NIS2 goes into effect April 18.
Is your SME ready?

NIS2 applies to any entity operating in one of the 18 critical sectors (energy, transport, health, banking, water, digital, food, public administration, industry, etc.) that exceeds the medium enterprise thresholds (50+ employees or 10 M€ revenue). Suppliers and subcontractors of these entities are also affected indirectly, as their clients will request contractual guarantees.

Essential entities risk up to 10 million euros or 2% of annual global revenue. Important entities risk up to 7 million euros or 1.4% of revenue. The higher amount applies. Executives can also be held personally liable, with possible temporary suspension of their duties.

The cost varies depending on the SME's size and current maturity level. For a 20-50 employee SME with a sound IT base, the budget typically starts between 3,000 and 15,000 € for initial implementation, then 100 to 400 €/month for ongoing supervision. The free audit gives you a precise estimate tailored to your context.

No, NIS2 does not require a DPO (Data Protection Officer), which remains a GDPR obligation. However, NIS2 does require that an information security officer be clearly designated within the organisation, and that executive management assumes direct responsibility for validating cyber risk management measures.

GDPR protects personal data. NIS2 protects the continuity and security of essential services against cyberattacks. Both are complementary and mandatory. If you are already GDPR compliant, part of the work is done (registry, notification procedures), but NIS2 adds further technical and organisational requirements.

Don't panic, but act immediately. Belgian authorities prioritise entities that demonstrate an active compliance process. The urgency is to document a credible action plan with short milestones. That is exactly what our free audit delivers in 30 minutes: a concrete plan you can present in case of inspection.