IIC Brussels Chapter Meeting – Save the Date

Date: Thursday 11 March 2027
Time: to be confirmed
Venue: McDermott Will & Schulte, Brussels, Belgium

Please save the date for the next IIC Brussels Chapter meeting. More information will be available soon.

Please note the meeting will be held in English.

Registration is now open.

Please click here to register.

We had a great host and scene setter regarding the NIS2 Directive and the draft NIS2 Implementing Regulation from McDermott Will & Emery followed by an interesting Q&A session with the speakers and audience. The main points raised were as follows:

1. While the EU Member States need to transpose the NIS2 Directive by 17th October 2024, only a few of them have done so at present. Belgium has fully transposed the NIS2 Directive into its national legal order and the Belgian NIS2 law is effective as of 18th October 2024.
2. Companies falling within the scope of the Belgian NIS2 law will have time to comply with the obligations stemming from the law gradually, depending on the type of company (important or essential). Nonetheless, it is key for companies to show they are preparing to comply and building up or adapting their cybersecurity-risk management measures.
3. Some concern was expressed that not all EU Member States may allow companies a progressive timeline to foster proper compliance. Some noted that there had been often a misconception that the tech industry is already compliant with any tech requirements and does not need transition periods.
4. The Belgian competent authority, the Cybersecurity Centre – Belgium, has published a host of useful resources on its website to help companies steer their compliance efforts. The Centre is also organizing webinars to that effect.
5. The draft NIS2 Implementing Regulation, that will be applicable to a number of digital industries, should be adopted any time soon. The draft Regulation was revised to address some of the concerns expressed, among others, by respondents to the public consultation.
6. Among the cybersecurity-risk management measures, an important measure that stands out it the security of the supply chain. It was stressed that the measures need to be seen and implemented in the context of a company’s risk assessment.
7. Another novelty of the NIS2 Directive is the introduction of the accountability of top management. The intention is to ensure that cybersecurity is a board room issue. Cybersecurity requires a holistic approach that goes beyond a single IT department (as may have been the case in the past for some companies).
8. The NIS2 Directive sets out only the main rules regarding accountability of top management. It is up to EU Member States to outline specifics (e.g., which body of the entity is responsible, if they can delegate anything to some extent, etc.).
9. It was suggested that before adopting new laws, enough time is given to allow currently applicable laws to demonstrate whether they are effective enough to address the issues they meant to tackle.
10. The NIS2 Directive is a great tool, and now it is time to focus on compliance to boost the cybersecurity posture of the industry across the EU.