points (g), (i) and (j) of Regulation (EU) 2022/2065 make inaccessible the content that is the subject of the infringement committed through their intermediary.

The orders of those authorities meet at least the conditions listed in Article 9, paragraph 2 of the Regulation. Under Article XII.20, paragraph 2, the same providers communicate to the competent judicial or administrative authorities, on request, all the specific information they hold that is useful for investigating and establishing infringements committed by a specific recipient of their intermediary service.

The orders of those authorities meet at least the conditions listed in Article 10, paragraph 2 of the Regulation. Article 5 of the Act replaces point 3° of Article XV.118 of the Code so that it covers providers that refuse the cooperation required by Article XII.20, paragraph 1 or paragraph 2. Article XV.118 of the Code opens with the words that those it lists are punished with a level 3 sanction.

Article 3 of the Act repeals sections 1, 2 and 3 of chapter 6 of title 1 of Book XII of the Code, which contained Articles XII.17, XII.18 and XII.19. The Chamber's explanatory memorandum records that Articles XII.17 to XII.20 had transposed Articles 12 to 15 of Directive 2000/31. Article 2 of the Act replaces, in Article XI.228/3, paragraph 3 of the Code, the reference to Article XII.19, paragraph 1 with a reference to Article 8, paragraph 1 of the Regulation.

Articles 15 to 18 of the Act replace the references to Articles XII.17 to XII.20 in Article 39ter of the Code d'instruction criminelle, in Article 584 of the Judicial Code and in Articles 29, 29/1, 29/2 and 29/4 of the Act of on audiovisual media services in the Brussels-Capital bilingual region with references to the corresponding Articles of the Regulation, namely Articles 4, 5, 6 and 8, or Articles 4 and 6 in the Judicial Code. The BIPT states that it has been designated at federal level by virtue of the Act of .

What it requires

Code de droit économique, Articles XI.228/2, XI.228/3 and XI.228/5 to XI.228/9, Online Content-Sharing Service Providers (Article 17 of the Copyright Directive)

Code de droit économique, arts. XI.228/2-XI.228/3 and XI.228/5-XI.228/9Chamber of Representatives, DOC 55 2608/007, text of the bill transposing Directive (EU) 2019/790 as adopted in second reading

In force since . Binds private bodies.

What this law does

Article XI.228/2 of the Code de droit économique defines an online content-sharing service provider as the provider of an information society service whose main purpose, or one of whose main purposes, is to store and give the public access to a large amount of works or other protected subject matter uploaded by its users, which it organizes and promotes for profit.

Non-profit online encyclopedias, non-profit educational and scientific repositories, open-source software development and sharing platforms, electronic communications service providers, online marketplaces, business-to-business cloud services and cloud services that let users upload content for their own use are not online content-sharing service providers.

Under Article XI.228/3, paragraph 1, such a provider performs an act of communication to the public when it gives the public access to works or performances uploaded by its users. Under paragraph 2, an authorization the provider obtains also covers the acts of its users, as long as they are not acting on a commercial basis or their activity does not generate significant revenues.

Under Article XI.228/5, paragraph 1, if no authorization is granted the provider is liable for unauthorized acts of communication to the public unless it shows that it made its best efforts to obtain an authorization, made its best efforts, in accordance with high industry standards of professional diligence, to ensure the unavailability of specific works for which rightholders gave it the relevant and necessary information, and, in any event, acted promptly on a sufficiently substantiated notice from rightholders to block access or remove the works and made its best efforts to prevent their future upload.

Under paragraph 2, a new provider whose services have been available to the public in the European Union for less than three years and whose annual turnover is below EUR 10,000,000 only has to show its best efforts to obtain an authorization and prompt action on a sufficiently substantiated notice, and if its average monthly unique visitors exceed five million it must also show its best efforts to prevent further uploads of the notified works.

Article XI.228/6 provides that cooperation with rightholders must not prevent the availability of uploaded works that do not infringe copyright and related rights, including works covered by an exception or limitation, and that the chapter gives rise to no general monitoring obligation.

Article XI.228/7 requires providers to give rightholders, on request, adequate information on how their cooperation practices work and, where licenses exist, on the use of the covered works, and to tell users in their general terms and conditions that they may use works under exceptions and limitations.

Article XI.228/8 requires an effective and quick complaint and redress mechanism for users in disputes over blocked or removed uploads, with complaints handled without undue delay and decisions to block or remove subject to review by a natural person. Article XI.228/9 requires providers, for activities directed at users or rightholders with their seat or habitual residence in Belgium, to name two or more mediators with whom they are prepared to work on out-of-court settlement of such disputes.

Article XI.228/3, paragraph 3 disapplies the liability scheme of Article XII.19, paragraph 1 to situations covered by the chapter. The Act of replaced that reference with a reference to Article 8, paragraph 1 of Regulation (EU) 2022/2065. The Federal Public Service Economy lists Articles XI.228/3 and XI.228/5 to XI.228/9 as the transposition of Article 17 of the Copyright Directive by the Act of .

The Federal Public Service Economy states that most provisions of the Act came into force on . The Act enters into force on the day of its publication in the Moniteur belge, except for listed provisions that do not include these articles. The Chamber of Representatives adopted the text in plenary session on , identical to the text adopted in committee in second reading.

What it requires

Transparency and process

Act of 21 April 2024 Implementing the Digital Services Act, BIPT Competence, Investigation Powers and Penalties

Loi du 21 avril 2024, arts. 6-14 (loi du 17 janvier 2003, arts. 14, 15/1, 20, 21)Chamber of Representatives, DOC 55 3799/006, text of the bill implementing Regulation (EU) 2022/2065 as adopted in second reading

In force since . Binds public and private bodies.

What this law does

Article 7 of the Act of inserts a paragraph 1/1 into Article 14 of the law of on the statute of the BIPT, under which the Institute is, for the federal competences, a competent authority within the meaning of Article 49 of Regulation (EU) 2022/2065. Article 9 inserts Article 15/1, under which the Institute itself carries out the inspections of premises provided for in Article 51(1)(b) of the Regulation, after a decision of its Council.

The decision of the Council or its president states the object and purpose of the inspection, fixes the date on which it starts and mentions the sanctions that apply in case of non-compliance. An inspection in a private home needs at least two officials acting together and the authorization of an investigating judge of the Dutch-language or French-language court of first instance of Brussels.

Requests for explanations under Article 51(1)(c) of the Regulation are made by staff of the Institute mandated by the Council, and the explanations are recorded in a report that the person questioned signs. Article 12 adds a paragraph 3 to Article 20, under which the Council adopts interim measures when it finds a breach prima facie, in the context of Article 51(2)(e) of the Regulation.

Article 13 supplements Article 21, paragraph 5, so that the Institute may accept the commitments that a provider of an intermediary service proposes under the Regulation and make them binding. For breaches of the Regulation, the maximum administrative fine is the amount referred to in Article 52(3) of the Regulation. For breaches of the Regulation, the maximum periodic penalty payment is the amount referred to in Article 52(4) of the Regulation.

Paragraph 7/3 of Article 21 provides that, for the restriction of access provided for in Article 51(3), first paragraph, point (b) of the Regulation, the Institute applies to the president of the court of first instance sitting in summary proceedings. The Chamber of Representatives adopted the text in plenary session on , in the form adopted in committee in second reading.

What it requires

Cooperation Agreement on the Coordinated Partial Implementation of the Digital Services Act, Digital Services Coordinator and Competent Authorities

Accord de coopération du 3 mai 2024, arts. 1-11 and 20Chamber of Representatives, DOC 56 0288/001, bill giving assent to the cooperation agreement, with the agreement text

In force since . Binds government bodies.

What this law does

Article 4, paragraph 1 of the cooperation agreement between the federal State, the Flemish Community, the French Community and the German-speaking Community designates the Belgian Institute for Postal Services and Telecommunications as coordinator, which Article 1 defines as the Digital Services Coordinator within the meaning of Article 49(2) of Regulation (EU) 2022/2065.

Article 1 defines a competent authority as the authority designated by the federal State or by one of the Communities, the federal one being the authority referred to in Article 14, paragraph 1 of the law of and the three others being those referred to in the audiovisual media decrees of the Flemish, French and German-speaking Communities.

Under Article 4, paragraph 2, the coordinator is responsible for coordination at national level of all questions related to the supervision and enforcement of the Regulation. Article 5 requires the coordinator and the other competent authorities to set up an information-sharing system that each of them can access, in which they mention the files they handle and indicate their status in real time.

Under Articles 10 and 11, the coordinator receives applications for certification as an out-of-court dispute settlement body and for trusted flagger or vetted researcher status, and the complaints referred to in Article 53 of the Regulation, and places them in that system.

Under Article 8, before imposing a sanction, the competent authorities check in the system whether another competent authority has already taken a final decision against the same provider of intermediary services for the same infringement of the Regulation. Article 20 provides that the agreement enters into force ten days after the publication in the Moniteur belge of the last act of assent. The cooperation agreement is dated , and the loi du 20 décembre 2024 gave assent to it.

The agreement was published in the Moniteur belge on and entered into force on . The BIPT states that the agreement designates it as the national coordinator and lays down the tasks of the coordinator and of the other competent authorities, the Medienrat, the CSA and the VRM.

What it requires

Product and AI liability law2 instruments, 1 in force, 1 proposed

Research summary (269 words)

Book 6 of the Civil Code holds Belgium's product liability regime in Articles 6.41 to 6.55, and Article 6.41 makes the producer liable for the damage caused by a defect in its product. Article 6.42 defines a product as any corporeal movable good, and it also treats electricity as a product. The Law of that enacted Book 6 was published in the Belgisch Staatsblad on .

Article 45 of that Law brings it into force on the first day of the sixth month after the month of its publication. The repeal of the Law of on liability for defective products took effect on . The Law of on liability for defective products was repealed by the Law of . No provision of the Law of mentions software, algorithms or artificial intelligence.

Directive (EU) 2024/2853 requires Member States to bring into force the measures necessary to comply with it by . It repeals Directive 85/374/EEC with effect from and keeps that Directive applying to products placed on the market or put into service before that date. On the Council of Ministers approved a preliminary draft law that partially transposes Directive (EU) 2024/2853. The preliminary draft is sent to the Council of State for its opinion.

No bill transposing Directive (EU) 2024/2853 has been located among the documents the Chamber of Representatives listed for 7 to . The Belgian cybersecurity baseline, the Law of , is recorded in the security topic.

Product liability

Avant-projet de loi (Council of Ministers, 18 July 2026), partial transposition of Directive (EU) 2024/2853 on liability for defective products

Avant-projet de loi modifiant les dispositions du Code civil relatives à la responsabilité du fait des produits défectueux et insérant l’article 877/1 dans le Code judiciaireAnnouncement of the Council of Ministers of

Proposed. proposed Not law. It binds no one unless it is enacted.

Approved by the executive for transmission to the legislature, dated , as of .

What this law does

The Council of Ministers approved a preliminary draft law that partially transposes Directive (EU) 2024/2853 into Belgian law. The Council of Ministers met on . The preliminary draft is sent to the Council of State for its opinion. The preliminary draft is titled as a draft law amending the Civil Code provisions on liability for defective products and inserting Article 877/1 into the Judicial Code.

