CRA Compliance in Belgium

CCB serves as Belgium's national competent authority for the CRA, with market surveillance functions coordinated with the Federal Public Service Economy (FPS Economy), which oversees consumer product safety and CE marking enforcement in Belgium. Belgium's federal structure means that regional authorities (Flanders, Wallonia, and Brussels Capital) are involved in implementation for regionally-competent matters. CCB has been expanding its regulatory capacity through Belgium's national cybersecurity strategy phases, and CRA enforcement is expected to build on the NIS2 implementation framework. CCB coordinates with ENISA and peer NCAs through established working groups.

Belgian manufacturers submit Article 14 notifications to CERT.be through its secure online reporting portal at cert.be/en/report. CERT.be operates 24/7 incident response capability and is accessible in French, Dutch, and English. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. Belgium's NIS2 transposition through the NIS2-wet (Wet van 26 april 2024) created an incident reporting framework that CERT.be administers, and CRA Article 14 notifications will follow the same channel. CERT.be participates in the EU CSIRTs network and relays reports to ENISA as required.

Market surveillance in Belgium for CRA products is coordinated between CCB and the FPS Economy's Quality and Safety directorate, with customs involvement for imports. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Belgium's consumer product safety enforcement through FPS Economy has been active under the General Product Safety Directive, providing a foundation for CRA market surveillance. Belgian manufacturers should note that CCB may collaborate with the Data Protection Authority (APD/GBA) where CRA incidents also involve personal data breaches.

CCB operates the Cyber Fundamentals Framework (CyFun), which provides a structured cybersecurity baseline aligned with international standards including ISO 27001 and NIST CSF. CyFun certification provides a strong foundation for CRA Annex I compliance and is recognised by Belgian public authorities in procurement. The CCB SafeOnWeb programme provides free cybersecurity guidance for businesses. Agoria (Belgian technology industry federation) provides CRA implementation guidance for its manufacturing members. BELSPO-funded research institutions and Sirris (manufacturing technology institute) provide technical expertise for conformity assessment activities.