NIS2: does it apply to my medical practice or my SME?

The CCB's three conditions

The law of 26 April 2024 transposes the European NIS2 directive into Belgian law. It has applied since 18 October 2024 and the CCB is the competent authority. According to the CCB, an organisation is in principle covered if it meets three conditions at once:

1. It provides a service listed in the annexes of the law. Healthcare is one of them, including healthcare providers.
2. It is at least the size of a medium-sized enterprise: at least 50 full-time workers, or an annual turnover and an annual balance sheet total above 10 million euros.
3. It is established in Belgium.

The one-minute summary is on our page NIS2, in plain words. To settle your own case, the CCB offers a free tool, the « NIS2 Scope Test Tool », on Safeonweb@Work. The three situations below are where a small practice or SME often wrongly assumes NIS2 does not concern it.

Is your practice part of a group? Then the group's size counts

The threshold of 50 workers or 10 million euros is not always measured company by company. The CCB points this out: when an organisation is part of a group (« partner enterprises » or « linked enterprises »), the figures of the group's companies are consolidated.

A group of clinics or centres can therefore exceed the thresholds even when each site, on its own, stays small. The exact calculation follows European recommendation 2003/361/EC on the size of enterprises: do it with your accountant, on your real figures, before concluding that NIS2 does not concern you.

Can the CCB designate a small practice?

Yes, whatever its size. Article 11 of the law allows the CCB to identify an organisation as an essential or important entity in four cases:

• it is the sole provider in Belgium of an essential service;
• a disruption at the organisation could have a significant impact on public safety, public security or public health;
• a disruption at the organisation could create a significant systemic risk;
• it is critical at national or regional level for its sector or for other sectors that depend on it.

Such a designation does not come out of the blue: according to the CCB, it is made in consultation with the organisation concerned and, where there is one, with the sector authority. A practice or centre that offers a rare service in its region should keep this in mind.

Is a hospital your client? It can impose measures on you

Organisations covered by NIS2, such as a hospital or a large laboratory, must secure their supply chain, including their relationships with direct suppliers and service providers. They can therefore write security requirements into the contract they have with you, even if you are too small to be covered yourself.

The CCB advises any organisation that may be part of such a chain to apply at least the Basic level of the CyberFundamentals framework (CyFun®), and notes that a NIS2 entity could impose a CyFun® level on its direct suppliers. If you receive such a request, ask for the expected level and the proof required in writing.

Your organisation is covered: the deadlines as of 26 October 2026

Since 18 October 2024, a covered entity must take the minimum security measures (the law lists 11), report significant incidents and accept supervision by the CCB. Its management approves these measures, oversees their implementation, is accountable for them and follows cybersecurity training. The rest of the timeline:

For a significant incident, the clock is short: an early warning to the CCB within 24 hours, a notification within 72 hours and a final report no later than one month after the notification.

Essential or important entity: supervision and fines

Both categories have the same obligations. The difference is supervision: an essential entity is supervised in advance and goes through regular, mandatory conformity assessments; an important entity is in principle only supervised after the fact, following an incident or evidence that it is not complying with the law.

Fines go up to 10 million euros or 2 % of total worldwide annual turnover for an essential entity, and up to 7 million euros or 1.4 % for an important entity, whichever is higher.

What DeepIT puts in place, whether you are covered or not

In the practices and SMEs we manage, we set up the same baseline: Microsoft Defender on every computer, managed and monitored by us; a confirmation code on top of the password for Microsoft 365 accounts; a backup kept outside your premises; the email settings that stop a fraudster from sending mail in your name (SPF, DKIM, DMARC); and our intervention when something goes wrong. The GDPR requires you to protect the personal data you process in any case (for a practice, that of its patients).

We can run the CCB test with you and read the result, including for a group. This baseline is not a certification: DeepIT is not a conformity assessment body, and only an approved body can verify or certify a CyFun® level. For practices, see also our medical IT page.

Find out if NIS2 applies to you→