The Council of Ministers' announcement describes the Directive as setting up a liability regime without fault in favor of natural persons who suffer bodily injury or damage caused by defective products. The announcement says the draft pursues objectives of adapting the present rules to the circular economy and new global supply chains, to new technologies including artificial intelligence, and of lightening the victim's burden of proof.

The announcement says the draft also clarifies fundamental notions and concepts and takes account of recent case law of the Court of Justice of the European Union.

What it requires

Civil Code Book 6, Articles 6.41 to 6.55, Liability for Defective Products (Directive 85/374/EEC)

Burgerlijk Wetboek, boek 6, artikelen 6.41 tot 6.55Text of the Law of enacting Book 6 of the Civil Code

In force since . Binds private bodies.

What this law does

Article 6.41 makes the producer liable for the damage caused by a defect in its product. Article 6.42 defines a product as any corporeal movable good, even where it forms part of another movable or immovable good or has become immovable by destination.

Article 6.43 counts as a producer the manufacturer of a finished product, the manufacturer of a component part and the manufacturer or producer of a raw material, and anyone who presents itself as a manufacturer or producer by putting its name, trade mark or another distinguishing sign on the product. Article 6.44 treats as a producer anyone who, in the course of its economic activities, imports a product into the European Union to sell it or transfer its use to a third party.

Article 6.44 treats the supplier as the producer where a product made in a Member State has no identifiable producer, unless the supplier tells the injured person within a reasonable time who the producer is or who supplied the product to it. Article 6.44 treats the supplier of an imported product as the producer where the importer cannot be identified, unless the supplier tells the injured person within a reasonable time who the importer is or who supplied the product to it.

Article 6.45 makes a product defective where it does not offer the safety that one is entitled to expect in all the circumstances, among them its presentation, its normal or reasonably foreseeable use and the time it was put into circulation. Article 6.45 provides that a product may not be regarded as defective only because a better product was put into circulation later. Article 6.47 places on the injured person the burden of proving the damage, the defect and the causal link between them.

Article 6.48 excuses the producer who proves that it did not put the product into circulation. Article 6.48 excuses the producer who proves that the defect probably did not exist when it put the product into circulation or arose later. Article 6.48 excuses the producer who proves that the product was not made for sale or distribution with an economic purpose, nor made or distributed in the course of its profession.

Article 6.48 excuses the producer who proves that the defect results from the product complying with mandatory rules of the public authorities. Article 6.48 excuses the producer who proves that the state of scientific and technical knowledge when it put the product into circulation made it impossible to discover the defect.

Article 6.48 excuses the producer of a component or raw material who proves that the defect is due to the design of the product it went into or to the instructions of that product's producer. Article 6.49 makes each of several persons liable for the same damage jointly liable, without prejudice to rights of recourse. Article 6.50 bars limiting or excluding the producer's liability towards the injured person by contract.

Article 6.50 allows the liability to be limited or excluded where the damage is caused both by a defect and by the fault of the injured person or of a person for whom the injured person is responsible. Article 6.50 does not allow the liability to be limited or excluded where the damage is caused both by a defect and by the act of a third party. Article 6.51 covers damage to persons, moral damage included, and, subject to the following provisions, damage to goods.

Article 6.51 compensates damage to goods only if they are of a type normally intended for private use or consumption and the injured person mainly used them that way. Article 6.51 gives no compensation for damage to the defective product itself. Article 6.51 makes compensation for damage to goods due only after a deductible of five hundred euros.

Article 6.52 extinguishes the injured person's right to compensation ten years after the producer put the product into circulation, unless the injured person began judicial proceedings within that period. Article 6.52 provides that the action prescribes three years after the injured person reasonably should have known the damage, the defect and the identity of the producer. Article 6.53 leaves untouched the injured person's rights under the law of contractual or extra-contractual liability.

Article 6.51 refers to Directive 85/374/EEC of on liability for defective products. The Law of that enacted Book 6 was published in the Belgisch Staatsblad on . Article 45 of that Law brings it into force on the first day of the sixth month after the month of its publication. Article 44 of that Law applies Book 6 to facts that can give rise to liability and occurred after its entry into force, and not to the future consequences of earlier facts.

What it requires

Digital accessibility law17 instruments, 17 in force

Research summary (728 words)

Belgium transposes Directive (EU) 2019/882 through federal, Community and Regional measures, because the Chamber's explanatory text states that the products and services that the Directive covers are divided between the regional and federal authorities according to their competences and transposed in their respective organic laws. The Law of puts the accessibility requirements for consumer banking and e-commerce services in Title 5 of Book VIII of the Code of Economic Law.

Article 40 of that Law places enterprises with fewer than ten employees and an annual turnover or balance sheet total of at most EUR 2,000,000 outside it only until . Its explanatory memorandum states that service providers that are micro-enterprises come within its scope from 2030. Article 4(5) of the Directive exempts microenterprises providing services from the accessibility requirements for services without a time limit.

The Royal Decree of sets the accessibility requirements for products other than radio equipment and designates the Directorate-General for Energy of the Federal Public Service Economy as the Belgian market surveillance authority. The Law of amended Articles 1, 38/1 and 121/4 of the Electronic Communications Act. A Royal Decree of lays down the accessibility requirements for electronic communications services under Article 121/4.

A second Royal Decree of inserts the accessibility requirements for radio equipment under Article 38/1 into the Royal Decree of . The Law of on audiovisual media services in the bilingual Brussels-Capital region now carries an accessibility duty in its Article 3/2(1). The Law of applies to the websites, mobile device services and electronic tickets of passenger air, bus, rail and waterborne transport services.

The Flemish Community applies accessibility requirements to terminal equipment for access to television services in Article 214/2 of its Media Decree. The German-speaking Community applies accessibility requirements to services that give access to audiovisual media services, and to e-books, in Article 100(2) of its Media Decree. The French Community requires electronic programme guides to be accessible to persons with a sensory impairment in Article 8.3.2-3 of its audiovisual decree.

Article 53(1) of the Law of on public procurement requires technical specifications for contracts intended for natural persons to take account of accessibility criteria. Article 133, point 3, of that Law applies the same rule to contracts in the special sectors. The Walloon Region's decree of concerns the accessibility requirements applicable to interactive self-service terminals of urban, suburban and regional transport.

The Brussels-Capital Region's ordinance of concerns the same subject for urban and regional transport. An order of the Brussels Government of makes Brussels Mobility the competent authority and the control service under that ordinance. The Flemish Government's decision of sets the arrangements for organising public passenger transport by water. The Flemish Community's decree of concerns e-books and related software.

The French Community's decree of concerns the accessibility requirements for digital books. The Royal Decree of concerns the sending of written electronic messages to the 112 centres. Article 2 of that decree lets deaf and hard-of-hearing persons, and persons with another disability that prevents a voice call, send written messages to the 112 centres by SMS to 8112 or through the 112 BE app.

The Royal Decree of sets the accessibility requirements for audiovisual media services in the bilingual Brussels-Capital region for persons with a visual or auditory impairment. The duties that the transposition of Directive (EU) 2016/2102 places on public bodies are covered on law.ungovr.org in the public-sector accessibility entry for Belgium.

Article 151(1) of the Flemish Media Decree requires the public broadcaster of the Flemish Community and the private television broadcasters to make their programmes continuously and increasingly accessible to persons with disabilities, by subtitling, audio description, sign language and spoken subtitles.

Article 4.1-1 of the French Community decree on audiovisual media services requires service publishers and service distributors to apply the regulations, approved by the Government, that govern the accessibility of programmes for persons with a sensory impairment.

Article 21(1) of the Decree of the German-speaking Community on media services requires audiovisual media service providers to improve the accessibility of their services for persons with support needs continuously and increasingly, by appropriate measures.

Accessibility requirements

Brussels-Capital Region ordinance of 30 March 2023 on the accessibility of interactive self-service terminals of urban and regional transport, with the executing order of 8 June 2023

Ordonnance du 30 mars 2023 relative à l'accessibilité des terminaux en libre-service interactifs des transports urbains et régionaux et arrêté du Gouvernement de la Région de Bruxelles-Capitale du 8 juin 2023 portant exécution de cette ordonnance (Région de Bruxelles-Capitale)Text of the ordinance of the Brussels-Capital Region of as published in the Moniteur belge of

In force since . Binds public and private bodies.

What this law does

Article 2 of the ordinance of the Brussels-Capital Region of states that it partly transposes Directive (EU) 2019/882. Article 2(2)(c) of the Directive brings urban, suburban and regional transport services within its scope only for their interactive self-service terminals.

Article 4 covers the accessibility for persons with disabilities of the interactive self-service terminals that give access to urban and regional bus, tram and metro transport services on the territory of the Brussels-Capital Region, rail excluded.

Article 3, point 5, defines the service provider as the economic operator that manages the urban and regional services, and Article 3, point 6, defines an economic operator as an entity carrying on an economic activity, whatever its legal status and way of financing.

Article 5 requires the services to meet the accessibility requirements of Annex I. Article 6(1) applies the requirements only to the extent that compliance does not require a significant change that fundamentally alters the nature of the service and does not impose a disproportionate burden on the providers.

Article 6(3) requires providers to support their assessment with evidence, keep the relevant results for five years after the service was last provided and give the control service a copy on request. Article 6(5) bars a provider that receives funding other than its own resources, public or private, to improve accessibility from relying on the disproportionate burden defence, and Article 6(6) requires a provider relying on the exception to inform the control service.

Article 7(3) makes the requirements of Annex I binding accessibility requirements within the meaning of Article 53(1), fifth paragraph, of the Law of on public procurement. Article 7(6) deems services that meet the accessible-information requirements of the EU passenger rights regulations, and of the acts adopted under Directive 2008/57/EC, to meet the corresponding requirements of the ordinance.

Article 8 requires providers to design and provide the services in line with the requirements, prepare the Annex II information and make it available in writing and orally, including in a way accessible to persons with disabilities, keep procedures that keep the service conforming, take corrective measures and inform the control service of a non-conformity at once. Article 10(1) lets any interested person lodge a complaint free of charge with the competent authority, anonymously if they wish.

Article 13 lets a person mandate a non-profit body active for at least three years in protecting the rights of persons with disabilities to lodge the complaint on their behalf. Article 17(1) sets administrative fines from EUR 10,000 to EUR 16,000 for failing to design and provide conforming services down to EUR 1,250 to EUR 2,000 for failing to supply the information the control service asks for.

Article 17(3) caps the total of the fines for concurrent breaches at twice the heaviest maximum fine, and Article 17(4) sets the fine for a repeat of the same breach within two years at no less than twice the earlier fine. Article 20 lets the person fined appeal to the police court within one month of the decision.

Article 21 lets service contracts agreed before run unchanged for no more than five years, and lets self-service terminals lawfully used before that date stay in use until and for no more than twenty years after they entered service. Article 22 brings the ordinance into force on . Article 3 of the order of the Brussels Government of makes Brussels Mobility the competent authority that handles complaints and imposes the fines.

Article 4 of that order makes Brussels Mobility the control service as well. Article 6 of that order brings it into force on . The European Union's list of Belgian transposition measures also records an ordinance of amending the ordinance of , published in the Moniteur belge on .

