Skip to content

EU country · Western Europe

Belgium:
What Belgian customers expect

Belgium transposed NIS2 early and requires essential entities to undergo a conformity assessment under CyberFundamentals or ISO 27001. Suppliers notice this in questionnaires. For fresh produce from Latin America, Antwerp-Bruges is one of the main gateways into the EU.

Official languagesDutch, French, German
Main seaportAntwerp-Bruges
NIS2Law of Apr 26, 2024, in force since Oct 18, 2024
Data protection authorityGegevensbeschermingsautoriteit (GBA/APD)
VAT (standard rate)21 %

Belgium as a market for South America

The Port of Antwerp-Bruges reported a record year for reefer containers in 2025: 1.17 million TEU. According to the port authority, around 90 % of refrigerated imports are fresh goods such as fruit, vegetables, meat and fish, most of them from Latin America. Bananas from Ecuador, grapes from Chile and avocados from Peru often enter the EU through Antwerp and are distributed to neighboring countries from there.

Antwerp is also a major hub for coffee and for the chemical industry. Belgian customers are therefore often importers and distributors serving all of Western Europe. Their requirements follow those of the strictest buyers they supply.

Brussels is also home to the EU institutions and many trade associations. For service providers from South America, that means public tenders and customers who work with EU law every day and ask detailed questions accordingly.

What is the same across the EU and what applies in Belgium

Customs and product law are uniform across the EU; details are in the export guide. Imports are handled by the General Administration of Customs and Excise within the Federal Public Service Finance.

Language: Belgium has three official languages. Which of them must appear on the label and instructions depends on the product and the sales area. The Food Information Regulation (Regulation (EU) No 1169/2011, Art. 15) allows member states to require their official languages. Settle the language version with your importer before you print labels. For goods that only pass through Antwerp, the country of destination is what counts.

VAT: the standard rate is 21 %.

Packaging: whoever places packaged goods on the Belgian market as manufacturer or importer is the party responsible for packaging. That party must report quantities each year to the Interregional Packaging Commission (IVCIE). In practice this is done through Fost Plus for household packaging and Valipac for commercial and industrial packaging. When you deliver to a Belgian importer, the obligation is theirs. Since August 12, 2026, the EU Packaging Regulation (Regulation (EU) 2025/40) applies as well.

NIS2 in Belgium

Belgium was one of the first countries with a NIS2 law. The Law of April 26, 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security has applied since October 18, 2024. A Royal Decree of June 9, 2024 sets out the details.

The competent authority is the Centre for Cybersecurity Belgium (CCB). It is also the national CSIRT and receives incident reports. The deadlines match the directive: early warning within 24 hours, notification within 72 hours, final report after one month. The registration deadlines expired in March 2025.

What sets Belgium apart is the conformity assessment. Essential entities must get certified under the CCB framework CyberFundamentals (CyFun) or ISO/IEC 27001, or be inspected by the CCB. The next stage is due by April 18, 2027. A certified entity is presumed compliant unless proven otherwise. For you, this means Belgian customers often assess their suppliers against CyFun controls or ISO 27001. Your own ISO 27001 certificate fits that grid exactly. To prepare for certification, Sightadel walks you through the clauses and Annex A controls and keeps the evidence ready for the audit. The general obligations are explained on the NIS2 page.

Fines follow the directive: up to EUR 10 million or 2 % of worldwide annual turnover for essential entities, up to EUR 7 million or 1.4 % for important ones. Management bodies must approve the measures and take training.

Data protection and supply chain

The data protection authority is called Gegevensbeschermingsautoriteit (GBA) in Dutch and Autorité de protection des données (APD) in French. It supervises the GDPR for companies throughout the country.

Belgium has not passed its own supply chain law like those in Germany or France. There is a national action plan on business and human rights, which is not binding. The European CSDDD, to be transposed by 2028, will be binding. Large Belgian retailers and food groups already ask about social standards and origin today.

What Belgian customers typically ask for

In the fruit trade, GLOBALG.A.P. for farms and a GFSI-recognized standard such as BRCGS or IFS for packhouses are common. Belgian distributors often supply supermarkets in several countries and therefore ask for whatever certificate their most demanding buyer requires. More under food safety.

For coffee and cocoa, EUDR documentation comes on top; for chemicals and metals, the data for CBAM.

IT service providers receive questionnaires based on CyFun. If you know the controls at the "Basic" or "Important" level, you can answer them faster. Some of these controls concern vulnerabilities and systems reachable from the internet; a veyrisk check of your external attack surface gives you current answers on those points.

A sensible starting point for suppliers to Belgian customers:

  1. Ask whether your customer is an essential or important entity and which framework it uses, CyFun or ISO 27001.
  2. Compare your security measures with the controls of that framework.
  3. Agree on the label language and the packaging report with your importer.
  4. Have your food safety certificates and EUDR documents ready before the questionnaire arrives.

Contacts

AreaOffice
Bilateral chamberBelgalux, Belgian-Luxembourg-Brazilian Chamber of Commerce in São Paulo
CustomsFPS Finance, General Administration of Customs and Excise
CybersecurityCentre for Cybersecurity Belgium (CCB)
Data protectionGegevensbeschermingsautoriteit / Autorité de protection des données
PackagingIVCIE, Fost Plus, Valipac
Finding partnersEnterprise Europe Network

In Belgium, foreign trade is a matter for the regions. For contacts with Belgian buyers, turn to the trade sections of the embassies and the regional agencies of Flanders, Wallonia and Brussels.

FAQ

Do I need CyFun certification as a supplier to a Belgian customer?
No, the obligation applies to essential entities in Belgium. Your customer can, however, require by contract that you meet certain CyFun controls or present an ISO 27001 certificate.
Which language does my label need in Belgium?
That depends on the product and the sales area; Belgium has three official languages. Agree on the language version with your importer before printing.
Who reports packaging in Belgium?
The party responsible for packaging, meaning the manufacturer or importer, usually through Fost Plus or Valipac to the IVCIE.
What VAT rate applies in Belgium?
The standard rate is 21 %.
Which tool helps me prepare ISO 27001 evidence for a Belgian customer?
Sightadel sets up ISO 27001 step by step with templates, tasks and audit preparation, and keeps the data in Germany. Certification remains with an accredited body; Sightadel does not issue certificates.