NIS2 and Belgian local authorities: who is in scope

The Belgian law that transposes the EU NIS2 directive raises the cybersecurity bar for many public and private organisations. Local authorities often ask the same question: does it apply to our municipality? The short answer is not automatically. It depends on the activities carried out, the size of the entity and any identification by the Centre for Cybersecurity Belgium (CCB).

This guide helps you work through the analysis. It does not replace advice from the CCB or from a lawyer.

The Belgian framework

The law of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security, published in the Belgian Official Gazette on 17 May 2024 and in force since 18 October 2024.
The royal decree of 9 June 2024 implementing it, published on 24 June 2024. Among other things, it organises conformity assessment.
The CCB, the national cybersecurity authority. It registers entities, receives incident notifications through the national CSIRT and supervises.

The law distinguishes essential entities from important entities. They share the same core obligations; the difference lies mainly in how closely they are supervised and sanctioned.

Local authorities are not automatically in scope

The "public administration" sector in Annex I covers bodies that depend on the federal State, and bodies that depend on the federated entities once they have been identified. The parliamentary preparatory works state that local authorities are not part of it. The CCB's FAQ, as quoted by the association of Walloon municipalities (UVCW), confirms this: local public administrations (municipalities, provinces, inter-municipal companies, CPAS/OCMW, municipal companies) are not automatically subject to the law.

The law adds two useful points:

rescue zones and the Brussels fire and emergency medical service are expressly covered;
police services, including police zones, are excluded.

Three ways into scope

A local authority can still be covered in three ways.

1. A listed activity and sufficient size. The law applies to public or private entities that carry out an activity listed in Annex I or II and are at least a medium-sized enterprise under EU Recommendation 2003/361/EC (as a rule, from 50 staff or above certain financial thresholds). According to the UVCW, headcount covers all staff, teachers included. Its analysis and the CCB's FAQ point to several activities that may concern a municipality or a CPAS/OCMW:

drinking water distribution, wastewater or waste management, where these form an essential part of the entity's activity;
operating electric vehicle charging points, if the entity manages and operates them itself;
electricity production, including solar panels connected to the grid;
district heating;
healthcare, for example a care home run by a CPAS/OCMW;
operating an intelligent transport system.

Once a listed activity is carried out and the size threshold is met, the whole entity is in scope, for all its network and information systems.

2. Identification by the CCB. Whatever its size, an entity may be identified as essential or important, for example if it is the sole provider of an essential service or if a disruption could seriously affect public security or public health. According to the UVCW, when it updated its analysis in 2026, no local authority had yet been identified in this way.

3. Identification as a critical entity under the law of 19 December 2025 on the resilience of critical entities, which also brings the NIS2 law into play.

The UVCW notes that inter-municipal companies are the category of local bodies most often concerned, because of their activities and size.

If your entity is in scope

The main obligations are:

register with the CCB within five months of the law's entry into force or of identification;
take proportionate risk-management measures based on an all-hazards approach, covering among other things business continuity, backups, disaster recovery and crisis management;
have these measures approved and overseen by the management body, whose members must follow training;
notify significant incidents to the national CSIRT: early warning within 24 hours, incident notification within 72 hours, final report within one month;
for essential entities, undergo conformity assessment in stages set at 18 and 30 months after the law's entry into force or after identification. For important entities, periodic assessment is voluntary.

For some entities, such as care homes, the CCB's FAQ quoted by the UVCW considers a lower assurance level (for example Basic) proportionate.

CyberFundamentals (CyFun)

CyberFundamentals (CyFun) is the CCB's reference framework. The royal decree of 9 June 2024 requires it to include at least three assurance levels: Basic, Important and Essential. An essential entity may use CyFun or the ISO/IEC 27001 standard to demonstrate conformity.

For a municipality that is not in scope, CyFun is still a practical yardstick. You can start with a self-assessment at Basic level, prioritise the key measures and track progress year after year. The UVCW also points out that an entity that considers itself out of scope can register voluntarily with the CCB to use its free services, without becoming subject to the obligations.

What about the regions?

The regions may set their own expectations for local authorities.

Flanders: on 24 April 2026 the Flemish Government approved a digital security policy strategy that also covers local authorities. The Flemish Centre for Digital Security monitors it, acts as regional CSIRT and central contact point for cyber incidents, and issues implementation guidelines based on ISO/IEC 27001 and CyFun.
Wallonia: the UVCW mentions a Walloon Cyber Response Team set up by the Digital Agency (Agence du Numérique) with the CCB.
Brussels: we found no official source on specific regional obligations.

In every case, check with your region what applies to your municipality.

Assess your own status

The observatory never states that a municipality is subject to NIS2: each local authority assesses its own status. A simple approach:

List all activities of the municipality, the CPAS/OCMW and municipal companies, including secondary ones (solar panels, charging points, care home).
Compare them with Annexes I and II of the law.
Check the size criterion for each legal entity.
Use the scope test tool offered by the CCB.
Record the analysis and conclusion in a note approved by management.
Review the analysis every year and whenever a new activity starts.
If in doubt, ask the CCB or your association of local authorities.

Whether or not your municipality is in scope, its services depend on IT: the municipal continuity guide covers the IT recovery plan and cyber incident response.