What it requires

Code of Economic Law, Book VIII Title 5, accessibility requirements for consumer banking and e-commerce services (Law of 5 November 2023)

Wetboek van economisch recht boek VIII, titel 5 (art. VIII.58 tot VIII.66), boek XV (art. XV.18/5, XV.18/6, XV.62/7, XV.101/1 en XV.132) en bijlagen 1 tot 4, ingevoegd bij de wet van 5 november 2023Text adopted by the committee, Chamber document 55-3433/003, in Dutch and French

In force since . Binds public and private bodies.

What this law does

Article 2 of the Law of states that the Law partly transposes Directive (EU) 2019/882. Article 4(1) of the Directive requires Member States to ensure that economic operators only provide services that comply with the accessibility requirements in its Annex I. Article VIII.58(1) applies Title 5 of Book VIII of the Code of Economic Law to consumer banking services and e-commerce services provided to consumers.

Article I.9/1, point 7, defines e-commerce services as services provided at a distance, through websites and mobile device-based services, by electronic means and at a consumer's individual request with a view to concluding a consumer contract. Article I.9/1, point 6, treats as consumer banking services the consumer credit agreements, investment services, payment services, electronic money and payment-account services that it lists.

Article VIII.58(2) excludes from Title 5 the pre-recorded time-based media and office file formats published before the entry into force of the title, and online maps and mapping services where the essential navigation information is provided in an accessible digital way. Article VIII.58(2) also excludes third-party content that the operator does not finance, develop or control, and website and app content that counts as an archive.

Article VIII.59(1) requires service providers to design and provide only services within Article VIII.58(1) that meet the accessibility requirements in Annex 1 to Book VIII. Article VIII.59(1) requires providers that outsource a service in whole or in part to ensure that the outsourced service meets the same requirements. Article VIII.59(2) lets the King exclude all or certain categories of micro-enterprises from all or some of the accessibility requirements.

Section 1 of Annex 1 requires websites, related online applications and mobile device services, including mobile applications, to be made accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust. Section 2 of Annex 1 sets additional accessibility requirements for consumer banking services, covering identification methods, electronic signature, security and payment services.

Section 2 of Annex 1 also requires banking information to be no more difficult than level B2 of the Common European Framework of Reference for Languages. Section 3 of Annex 1 sets additional accessibility requirements for e-commerce services, covering accessibility information on the products and services offered for sale, and identification, security and payment functions.

Section 3 of Annex 1 also requires e-commerce services to provide identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust. Section 4 of Annex 1 requires functions of a service that Sections 1 to 3 do not address to be made accessible by meeting the functional performance criteria it lists.

Article VIII.60 requires service providers to prepare the information required by Annex 2 and explain how the services meet or do not meet the accessibility requirements. Article VIII.60 requires that information to be made available to the public in writing and orally, including in a way accessible to persons with disabilities, and kept as long as the service operates.

Article VIII.61(1) requires service providers to apply procedures that keep the service in line with the accessibility requirements for as long as it is provided. Article VIII.61(2) requires providers to take corrective measures when a service no longer conforms. Article VIII.61(2) also requires providers to notify the officials designated under Article XV.2 immediately when a service does not meet the requirements.

Article VIII.61(3) requires providers to give those officials, on request, all information and documentation that shows the service meets the requirements, and to cooperate with them. Article VIII.62(1) applies the requirements only to the extent that compliance does not require a significant change resulting in a fundamental alteration of the nature of the service and does not impose a disproportionate burden on the provider.

Article VIII.62(1) requires the requirements that do not cause a fundamental alteration or disproportionate burden to be complied with in full. Article VIII.62(2) requires providers to carry out an assessment of whether compliance with the accessibility requirements would introduce a fundamental alteration. Article VIII.62(3) requires providers to keep all relevant results of the assessment for five years after the service was last provided.

Article VIII.62(4) requires a provider relying on the disproportionate burden defence to renew the assessment when the service changes, at the officials' request, and at least every five years. Article VIII.62(5) bars a provider that receives public or private funding for accessibility from relying on the disproportionate burden defence.

Article VIII.62(6) requires a provider that relies on the fundamental alteration or disproportionate burden exception for a specific service to inform the officials proactively. Article VIII.63 presumes that services meeting harmonised standards, or parts of them, published in the Official Journal of the European Union conform to the accessibility requirements to the extent the standards cover them.

Article 39 of the Law lets service contracts concluded before continue unchanged until they expire, and for no more than five years from that date. Article 39 of the Law lets providers keep using, until , the products they lawfully used before that date to provide similar services. Article 39 of the Law lets self-service terminals lawfully used before stay in use until the end of their economic life, and for no more than twenty years after they entered use.

Article 40 of the Law excludes certain small enterprises from the Law until , except for Article 5 of the Law. The explanatory memorandum states that service providers that are micro-enterprises come within the scope of the Law only from 2030. Article 4(5) of the Directive exempts microenterprises providing services from the accessibility requirements for services and from any obligations relating to compliance with them.

Article 40 of the Law lets service contracts agreed with those enterprises before continue unchanged until they expire, and for no more than five years from that date. Article 40 of the Law lets those enterprises keep using, until , the products they lawfully used before that date to provide similar services. Article 38 of the Law provides that the Law enters into force on .

Article XV.18/5(1) lets any person lodge a complaint about the accessibility of products and services free of charge with the officials designated under Article XV.2. Article XV.18/5(3) makes a complaint inadmissible where it concerns facts that occurred before , or before where the service is provided by a micro-enterprise.

Article XV.18/6 lets a person with a disability mandate a non-profit body, organisation or association that meets its conditions to lodge the complaint on their behalf. The Economic Inspection of the Federal Public Service Economy supervises consumer banking and e-commerce providers. Article XV.101/1 punishes breach of Articles VIII.59 to VIII.62 with a level 2 sanction, and a bad-faith breach with a level 3 sanction.

The explanatory memorandum equates a level 2 sanction with an administrative or criminal fine of EUR 208 to EUR 80,000. The explanatory memorandum gives for a level 2 sanction a settlement of EUR 26 to EUR 60,000 under the Royal Decree of . The explanatory memorandum gives for a level 3 sanction an administrative or criminal fine of EUR 208 to EUR 200,000 or a settlement of EUR 26 to EUR 150,000.

Article XV.132 lets the court order additional corrective measures for breaches of Articles XV.99/1 and XV.101/1. Article 36 of the Law adds Titles 4 and 5 of Book VIII to the provisions listed in Article XVII.37, point 1, of the Code. The explanatory summary says that the Law inserts into Books I, XV and XVII the relevant definitions, the enforcement provisions and the possibility of an action for collective redress.

Article XV.62/7 lets the officials designated under Article XV.60/4, who impose the administrative fine, decide that it is not executed, or only in part, if the offender carries out the corrective measures they set.

What it requires

Decree of the French Community on audiovisual media services and video-sharing services, Article 4.1-1, accessibility of programmes for persons with a sensory impairment

Décret du 4 février 2021 relatif aux services de médias audiovisuels et aux services de partage de vidéos articles 2.1.4-1, 4.1-1 et 9.2.2-1 (Communauté française)Gallilex

In force since . Binds public and private bodies.

What this law does

Article 4.1-1 of the French Community decree requires service publishers and service distributors to apply the regulations of the Advisory College of the Conseil supérieur de l'audiovisuel, approved by the Government, that govern the accessibility of programmes for persons with a sensory impairment. Article 4.1-1 states that those regulations aim in particular to make programmes continuously and progressively more accessible to persons with a sensory impairment.

Article 2.1.4-1 requires service publishers, when they broadcast an urgent message of general interest, to ensure that it is also accessible to persons with a sensory impairment. Article 9.2.2-1 lets the Authorisation and Control College of the Conseil supérieur de l'audiovisuel, on finding a breach of the audiovisual laws, decrees and regulations, impose a fine. The consolidated text gives the decree's date as and its publication in the Moniteur belge as .

Article 10.4-1 provides that the decree enters into force on the twentieth day after its publication in the Moniteur belge.

What it requires

Decree of the French Community on audiovisual media services and video-sharing services, Article 8.3.2-3, accessibility of electronic programme guides and application programme interfaces

Décret du 4 février 2021 relatif aux services de médias audiovisuels et aux services de partage de vidéos articles 1.2-1, 8.3.2-3, 9.2.2-1 et 10.2-1 (Communauté française)Gallilex

In force since . Binds public and private bodies.

What this law does

Article 1.2-1, paragraph 1, point 5, of the French Community decree states that the decree partly transposes Directive (EU) 2019/882. Article 4(1) of the Directive requires Member States to ensure that economic operators only provide services that comply with the accessibility requirements in its Annex I. Article 8.3.2-3 requires electronic programme guides to be accessible to persons with a sensory impairment and to give information on the availability of accessibility features.

Article 8.3.2-3 lets the Government determine the modes of use that those guides must offer to make them accessible. Article 8.3.2-3 requires application programme interfaces to be able to process the applications and related data of audiovisual media services, including those that give persons with a sensory impairment access to the services.

Article 8.3.2-3 requires access features such as subtitling, audio description or sign language interpretation to be available at a quality suited to a clear display, synchronised with sound and video, and adjustable by the user.

Article 10.2-1 brings into force on an Article 8.2.3-6, which the consolidated decree does not contain, and lets electronic programme guides and interfaces made available to users before that date be operated in their original configuration until . The electronic programme guides and application programme interfaces whose accessibility the decree governs are those of Article 8.3.2-3.

Article 10.4-1 provides that the decree enters into force on the twentieth day after its publication in the Moniteur belge. Article 9.2.2-1 lets the Authorisation and Control College of the Conseil supérieur de l'audiovisuel, on finding a breach of the audiovisual laws, decrees and regulations, impose one of the sanctions that it lists.

What it requires

Decree of the German-speaking Community on media services and cinema screenings, Article 100 and Annexes 1 and 2, accessibility of terminal equipment, access services and e-books

Dekret vom 1. März 2021 über die Mediendienste und die Kinovorstellungen Artikel 100, 139 §1 und Anhänge 1 und 2 (Deutschsprachige Gemeinschaft)Medienrat der Deutschsprachigen Gemeinschaft, consolidated Dekret über die Mediendienste und die Kinovorstellungen in German

In force since . Binds public and private bodies.

What this law does

Article 1, point 5, of the Decree of the German-speaking Community states that the Decree partly transposes Directive (EU) 2019/882.

Article 4(1) of the Directive requires Member States to ensure that economic operators only place on the market products and only provide services that comply with the accessibility requirements in its Annex I. Article 100(1) requires consumer terminal equipment with interactive computing capability used to access audiovisual media services, and e-readers, placed on the market after to meet Sections I and IV of Annex 1.

Article 100(2) requires services that give access to audiovisual media services, and e-books, provided to consumers after to meet Sections II and III, or Section IV, of Annex 1. Article 100(2) exempts microenterprises that offer services from the accessibility requirements and from all obligations relating to compliance with them.

Article 100(3) applies the requirements only to the extent that compliance does not require a significant change resulting in a fundamental alteration of the product or service and does not impose a disproportionate burden on the economic operators. Article 100(3) requires economic operators to assess and document the defence on the Annex 2 criteria, keep the results for five years, and give the Media Council or the competent authority a copy on request.

Article 100(4) bars an operator that receives public or private funding for accessibility from relying on the disproportionate burden defence. Article 139(1) lets the Media Council impose on providers of consumer terminal equipment, e-readers, access services and e-books, for breach of Article 100, a warning, a press notice or an administrative fine of EUR 2,500 to EUR 25,000.

Article 139(1) also lets the Media Council impose a warning and publication of a notice in the press for a breach of Article 100. Article 139(1) also lists the seizure of the equipment among the sanctions the Media Council may impose. The consolidated text records that the e-book wording of Article 100 was added by the Decree of , in force from .

What it requires

Decree of the German-speaking Community on media services and cinema screenings, Article 21, accessibility of audiovisual media services for persons with support needs

Dekret vom 1. März 2021 über die Mediendienste und die Kinovorstellungen, Artikel 21 und 138 (Deutschsprachige Gemeinschaft)Medienrat der Deutschsprachigen Gemeinschaft, consolidated Dekret über die Mediendienste und die Kinovorstellungen in German

In force since . Binds public and private bodies.

What this law does

Article 21(1) of the Decree of the German-speaking Community requires audiovisual media service providers to improve the accessibility of their services for persons with support needs continuously and increasingly, by appropriate measures. Article 21(1) requires media service providers to report to the Media Council every three years from the date of their notification on how they carried out those measures.

Article 21(2) requires emergency information made available to the public through audiovisual media services to be provided in a way that is accessible to persons with support needs. Article 138 lets the Media Council, for a breach of Title 2 of the Decree, impose on the media service providers concerned a warning, a press notice or an administrative fine.

Article 157 provides that the Decree enters into force on the day of its publication, which the title line of the consolidated text gives as in the Belgisch Staatsblad.

What it requires

Electronic Communications Act, Article 121/4(3) to (7), and the Royal Decree of 13 September 2023, accessibility requirements for electronic communications services (Law of 20 July 2023)

Loi du 13 juin 2005 relative aux communications électroniques article 121/4, §§ 3 à 7, inséré par la loi du 20 juillet 2023, et Koninklijk besluit van 13 september 2023 tot vaststelling van de voorschriften en nadere bepalingen inzake toegankelijkheid voor personen met een handicap tot elektronische communicatiedienstenJustel consolidated text of the Loi du 13 juin 2005 relative aux communications électroniques in French

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2005/06/13/2005011238/justel

In force since . Binds public and private bodies.

What this law does

Article 1, second paragraph, point 7, of the Electronic Communications Act states that the Act partly transposes Directive (EU) 2019/882.

Article 4(1) of the Directive requires Member States to ensure that economic operators only provide services that comply with the accessibility requirements in its Annex I. Article 121/4(3) requires providers of electronic communications services to design the services in accordance with accessibility requirements and make them accessible to end users with disabilities. Article 121/4(3) leaves it to the King to fix the accessibility requirements and procedures.

The Royal Decree of on accessibility for persons with disabilities to electronic communications services, made under Article 121/4, enters into force on . Article 3 of that decree requires the provider of electronic communications services to give information on how the service works and on its accessibility features through several sensory channels.

Article 3, point 2, of that decree requires websites, related online applications and mobile device services, including mobile applications, to be made accessible by making them perceivable, operable, understandable and robust. Article 3, point 3, of that decree requires technical support that gives information, through accessible communication methods, on the accessibility of the service and its compatibility with assistive technologies.

Article 4 of that decree requires real-time text in addition to voice communication, and total conversation where video is provided in addition to voice. Article 5 of that decree requires the provider to describe the service in accessible formats and justify how it meets each requirement of Articles 3 and 4. Article 5(2) of that decree requires that information to be stated in the general terms and conditions or an equivalent document and kept as long as the service operates.

Article 6 of that decree sets the criteria for assessing a disproportionate burden, among them the ratio of the net costs of compliance to the provider's net turnover. Article 121/4(4) excludes from the requirements the transmission services used to provide machine-to-machine services. Article 121/4(5) exempts micro-enterprises that offer electronic communications services from the requirements and from all obligations relating to compliance with them.

Article 121/4(6) applies the requirements only to the extent that compliance does not require a significant change that fundamentally alters the nature of the service and does not impose a disproportionate burden on the provider. Article 121/4(6) requires providers to assess whether compliance would impose a fundamental alteration or disproportionate burden, to keep the evidence and results for five years, and to give the Institute a copy of the assessment on request.

Article 121/4(6) requires providers to renew the assessment for each category or type of service when the service changes, at the Institute's request, and at least every five years. Article 121/4(7) bars a provider that receives public or private funding for accessibility from relying on the disproportionate burden defence. Article 2, point 1, defines the Institute as the Belgian Institute for Postal Services and Telecommunications.

The Law of inserted Article 121/4(3) to (7), and the Justel consolidation records that it applies from . A royal decree laying down the rules and detailed provisions on accessibility for persons with disabilities to electronic communications services is among the measures that Belgium notified for Directive 2019/882.

Article 14(1), point 3, of the Law of on the status of the regulator of the Belgian postal and telecommunications sectors charges the Institute with checking compliance with the Law of and its implementing decrees. Article 21(5) of the Law of lets the Institute's Council, on finding a breach, order it to end, prescribe how it is to be remedied, and impose an administrative fine, with separate maximums for natural and for legal persons.

Article 21(5) of the Law of also lets the Council impose a periodic penalty payment for each day of delay in complying with its decisions. Article 21(6) of the Law of doubles those maximum amounts and percentages where the measures taken have not remedied the breach.

What it requires

Electronic Communications Act, Article 38/1, and the Royal Decree of 13 September 2023 amending the Royal Decree of 25 March 2016, accessibility requirements for consumer computing, self-service and terminal radio equipment (Law of 20 July 2023)

Loi du 13 juin 2005 relative aux communications électroniques article 38/1, inséré par la loi du 20 juillet 2023, et Koninklijk besluit van 13 september 2023 houdende wijziging van het koninklijk besluit van 25 maart 2016 betreffende het op de markt aanbieden van radioapparatuurJustel consolidated text of the Loi du 13 juin 2005 relative aux communications électroniques in French

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2005/06/13/2005011238/justel

In force since . Binds public and private bodies.

What this law does

Article 4(1) of the Directive requires Member States to ensure that economic operators only place on the market products that comply with the accessibility requirements in its Annex I. Article 38/1(1) subjects the radio equipment it lists to accessibility requirements fixed by the King, for holding, marketing, importing or owning it.

Article 38/1(1) lists general-purpose consumer computer hardware and its operating systems, self-service payment terminals, bank machines, ticketing machines, check-in machines, interactive information terminals, consumer terminal equipment for electronic communications services and for access to audiovisual media services, and e-readers.

Article 38/1(1) applies the requirements only to the extent that compliance does not require a significant change that fundamentally alters the nature of the equipment and does not impose a disproportionate burden on manufacturers, authorised representatives, importers and distributors. Article 38/1(1) requires those operators to assess the effect of compliance, support the assessment with evidence and keep the results for five years from the last placing on the market of the equipment.

Article 38/1(1) lets the Institute require a copy of the assessment. Article 38/1(1) exonerates a micro-enterprise active in radio equipment from the duty to support its assessment with evidence, unless the Institute asks for the relevant facts. Article 38/1(2) bars a manufacturer, authorised representative, importer or distributor that receives public or private funding for accessibility from relying on the disproportionate burden defence.

The Royal Decree of amending the Royal Decree of on making radio equipment available on the market requires the radio equipment covered by Article 38/1 to meet the accessibility requirements that it sets. That amending decree enters into force on .

Article 3/1(1), which that decree inserts, requires radio equipment to be designed and produced so as to maximise its foreseeable use by persons with disabilities, and to be accompanied, where possible in or on the equipment, by accessible information on how it works and on its accessibility features.

Article 26(1/1), which that decree inserts, requires the Institute, where it finds that radio equipment does not meet the accessibility requirements, to order the operator to take corrective measures within a reasonable period, and to require withdrawal from the market only where the operator fails to take them. The Justel consolidation records that Article 38/1 was inserted by the Law of and applies from .

A royal decree amending the Royal Decree of on making radio equipment available on the market is among the measures that Belgium notified for Directive 2019/882. Article 14(1), point 3, of the Law of on the status of the regulator of the Belgian postal and telecommunications sectors charges the Institute with checking compliance with the Law of and its implementing decrees.

Article 21(5) of the Law of lets the Institute's Council, on finding a breach, order it to end, prescribe how it is to be remedied, and impose an administrative fine of up to EUR 5,000 on a natural person and of up to 5% of the offender's consolidated turnover in the electronic communications or postal sector in Belgium, or up to EUR 1,000,000 for a legal person with no turnover.

Article 21(5) of the Law of also lets the Council impose a periodic penalty payment of up to EUR 500 a day of delay on a natural person and of up to 5% of daily turnover a day of delay on a legal person. Article 21(6) of the Law of doubles those maximum amounts and percentages where the measures taken have not remedied the breach.

What it requires

Flemish Media Decree, Article 151, accessibility of television programmes for persons with disabilities

Decreet van 27 maart 2009 betreffende radio-omroep en televisie, artikel 151 en artikel 228 (Vlaamse Gemeenschap)Codex Vlaanderen, consolidated Decreet betreffende radio-omroep en televisie of the Flemish Community in Dutch

In force since . Binds public and private bodies.

What this law does

Article 151(1) of the Flemish Media Decree requires the public broadcaster of the Flemish Community and the private television broadcasters to make their programmes continuously and increasingly accessible to persons with disabilities, by proportionate measures. Article 151(1) names subtitling, audio description, sign language and spoken subtitles as the means of making programmes accessible to persons with a visual or auditory disability.

Article 151(2) requires regional television broadcasters to make their news bulletins on weekdays from 8 pm accessible to persons with a hearing disability by subtitling. Article 151(2) requires private television broadcasters that air a main news bulletin and hold an average market share of 2% to subtitle that main news bulletin. Article 151(3) requires the Flemish Government to set a timetable and quotas for other subtitling, audio description, sign language and spoken subtitles.

Article 151(4) requires the public broadcaster and the private television broadcasters to send the Flemish Regulator for the Media each year before 31 March a report on how they met paragraphs 1, 2 and 3 in the previous year. Article 151(6) requires television broadcasters to broadcast emergency information, as far as reasonably possible, including announcements in natural disasters, in a way that is accessible to persons with disabilities.

Article 151(7) has the Flemish Regulator for the Media keep an online contact point, easily accessible to persons with disabilities, that gives information on and receives complaints about Article 151. The consolidated text marks Article 151 as in force from .

Article 228 of the Flemish Media Decree lets the general chamber of the Flemish Regulator for the Media impose on any natural or legal person to whom the Decree applies an administrative fine of up to EUR 125,000 for an infringement of the Decree.

What it requires

Flemish Media Decree, Article 214/2 and Annexes 1 to 3, accessibility of terminal equipment and services giving access to television services

Decreet van 27 maart 2009 betreffende radio-omroep en televisie, artikel 214/2 en bijlagen 1 tot 3 (Vlaamse Gemeenschap)Codex Vlaanderen, consolidated text of the Decreet betreffende radio-omroep en televisie of the Flemish Community in Dutch

In force since . Binds public and private bodies.

What this law does

Article 1 of the Flemish Media Decree states that the Decree transposes, among other instruments, Directive (EU) 2019/882.

Article 4(1) of the Directive requires Member States to ensure that economic operators only place on the market products and only provide services that comply with the accessibility requirements in its Annex I. Article 214/2(1) requires terminal equipment with interactive computing capability for access to television services that is placed on the market from to meet Sections 1 and 2 of Annex 1.

Article 214/2(2) requires services providing access to television services that are provided to consumers from to meet Sections 3 and 4 of Annex 1. Article 214/2(2) requires providers of those services to prepare the information required by Annex 2 and explain how the services meet the applicable accessibility requirements.

Article 214/2(2) requires the information to be made available to the public in writing and orally, in a way accessible to persons with disabilities, and kept as long as the service operates. Article 214/2(2) exempts micro-enterprises that offer those services from the accessibility requirements and from every obligation relating to compliance with them.

Article 214/2(3) applies the requirements only to the extent that compliance does not require a significant change resulting in a fundamental alteration of the nature of the terminal equipment or service and does not impose a disproportionate burden on the providers. Article 214/2(3) requires providers to document their assessment and keep the relevant results for five years after the terminal equipment or service was last made available.

Article 214/2(3) requires providers of access services that rely on the disproportionate burden defence to renew the assessment when the service changes, at the regulator's request, and at least every five years. Article 214/2(3) excepts micro-enterprises that deal in terminal equipment from the duty to document their assessment, and requires them to give the Flemish Regulator for the Media the relevant facts on request.

Article 214/2(3) requires providers other than micro-enterprises that rely on the defence for a specific terminal or service to inform the Flemish Regulator for the Media. Article 214/2(4) bars a provider that receives public or private funding for accessibility from relying on the disproportionate burden defence.

Article 214/2(5) lets providers of those services keep using, until , the terminals they lawfully used before that date, and lets service contracts concluded before run unchanged for no more than five years. The consolidated text marks Article 214/2 as in force from .

Article 228, point 4, lets the general chamber of the Flemish Regulator for the Media impose an administrative fine of up to EUR 125,000 on any natural or legal person to whom the Decree applies. Article 228, point 8, lets the general chamber order effective remedial measures to secure compliance with Article 214/2.

What it requires

Flemish decree of 29 March 2024 on e-books and related software, accessibility requirements for e-books

Decreet van 29 maart 2024 over e-boeken en bijbehorende software (Vlaamse Gemeenschap)Text of the decree of the Flemish Community of as published in the Belgisch Staatsblad of

In force since . Binds public and private bodies.

What this law does

Article 2 of the Flemish decree of on e-books and related software states that it partly transposes Directive (EU) 2019/882. Article 2(2)(e) of the Directive brings e-books and dedicated software within its scope as services provided to consumers.

Article 3, point 2, defines an e-book as a service that makes available digital files carrying an electronic version of a book, together with the software, including mobile device services and applications, needed to open, browse, read and use them, other than e-reader software. Article 4(2) requires e-books placed on the market from to meet the accessibility requirements of Sections 1 and 2 of Annex 1.

Article 4(2) requires e-book providers to prepare the information Annex 2 requires, explain how the services meet the requirements, make it available to the public in writing and orally in an accessible way, and keep it as long as the service operates. Article 4(2) exempts micro-enterprises that offer those services from the accessibility requirements and from every obligation relating to compliance with them.

Article 4(3) applies the requirements only where compliance requires no significant change resulting in a fundamental alteration of the e-book and imposes no disproportionate burden on the provider. Article 4(3) requires providers to document the assessment, keep its results for five years after the service was last provided and give the administration a copy on request.

Article 4(3) requires providers other than micro-enterprises that consider the requirements cannot be applied to a specific product or service to inform the administration. Article 4(4) bars a provider that receives public or private funding for accessibility from relying on the disproportionate burden defence.

Article 4(5) lets providers keep using, until , the products they lawfully used before that date, and lets service contracts concluded before run unchanged until at the latest. Article 5(1) punishes anyone who breaches the decree or its implementing decisions with an exclusive administrative fine of at least EUR 5,000 and at most EUR 125,000 per established infringement. Article 5(1) indexes those amounts every 1 January to the health index.

Article 5(2) applies the framework decree on Flemish enforcement of to the enforcement of the decree, and lets authorities or legal persons with a legitimate interest file an enforcement request on behalf of or in support of the persons concerned.

What it requires

French Community decree of 24 April 2025 on the accessibility requirements for digital books

Décret du 24 avril 2025 relatif aux exigences en matière d'accessibilité des livres numériques (Communauté française)Text of the decree of the French Community of as published in the Moniteur belge of

In force since . Binds public and private bodies.

What this law does

Article 1 of the French Community decree of states that it partly transposes Directive (EU) 2019/882. Article 2(2)(e) of the Directive brings e-books and dedicated software within its scope as services provided to consumers. Article 2, point 5, treats as e-book providers the publishers of e-books and the other economic operators associated with their distribution.

Article 3(1) requires e-books placed on the market from to meet the accessibility requirements of Sections 1 and 2 of Annex I. Article 3(1) requires publishers to prepare the information Annex II requires and make it available in writing and orally, keep procedures that keep the service conforming, take corrective measures, inform the Administration of a non-conformity at once and cooperate with it.

Article 3(2) exempts micro-enterprises that publish e-books from the accessibility requirements and from all obligations relating to compliance with them, counting only the book-publishing part of a business with several activities. Article 3(3) requires distributors of e-books to receive, store and send on the publishers' files without compromising their accessibility features or changing their metadata.

Article 3(4) requires e-book retailers to store and supply the files to consumers without compromising their accessibility features, and to pass on faithfully the metadata on their accessibility features. Article 4(1) applies the requirements only to the extent that compliance does not require a significant change that fundamentally alters the nature of the e-book and does not impose a disproportionate burden, and requires a provider relying on that rule to inform the Administration.

Article 4(2) and (3) require providers to support their assessment with evidence, keep the results for five years, give the Administration a copy on request, and renew a burden assessment when the service changes, on request and at least every five years. Article 4(4) bars a provider that receives funding other than its own resources, public or private, to improve accessibility from relying on the disproportionate burden defence.

Article 5 lets any interested person ask the independent out-of-court settlement commission of the decree of on the cultural protection of the book to settle a dispute over the decree. Article 6(1) charges agents designated by the Government, who have the status of judicial police officers, with checking compliance and recording infringements.

Article 6(2) makes an e-book provider that does not meet the accessibility requirements and the obligations relating to them liable to a fine of EUR 100 to EUR 100,000 per infringement. Article 6(2) punishes knowingly incorrect or incomplete statements or information in the burden assessment with imprisonment of four months to five years and a fine of EUR 26 to EUR 50,000, or either of them.

Article 6(2) punishes intentionally obstructing the agents with imprisonment of eight days to six months and a fine of EUR 26 to EUR 200, or either of them. Article 7 applies the decree to e-books placed on the market from , and from to e-books placed on the market before .

What it requires

Law of 5 May 2017 on audiovisual media services in the bilingual Brussels-Capital region, Articles 3/2 to 3/5, 12(1) and 30/1, and the Royal Decree of 13 September 2023, accessibility of audiovisual media services

Wet van 5 mei 2017 betreffende de audiovisuele mediadiensten in het tweetalig gebied Brussel-Hoofdstad artikelen 3/2 tot 3/5, 12, § 1, en 30/1, ingevoegd ter gedeeltelijke omzetting van Richtlijn (EU) 2019/882, en Koninklijk besluit van 13 september 2023 tot vaststelling van de voorschriften en nadere bepalingen inzake toegankelijkheid voor personen met een visuele of auditieve handicap tot de audiovisuele mediadiensten in het tweetalig gebied Brussel-HoofdstadText adopted by the committee, Chamber document 55-3412/003, in Dutch and French

In force since . Binds public and private bodies.

What this law does

Article 2 of the amending Law inserts into the Law of a statement that it partly transposes Directive (EU) 2019/882. Article 4(1) of the Directive requires Member States to ensure that economic operators only provide services that comply with the accessibility requirements in its Annex I. Article 3/2(1) requires audiovisual media services to be made continuously and progressively more accessible, by proportionate measures, to persons with a visual or auditory impairment.

Article 3/2(2) requires emergency information made available to the public through audiovisual media services, including public communications and announcements in natural disasters, to be provided in a way that persons with a visual or auditory impairment can access. Article 3/2(3) requires a single online contact point, easily accessible to the public including persons with a visual or auditory impairment, to provide information and receive complaints on accessibility questions.

Article 3/3(1) requires an audiovisual media service provider to apply procedures that keep its service in line with the accessibility requirements of Articles 12(1) and 30/1. Article 3/3(2) requires the provider to take corrective measures when the service does not conform. Article 3/3(2) also requires the provider to inform the Institute immediately, describing the non-conformity and the corrective measures taken.

Article 3/3(3) requires the provider to cooperate with the Institute on request in any measure taken to ensure conformity. Article 3/4 exempts micro-enterprises from the accessibility requirements of Articles 3/2, 3/3, 12(1) and 30/1 and from every obligation relating to compliance with them.

Article 3/5(1) applies those articles only to the extent that they do not lead to a fundamental alteration of the service and the provider bears no burden that is disproportionate under the criteria the King sets. Article 3/5(2) and (3) require providers to assess the impact of that defence in a reasoned written report and to repeat the assessment when the service changes, at the Institute's request, and at least every five years.

Article 3/5(5) bars a provider that receives public or private funding for accessibility from relying on the disproportionate burden defence. Article 3/5(6) requires a provider that relies on the defence for a specific service to inform the Institute. Article 12(1) as replaced requires providers of audiovisual media services to develop the services in accordance with the accessibility requirements, which the King lays down.

Article 30/1 requires service distributors to make audiovisual media services available at all times in accordance with the accessibility requirements. The Royal Decree of that lays down those accessibility requirements is made under Articles 3/2 to 3/4, 12 and 30/1 of the Law of , as inserted by the Law of . That decree enters into force on .

Article 3 of that decree requires the audiovisual media service provider to give information on how the service works and on its accessibility features through several sensory channels, to make websites and mobile device services, including mobile applications, perceivable, operable, understandable and robust, and to provide accessible support.

Article 4 of that decree requires electronic programme guides that are perceivable, operable, understandable and robust and that give information on the accessibility of the services. Article 4 of that decree also requires full transmission of the access components of audiovisual media services, such as subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation, synchronised with sound and video and adjustable by the user.

Article 10 of the amending Law provides that the Law enters into force on . The Belgian Institute for Postal Services and Telecommunications lists the Law of and the Royal Decree of among the media regulations applicable at the Belgian level.

Article 14(1), point 3, of the Law of on the status of the regulator of the Belgian postal and telecommunications sectors charges the Institute with checking compliance with the Law of and its implementing decrees. Article 21(5) of the Law of lets the Institute's Council, on finding a breach, order it to end, prescribe how it is to be remedied, and impose an administrative fine, with separate maximums for natural and for legal persons.

Article 21(5) of the Law of also lets the Council impose a periodic penalty payment for each day of delay in complying with its decisions. Article 21(6) of the Law of doubles those maximum amounts and percentages where the measures taken have not remedied the breach. Article 21(5) of the Law of sets a separate, lower cap of EUR 125,000 for a breach of Chapter 2 of the Law of . Article 4 of the amending Law inserts Article 3/2 into Chapter 1 of the Law of .

What it requires

Law of 8 May 2024 on the accessibility requirements for transport services, accessibility of websites, apps, e-tickets, travel information and self-service terminals of passenger transport services

Wet van 8 mei 2024 betreffende de toegankelijkheidsvoorschriften voor vervoersdiensten en houdende de oprichting van het Federaal… Agentschap voor de Regulering van Transport, artikelen 1 tot 32 en 60 tot 61Text of the bill adopted by the Chamber of Representatives in second reading and submitted for royal assent

In force since . Binds public and private bodies.

What this law does

Article 2 of the Law of states that the Law partly transposes Directive (EU) 2019/882. Article 3(1) applies the Law to the websites, mobile device services including apps, and electronic tickets and ticketing services of passenger air, bus, rail and waterborne transport services, other than urban, suburban and regional services. Article 3(1) also covers the provision of information on those transport services, including real-time travel information.

Article 3(1) also covers interactive self-service terminals on Belgian territory, other than terminals installed as integral parts of vehicles, aircraft, ships and rolling stock. Article 3(1) applies to urban, suburban and regional rail passenger services only as regards their interactive self-service terminals.

Article 3(2) excludes pre-recorded time-based media and office file formats published before , online maps and mapping services with accessible essential navigation information, third-party content the operator does not finance, develop or control, and archive content. Article 5(1) requires service providers to design and provide their services in accordance with the accessibility requirements in Sections I and II of Annex 1.

Article 5(1) limits urban, suburban and regional rail services to Section I, point a, of Annex 1. Article 5(2) makes functions that Sections I and II do not address accessible through the functional performance criteria in Section III of Annex 1. Article 5(3) exempts micro-enterprises that offer services from the accessibility requirements and from any obligation relating to compliance with them.

Article 6 requires service providers to prepare the information required by Annex 2 and explain how the services meet the applicable accessibility requirements. Article 7(1) requires providers to apply procedures that keep the service in line with the accessibility requirements. Article 7(2) requires providers to take corrective measures at once when the service does not conform, and to inform the control service immediately, describing the non-conformity and the corrective measures.

Article 8 requires providers to give the control service, on its reasoned request, all information and documentation that shows the service conforms, and to cooperate with it. Article 9(1) applies the requirements only to the extent that compliance does not require a significant change of the service that results in a fundamental alteration of its nature. Article 9(1) also applies the requirements only to the extent that compliance does not impose a disproportionate burden on the provider.

Article 9(3) requires providers to keep all relevant results of the assessment for five years after the service was last provided. Article 9(4) requires a provider that relies on the disproportionate burden defence to renew the assessment when the service changes, at the control service's request, and at least every five years. Article 9(5) bars a provider that receives public or private funding for accessibility from relying on the disproportionate burden defence.

Article 10 presumes that services meeting harmonised standards published in the Official Journal of the European Union conform to the Law's accessibility requirements. Article 13 deems services that meet the requirements on accessible information and on information about accessibility of Regulations (EC) No 261/2004, (EC) No 1107/2006, (EC) No 1371/2007, (EU) No 1177/2010 and (EU) No 181/2011, and of the acts adopted under Directive 2008/57/EC, to meet the corresponding requirements of the Law.

Article 13 applies in full any requirement of the Law that goes beyond those regulations and acts. Article 14 requires the King to designate, for each mode of transport, the authority responsible for handling complaints and imposing administrative sanctions for breaches of the Law. Article 19 requires the King to designate the control service, which checks the conformity of services, follows up non-conformity and checks that corrective measures were taken.

Article 15(1) lets any person with a disability lodge a complaint with the competent authority free of charge. Article 16 sets a period of six months from receipt of the complaint for the competent authority to deal with it. Article 22(1) sets four degrees of administrative fine, starting at EUR 1,250 to EUR 2,000 for a first-degree breach, such as failing to give the required information to the traveller.

Article 22(1) sets EUR 2,500 to EUR 4,000 for a second-degree breach, which is a structural failure to put suitable procedures and business processes in place. Article 22(1) sets EUR 5,000 to EUR 8,000 for a third-degree breach, which causes direct and serious harm to the traveller or concerns misuse of external funding. Article 22(1) sets EUR 10,000 to EUR 16,000 for a fourth-degree breach, which obstructs supervision of compliance with the Law.

Article 23(1) lets the authority impose a fine below the minimum amounts where there are mitigating circumstances. Article 23(2) caps the sum of the fines for concurrent breaches at twice the highest maximum. Article 23(3) lets the amounts be doubled on a repeat within the year that follows a final decision imposing an administrative fine. Article 22(2) indexes the fine amounts every 1 January to the health index.

Article 29 provides that, for waterborne passenger transport providers, an administrative fine for a breach of Article 22(1) is imposed under chapter 3 of the Law of instituting administrative fines for breaches of the navigation laws. Article 25 sets a limitation period of three years from the date of the facts for imposing an administrative fine.

Article 60 lets providers keep using, until , the products they lawfully used before that date, and lets service contracts concluded before run unchanged for no more than five years. Article 60(2) lets self-service terminals of air passenger transport providers that were lawfully in use before stay in use until the end of their economic life, and for no more than twenty years after they entered use.

Article 61 provides that, apart from the articles of Title VIII that take effect on , the Law enters into force on .

What it requires

Royal Decree of 1 October 2023 on the accessibility requirements for products

Koninklijk besluit van 1 oktober 2023 betreffende de toegankelijkheidsvoorschriften voor productenText of the Koninklijk besluit of 1 oktober 2023 betreffende de toegankelijkheidsvoorschriften voor producten as published in the Belgisch…

In force since . Binds public and private bodies.

What this law does

Article 1 of the decree states that it partly transposes Directive 2019/882/EU. The decree is made under Article VIII.57 of the Code of Economic Law. Article 4(1) of the Directive requires Member States to ensure that economic operators only place on the market products that comply with the accessibility requirements in its Annex I. Article 3(1) applies the decree to the products it lists that are not radio equipment as the Law of defines it.

Article 3(1) lists general-purpose consumer computer hardware, payment terminals, cash machines, ticketing machines, check-in machines, interactive information self-service terminals, consumer terminal equipment for electronic communications services and for access to audiovisual media services, and e-readers, placed on the market after . Article 2, point 11, defines an economic operator as a manufacturer, authorised representative, importer, distributor or service provider.

Article 4 requires economic operators to place on the market only products that meet the accessibility requirements in Annex 1. Article 4 requires all products to meet Section I of Annex 1, and all products except self-service terminals to meet Section II. Article 5(1) requires manufacturers to ensure that their products are designed and manufactured in accordance with the applicable accessibility requirements.

Article 5(2) requires manufacturers to draw up the technical documentation and carry out the conformity assessment, then to draw up an EU declaration of conformity and affix the CE marking. Article 5(3) requires manufacturers to keep the technical documentation and the EU declaration of conformity for five years after the product is placed on the market.

Article 5(8) requires a manufacturer that has reason to believe a product does not conform to take corrective measures at once, and to inform the market surveillance authorities. Article 7(1) requires importers to place only conforming products on the market. Article 8(1) requires distributors that make a product available to act with due care in relation to the requirements of the decree.

Article 9 treats an importer or distributor as the manufacturer when it places a product on the market under its own name or trademark. Article 11(1) applies the requirements only to the extent that compliance does not require a fundamental alteration of the product and does not impose a disproportionate burden on the operators. Article 11(3) requires operators to document the assessment and keep the results for five years after the product was last made available.

Article 11(4) lets the market surveillance authorities, on a reasoned request, exempt micro-enterprises from the documentation duty. Article 14(4) of the Directive exempts microenterprises dealing with products from the requirement to document their assessment. Article 11(5) bars an operator that receives public or private funding for accessibility from relying on the disproportionate burden defence.

Article 11(6) requires an operator that relies on the defence for a specific product to give the market surveillance authorities the information they need to examine it. Article 14(8) of the Directive excepts microenterprises from the duty to send the market surveillance authorities information on reliance on the defence.

Article 12 presumes that products meeting harmonised standards, or parts of them, published in the Official Journal of the European Union conform to the accessibility requirements to the extent the standards cover them. Article 2, point 27, designates the Directorate-General for Energy of the Federal Public Service Economy as the Belgian market surveillance authority.

Article XV.18/7(1) of the Code of Economic Law requires the officials designated under Article XV.2 to call on the operator to end a non-conformity that they find. Article XV.18/7(2) lets the minister or the minister's delegate restrict or prohibit making the product available, or have it withdrawn from the market, if the defect continues. Article XV.99/1 punishes breach of the decrees made under Article VIII.57 with a level 2 sanction, and a bad-faith breach with a level 3 sanction.

The explanatory memorandum to that Law equates a level 2 sanction with an administrative or criminal fine of EUR 208 to EUR 80,000. The memorandum gives for a level 2 sanction a settlement of EUR 26 to EUR 60,000 under the Royal Decree of . The memorandum gives for a level 3 sanction an administrative or criminal fine of EUR 208 to EUR 200,000 or a settlement of EUR 26 to EUR 150,000.

Article XV.18/5(1) lets any person lodge a complaint about the accessibility of products and services free of charge with the officials designated under Article XV.2. Article XV.62/7 lets the officials designated under Article XV.60/4, who impose the administrative fine, decide that it is not executed, or only in part, if the offender carries out the corrective measures they set. The explanatory memorandum to the Law of places Article VIII.57 in Title 4 of Book VIII of the Code.

Article 36 of the Law of adds Titles 4 and 5 of Book VIII to the provisions listed in Article XVII.37, point 1, of the Code. The explanatory memorandum to that Law says that it inserts into Book XVII the possibility of an action for collective redress.

A bill on various economic provisions adds to Article I.9/1 of the Code a definition of product as a substance, preparation or good produced through a manufacturing process, other than food, feed, living plants and animals, products of human origin and products of plants and animals relating directly to their future reproduction. The Chamber adopted that bill in plenary on and submitted it for royal assent.

What it requires

Walloon decree of 16 February 2023 on the accessibility requirements for interactive self-service terminals of urban, suburban and regional transport

Décret du 16 février 2023 relatif aux exigences d'accessibilité applicables aux terminaux en libre-service interactifs des transports… urbains, suburbains et régionaux (Région wallonne)Text of the decree of the Walloon Region of as published in the Moniteur belge of

In force since . Binds public and private bodies.

What this law does

Article 1 of the Walloon decree of states that it partly transposes Directive (EU) 2019/882. Article 2(2)(c) of the Directive brings urban, suburban and regional transport services within its scope only for their interactive self-service terminals.

Article 3 applies the decree to urban, suburban and regional transport services other than rail, provided to consumers after , as regards interactive self-service terminals on the territory of the Walloon Region, other than terminals installed as integral parts of vehicles and rolling stock. Article 2, point 14, defines interactive self-service terminals as vending machines that let the customer carry out every stage of the sale, up to the delivery of the transport tickets.

Article 2, point 5, defines a service provider as any natural or legal person that provides a service on the Union market or offers to provide one to consumers in the Union. Article 4(1) requires economic operators to place on the market only services that meet the accessibility requirements of Section 1 of Annex 1. Article 4(2) exempts micro-enterprises that offer services from the accessibility requirements and from all obligations relating to compliance with them.

Article 5 deems services that meet the accessible-information requirements of Regulations (EC) No 261/2004, (EC) No 1107/2006, (EC) No 1371/2007, (EU) No 1177/2010 and (EU) No 181/2011, and of the acts adopted under Directive 2008/57/EC, to meet the corresponding requirements of the decree.

Article 7(1) and (2) require service providers to design and provide services in line with Article 4, prepare the information that Annex 3 requires, and make it available to the public in writing and orally, including in a way accessible to persons with disabilities. Article 7(4) requires providers to bring a non-conforming service into conformity and to inform the competent authority of the Walloon Region immediately.

Article 8(1) applies the requirements only to the extent that compliance does not require a significant change that fundamentally alters the nature of the service and does not impose a disproportionate burden on the operators. Article 8(3) requires operators to support their assessment with evidence and to keep the relevant results for five years after the service was last provided.

Article 8(5) bars an operator that receives funding other than its own resources, public or private, to improve accessibility from relying on the disproportionate burden defence. Article 8(6) requires operators that rely on the exception for a specific service to inform the authorities, and does not apply that duty to micro-enterprises.

Article 9 presumes that services meeting harmonised standards published in the Official Journal of the European Union conform to the decree's accessibility requirements to the extent the standards cover them. Article 10 requires the Government to designate the authorities that check the conformity of services and to lay down the complaint procedure.

Article 11 makes the requirements of Annex 1 binding accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU, Article 60(1) of Directive 2014/25/EU and Article 53 of the Law of on public procurement. Article 13(1) lets an administrative fine be imposed on economic operators, from EUR 10,000 to EUR 16,000 for failing to design and provide conforming services and from EUR 1,250 to EUR 2,000 for failing to supply the information the authority asks for.

Article 13(1) sets EUR 5,000 to EUR 8,000 for a breach of the information duty or of the duty to correct and report a non-conformity, and EUR 2,500 to EUR 4,000 for a breach of the procedures duty or of Article 8. Article 13(3) caps the total of the fines for concurrent breaches at twice the heaviest maximum fine. Article 13(4) sets the fine for a repeat of the same breach within two years at no less than twice the earlier fine, unless the authority finds mitigating circumstances.

Article 13(6) leaves the procedure for imposing a fine and for appeals to the Government. Article 14 lets providers keep using, until , the products they lawfully used for similar services, lets service contracts agreed before run unchanged for no more than five years, and lets self-service terminals used before stay in use until the end of their economic life, but not after . Article 15 brings the decree into force on .

What it requires

Procurement conditions

Law of 17 June 2016 on public procurement, Articles 53(1) and 133, point 3, accessibility criteria in the technical specifications of contracts for use by natural persons, in the classical and special sectors

Loi du 17 juin 2016 relative aux marchés publics, article 53, § 1er, et article 133, 3°Justel consolidated text of the Loi du 17 juin 2016 relative aux marchés publics in French

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2016/06/17/2016021053/justel

In force since . Binds public and private bodies.

What this law does

Article 53(1) of the Law of requires the contracting authority to draw up the technical specifications of every public contract intended for use by natural persons, whether the general public or the authority's staff, so as to take account of accessibility criteria for persons with disabilities or design for all users. Article 53(1) allows the contracting authority to depart from that rule only in duly justified cases.

Article 53(1) requires the technical specifications to be defined by reference to binding accessibility requirements adopted by a legal act of the European Union. Article 133, point 3, applies Article 53 to the public contracts in the special sectors covered by Title 3 of the Law.

Article 24(1) of the Directive makes the accessibility requirements of its Annex I, for the products and services it covers, mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU and Article 60(1) of Directive 2014/25/EU. The Justel consolidation records that, for contracts under Title 2 on public contracts in the classical sectors, the articles of the Law not yet in force took effect on .

The Justel consolidation records the same day, , for contracts under Title 3 on public contracts in the special sectors.

What it requires

Age gating law3 instruments, 3 in force

Research summary (195 words)

Belgium has no social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code. The Flemish Community's Mediadecreet requires a video-sharing platform provider under its jurisdiction to set up and use age verification systems for content that could impair the development of minors, in Article 176/4.

The minor's digital-consent age for information-society services is set by the Act of on the protection of personal data, and is described in this jurisdiction's privacy-topic record rather than repeated here.

Belgium's Penal Code criminalises producing or distributing extremely pornographic or violent content, with an aggravated tier where it is directed at a minor or a vulnerable person, but that prohibition binds the conduct itself rather than imposing an age-verification or age-gating duty on a service. The French Community's decree of requires a video-sharing platform provider under its jurisdiction to set up a system to verify the age of the user, in Article 2.5-2.

The German-speaking Community regulates audiovisual media and video-sharing platforms through its own decree, which transposes the Audiovisual Media Services Directive for providers under its jurisdiction, through Article 32 of its decree of , which has its own row.

Adult content age verification (AV)

Dekret über die Mediendienste und die Kinovorstellungen (German-speaking Community), Article 32, obligations of video-sharing platform providers

Dekret vom 1. März 2021 (Deutschsprachige Gemeinschaft), Art. 32Medienrat der Deutschsprachigen Gemeinschaft

In force since . Binds private bodies.

What this law does

A video-sharing platform provider under the jurisdiction of the German-speaking Community must take appropriate measures to protect minors from programmes, user-generated videos and audiovisual commercial communication that could impair their physical, mental or moral development. Those measures include, where appropriate, systems to verify the age of the platform's users for that content. They also include parental control systems managed by the end user.

The most harmful content is subject to the strictest access-control measures. Personal data of minors collected for age verification and parental control may not be used for commercial purposes such as direct marketing, profiling or behavioral advertising. A video-sharing platform provider not itself established in the German-speaking area is treated as established there when it has a parent or subsidiary company established there or belongs to a group with a company established there.

The Media Council (Medienrat) sets the mechanisms for assessing whether the providers' measures are appropriate. The Media Council can impose an administrative fine of up to 25,000 euros, which is set at 5 percent of annual turnover excluding tax where the breach is repeated within five years. The decree entered into force on the day of its publication in the Belgian State Gazette.

What it requires

Décret relatif aux services de médias audiovisuels et aux services de partage de vidéos (French Community), Article 2.5-2, measures by video-sharing platform providers

Décret du 4 février 2021 (Communauté française), art. 2.5-2Centre de documentation administrative of the Fédération Wallonie-Bruxelles (Gallilex), consolidated text of the decree

In force since . Binds private bodies.

What this law does

A video-sharing platform provider under the jurisdiction of the French Community must take appropriate measures to protect minors from programmes and user-generated videos that could harm their physical, mental or moral development. Those measures include a system to verify the age of the user and a parental control that the user controls. The most harmful content, such as pornography and gratuitous violence, is subject to the strictest access-control measures.

Personal data of minors collected or generated under these measures may not be used for commercial purposes such as direct marketing, profiling or behavioral advertising. A provider falls under the jurisdiction of the French Community when it is established in the French-language region, or in the bilingual Brussels-Capital region where its activity belongs exclusively to the French Community. The Collège d'autorisation et de contrôle assesses whether the measures providers take are appropriate.

It can impose an administrative fine of at least 250 euros and at most 3 percent of annual turnover excluding tax, or 5 percent where the breach is repeated within five years. The decree entered into force on the twentieth day after its publication in the Moniteur belge.

What it requires

Mediadecreet (Flemish Decree of 27 March 2009 on radio broadcasting and television), Article 176/4, measures by video-sharing platform providers

Mediadecreet, art. 176/4Vlaamse Codex, consolidated text of the Decreet betreffende radio-omroep en televisie

In force since . Binds private bodies.

What this law does

A video-sharing platform provider under the jurisdiction of the Flemish Community must take appropriate measures to protect minors from programmes, user-generated content and commercial communication that could impair their development. Those measures include setting up and using systems to verify the age of the platform's users for that content.

Programmes, user-generated content and commercial communication showing pornographic images or images of gratuitous violence must be offered encrypted or placed under effective parental control. A provider falls under the jurisdiction of the Flemish Community when it is established in the Dutch language region, or in the bilingual Brussels-Capital region where its activities belong exclusively to the Flemish Community.

An infringement of the decree can bring an administrative fine of up to 125,000 euros. The Flemish Regulator for the Media supervises whether providers take these measures and apply them.

What it requires

Reuse law1 instrument, 1 in force

Research summary (158 words)

Belgium transposed the EU press-publisher neighbouring right, Article 15 of Directive (EU) 2019/790, into Article XI.216/2 of the Code of Economic Law by the Act of , giving a press publisher established in an EU member state an exclusive online reproduction and making-available right, subject to a good-faith negotiation duty and a dispute-resolution avenue before the Belgian Institute for Postal Services and Telecommunications (BIPT), and exempting hyperlinks, isolated words, and very short extracts.

Belgium has no compelled platform-to-publisher bargaining regime comparable to Australia's News Media Bargaining Code or Canada's Online News Act; the BIPT mechanism can fix remuneration once a dispute is referred to it, but nothing compels a platform to strike a deal in the first place. A text-and-data-mining opt-out exception exists in the same Code, inserted by the same 2022 Act at Article XI.190, 20°.

No hot-news or misappropriation doctrine distinct from ordinary unfair-competition law, and no reported decision construing Article XI.216/2, is identified.

Press publishers' right

Code de droit économique, article XI.216/2, droit voisin des éditeurs de presse

Code de droit économique art. XI.216/2, inséré par la loi du 19 juin 2022 transposant partiellement la directive (UE) 2019/790, art. 15 (Moniteur belge, 1 août 2022)Belgian Official Gazette, text of the Act of amending the Code of Economic Law

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.ejustice.just.fgov.be/eli/loi/2022/06/19/2022015053/justel

In force since . Binds private bodies.

What this law does

A press publisher established in an EU member state has the sole right to reproduce its press publication and to make it available online for use by an information-society service provider, per Article XI.216/2, paragraph 1.

The publisher and the service provider must negotiate in good faith over that use and the remuneration due, and either may refer an unresolved dispute to the Belgian Institute for Postal Services and Telecommunications, which can decide the remuneration and take a binding administrative decision.

A service provider must give the publisher updated, relevant, and complete information on the number of consultations and the revenue it draws from the publications, on the publisher's written request, so the publisher can value the right, and authors of works integrated into a press publication are entitled to an appropriate, non-transferable share of what publishers collect for the use, set by a collective agreement.

The right does not reach hyperlinking, the use of isolated words or very short extracts of a press publication, or works whose protection has expired. It expires two years after the press publication was published, counted from 1 January of the following year, per Article XI.216/3. Article XI.216/2 does not apply to a press publication first published before , per Article 99 of the Act.

What it requires

Where nothing was found1 area of law

These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.

AI law

The EU AI Act (Regulation (EU) 2024/1689) applies directly in Belgium and is not restated here as Belgian law. Belgium's 2025-2029 federal government coalition agreement named the Belgian Institute for Postal Services and Telecommunications (BIPT) as the intended lead national competent authority and market-surveillance authority under the Act.

The Act's date for that designation was , and as of the date below no statute or royal decree has been enacted giving BIPT, or any other body, that role or setting a domestic penalty framework. No Belgium-specific AI-transparency, output-labelling, or AI-generated-content criminal statute distinct from the EU AI Act and the general Penal Code has been located.

As of .

Case law

  • No current case law for Belgium AI law
  • No current case law for Belgium privacy law
  • No current case law for Belgium scraping law
  • No current case law for Belgium cybersecurity law
  • No current case law for Belgium communications law
  • No current case law for Belgium content moderation law
  • No current case law for Belgium product and AI liability law
  • No current case law for Belgium digital accessibility law
  • No current case law for Belgium age gating law
  • No current case law for Belgium reuse law

Reporting clocks that run here21 instruments

The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Belgium comes first, then the law of the bodies above it that applies here.

Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.

48 hours
Serious-incident reporthigh-risk AI law
10 days
Serious-incident reporthigh-risk AI law
14 days
Final reportsecurity law
15 days
Serious-incident reporthigh-risk AI law
1 month
Final reportsecurity law
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.

The law of Belgium

24 hours72 hours1 month

Loi du 26 avril 2024, Significant-Incident Notification Obligations

Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la… sécurité publique, Artt. 34-37security law, in force since

The sentences the clocks are read from

Notify the national computer security incident response team (CSIRT) of any significant incident without undue delay, following the arrangements set out in the protocol between the CSIRT and the National Crisis Centre.

Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact.

Follow with an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise.

Submit an interim report if the national computer security incident response team (CSIRT) or the competent sectoral authority asks for one, and a final report no later than one month after the incident notification, describing the incident in detail, its severity and impact, the likely threat or root cause, the mitigation measures applied and in progress, and any cross-border impact.

If the incident is still ongoing when the final report falls due, submit a progress report at that point, followed by a final report within one month of the final handling of the incident (Article 35, paragraph 1, point 5).

If you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant incident that affects your trust services (Article 35, paragraph 2).

72 hours

GDPR Articles 33-34, Breach Notification

Regulation (EU) 2016/679, Arts. 33-34privacy law, in force since

The sentences the clocks are read from

Notify the GBA/APD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Belgium, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).

The law of the European Union, which applies in Belgium

4 hours

Commission Delegated Regulation (EU) 2024/1366, Cybersecurity Network Code for Cross-Border Electricity Flows: Information Sharing on Cyber-Attacks and Threats

Commission Delegated Regulation (EU) 2024/1366, Art. 38security law, in force since

The sentences the clocks are read from

Share relevant information related to a reportable cyber-attack with your computer security incident response teams (CSIRTs) and your competent authority without undue delay and no later than four hours of becoming aware that the incident is reportable; a cyber-attack is reportable when you assess its criticality as ranging from high to critical on the classification scale methodology under Article 37(8) (Article 38(3) and (4)).

Provide your computer security incident response teams (CSIRTs) without undue delay with any information related to a reportable cyber threat that may have a cross-border effect (Article 38(6)).

4 hours24 hours72 hours1 month

DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301

Regulation (EU) 2022/2554, Article 19security law, in force since

The sentences the clocks are read from

Report a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it.

Where classification as major comes later than that, submit the initial notification within four hours of the classification instead.

Submit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities.

Submit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures.

If you cannot meet one of those deadlines, tell the competent authority without undue delay and before the deadline lapses, explaining why. A deadline falling on a weekend or bank holiday moves to noon of the next working day, unless you are a credit institution, a central counterparty, a trading venue operator, or an entity your Member State has designated essential or important under the NIS2 Directive, none of which get that extension for an initial notification or intermediate report.

Your competent authority may also decide, and notify you, that the extension does not apply to you if you are a financial entity that is significant or has a systemic character for the financial sector at national or Union level.

Notifying a significant cyber threat under Article 19(2) is voluntary, only where you judge it relevant to the financial system, service users, or your clients. Where a major ICT-related incident affects your clients' financial interests, tell them without undue delay as soon as you become aware of it, describing the incident and the mitigation measures you took, and, for a significant cyber threat, tell a potentially affected client of protection measures it could take, where applicable.

24 hours3 days

Commission Regulation on Personal Data Breach Notification by Electronic Communications Providers (Regulation (EU) No 611/2013)

Regulation (EU) No 611/2013privacy law, in force since

The sentences the clocks are read from

If you provide a publicly available electronic communications service, notify every personal data breach to the competent national authority (Article 2(1)), no later than 24 hours after its detection, where feasible, with the information set out in Annex I; detection is deemed to have taken place when you have acquired sufficient awareness that a security incident has occurred that led to personal data being compromised (Article 2(2)).

Where all the information in Annex I is not available and further investigation is required, you may make an initial notification no later than 24 hours after detection containing the information in Section 1 of Annex I, and you must then make a second notification as soon as possible and at the latest within three days following the initial notification, containing the information in Section 2 of Annex I (Article 2(3)).

If you cannot provide all the information within the three-day period, notify as much as you have within it, submit to the competent national authority a reasoned justification for the late notification of the remaining information, and notify the remaining information as soon as possible (Article 2(3)).

Notify the subscriber or individual without undue delay after detection of the breach, whether or not you have yet notified the competent national authority (Article 3(3)).

If you have a direct contractual relationship with the end user and, despite reasonable efforts, cannot identify within the timeframe all the individuals likely to be adversely affected, you may notify them through advertisements in major national or regional media in the relevant Member States within that timeframe, containing the Annex II information where necessary in a condensed form, and you must continue all reasonable efforts to identify and notify them as soon as possible (Article 3(7)).

If you are contracted to deliver part of the electronic communications service without a direct contractual relationship with subscribers, immediately inform the contracting provider in the case of a personal data breach (Article 5).

24 hours72 hours14 days1 month

Cyber Resilience Act, Manufacturer Reporting Obligations

Regulation (EU) 2024/2847, Art. 14security law, in force since

The sentences the clocks are read from

Notify the computer security incident response team (CSIRT) designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided.

Notify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification; the incident notification and the final report each apply unless the relevant information has already been provided. For either an exploited vulnerability or a severe incident, give the computer security incident response team (CSIRT) an intermediate report on relevant status updates if it asks for one.

24 hours72 hours1 month

NIS2 Directive, Reporting Obligations

Directive (EU) 2022/2555, Art. 23security law, in force since

The sentences the clocks are read from

Notify your computer security incident response team (CSIRT), or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.

Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.

48 hours

AI Act, Article 26(10) (post-remote biometric identification authorisation)

Regulation (EU) 2024/1689, Article 26(10)high-risk AI law, not yet in force, from

The sentence the clocks are read from

If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.

2 days10 days15 days

AI Act, Article 73 (reporting of serious incidents)

Regulation (EU) 2024/1689, Article 73high-risk AI law, not yet in force, from

The sentences the clocks are read from

Report a serious incident not later than 15 days after you become aware of it, or immediately once you establish a causal link between your AI system and the incident, or the reasonable likelihood of one, whichever is sooner.

Report immediately, and not later than 2 days after becoming aware of it, a widespread infringement or a serious incident causing a serious and irreversible disruption to the management or operation of critical infrastructure.

Report a serious incident involving the death of a person not later than 10 days after becoming aware of it, and immediately once you establish, or suspect, a causal link between your AI system and the incident.

If you are a deployer of a high-risk AI system and identify a serious incident, Article 26(5) requires you to immediately inform first the provider, then the importer or distributor, and the relevant market surveillance authority; if you cannot reach the provider, report the incident yourself under the same rules that bind a provider. This does not require you to disclose sensitive operational data if you are a law enforcement authority.

After reporting a serious incident, without delay investigate it, including a risk assessment and corrective action, and cooperate with the competent authorities; do not alter the AI system in a way that could affect the investigation before telling the authorities.

2 days10 days15 days

AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)

Regulation (EU) 2024/1689, Articles 60 and 61high-risk AI law, in force since

The sentences the clocks are read from

Let a subject, or the subject's legally designated representative, withdraw from the testing at any time by revoking informed consent, without detriment and without having to provide any justification, and on request delete the subject's personal data immediately and permanently; the withdrawal does not affect the activities already carried out (Article 60(5)).

Report any serious incident identified in the course of the testing to the national market surveillance authority in accordance with Article 73, which requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after you become aware of the incident, not later than two days for a widespread infringement or a serious and irreversible disruption of the management or operation of critical infrastructure, and not later than 10 days after you become aware of it where a person has died (Article 60(7)).

72 hours

Commission Delegated Regulation (EU) 2022/1645, External Reporting of Information Security Incidents and Vulnerabilities (IS.D.OR.230)

Commission Delegated Regulation (EU) 2022/1645, IS.D.OR.230security law, in force since

The sentence the clocks are read from

Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.D.OR.230(c), points (1) and (2)).

72 hours

Commission Implementing Regulation (EU) 2023/203, External Reporting of Information Security Incidents and Vulnerabilities in Aviation (IS.I.OR.230)

Commission Implementing Regulation (EU) 2023/203, IS.I.OR.230security law, in force since

The sentence the clocks are read from

Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.I.OR.230(c), points (1) and (2)).

3 days

European Health Data Space Regulation, Serious-Incident Reporting by Manufacturers of EHR Systems

Regulation (EU) 2025/327, Art. 44(7)security law, not yet in force, from

The sentence the clocks are read from

Make the report immediately after you have established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link and, in any event, not later than three days after you become aware of the serious incident (Article 44(7)).

immediately

AI Act, Article 20 (corrective actions and duty of information)

Regulation (EU) 2024/1689, Article 20high-risk AI law, not yet in force, from

The sentence the clocks are read from

Where the system presents a risk to the health or safety, or to fundamental rights, of persons within the meaning of Article 79(1) and you become aware of that risk, immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued its certificate under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.

immediately

AI Act, Article 22 (authorised representative of a provider established in a third country: appointment, mandate, tasks and termination)

Regulation (EU) 2024/1689, Article 22(1), (2), (3) except points (b) and (c), and (4)high-risk AI law, not yet in force, from

The sentence the clocks are read from

Terminate the mandate if you consider or have reason to consider that the provider is acting contrary to its obligations under the Regulation, and immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body of the termination and the reasons for it (Article 22(4)).

without undue delay

AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring)

Regulation (EU) 2024/1689, Article 26(1) to (5)high-risk AI law, not yet in force, from

The sentences the clocks are read from

Where you have reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, inform the provider or distributor and the relevant market surveillance authority without undue delay, and suspend use of the system.

Where you have identified a serious incident, immediately inform first the provider, then the importer or distributor and the relevant market surveillance authorities; if you cannot reach the provider, report the incident yourself as Article 73 requires of a provider.

without undue delay

AI Act, Article 55 (obligations for providers of general-purpose AI models with systemic risk)

Regulation (EU) 2024/1689, Article 55frontier-model AI law, in force since

The sentence the clocks are read from

Keep track of, document, and report to the AI Office, and as appropriate to national competent authorities, without undue delay, relevant information about serious incidents involving your model and any corrective measures you have taken or plan to take. The Regulation states no fixed number of days for this report and no explicit moment its clock starts from, only that it must be made without undue delay.

without undue delay

ePrivacy Directive, Article 4(3) to (5), Personal Data Breach Notification

Directive 2002/58/EC, Art. 4(3)-(5)privacy law, in force since

The sentences the clocks are read from

If you provide a publicly available electronic communications service and a personal data breach occurs, notify the breach to the competent national authority without undue delay (Article 4(3)).

Where the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, also notify that subscriber or individual of the breach without undue delay (Article 4(3)).

Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

This page covers the instruments LexLint has researched to a stage. Instruments named in the law library but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.