Where the rules shape the work.

Each sector works to its own rules and deadlines.

Let's talk

Banking

Banks and investment firms, where every change is audited and many deadlines are set by the regulator.

Typical situations

A regulatory date that cannot move: DORA remediation, the move to the EU AML Regulation, instant payments.
A core banking system, data platform or payment chain to change without interrupting service.
A backlog of client files, periodic reviews or transaction alerts to clear, to the standard your regulator expects.

What matters in this sector in Belgium

DORA has applied since 17 January 2025. The ECB supervises significant Belgian banks and the National Bank of Belgium the others; each collects the register of ICT third-party arrangements.
Belgian banks, as euro-area providers, have had to send instant euro transfers and offer verification of the payee since 9 October 2025, under Regulation (EU) 2024/886.
The National Bank of Belgium supervises banks' anti-money laundering controls. The Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027, and AMLA begins direct supervision of certain groups in 2028.

Expertise we bring to this sector

Insurance

Insurers and brokers, where solvency, conduct and data rules shape every change.

Typical situations

A regulatory programme with a fixed date: the Solvency II review, DORA, recovery and resolution planning.
Policy administration or claims systems to modernise while contracts keep running.
Actuarial, finance and risk teams that need reliable data and reporting, on time.

What matters in this sector in Belgium

In Belgium, the National Bank of Belgium supervises insurers prudentially, and the FSMA supervises conduct of business rules for insurers and intermediaries under the law of 4 April 2014 on insurance.
DORA has applied since 17 January 2025. The National Bank of Belgium collects insurers' register of ICT third-party arrangements; the FSMA supervises DORA for insurance intermediaries other than SMEs.
Belgium must transpose the Solvency II review, Directive (EU) 2025/2, and the Insurance Recovery and Resolution Directive, (EU) 2025/1, by 29 January 2027, for application from 30 January 2027.

Expertise we bring to this sector

Life Sciences

Pharmaceutical, biotech and medical device companies, where systems are validated and every change is documented.

Typical situations

A system to validate or revalidate, with the documentation an inspection expects.
A regulatory transition to plan for, such as the medical device and in vitro diagnostic rules.
Clinical, quality or manufacturing data to bring together without breaking its audit trail.

What matters in this sector in Belgium

The FAMHP is Belgium's competent authority for medicines, medical devices and in vitro diagnostics. The laws of 22 December 2020 and 15 June 2022 implement the MDR and IVDR in Belgium.
Belgium's NIS2 law of 26 April 2024 has applied since 18 October 2024. The FAMHP is sectoral authority for pharmaceutical research and manufacturing and for medical device manufacturers, alongside the CCB.
Belgium's Health Data Agency, set up by the law of 14 March 2023, is the intermediary for reusing health data in research and innovation. EHDS secondary-use rules apply from 26 March 2029.

Expertise we bring to this sector

Transport & Logistics

Transport operators, logistics providers and ports, whose schedules and flows the public and supply chains rely on every day.

Typical situations

Scheduling, ticketing or asset systems where an outage is visible to the public the same day.
Warehouse, fleet or freight systems to integrate while goods keep moving.
Electronic freight documents and data exchanges to prepare with partners and authorities.

What matters in this sector in Belgium

Belgium's NIS2 law of 26 April 2024 has applied since 18 October 2024; the first conformity milestone for essential entities, under CyberFundamentals or ISO 27001, fell on 18 April 2026.
Belgium's critical entities law of 19 December 2025 covers air, rail, water and road transport; sectoral authorities were to designate critical entities by 17 July 2026, and these are essential entities under NIS2.
Since 1 January 2026, businesses in Belgium liable to VAT must issue and receive B2B invoices in structured electronic form, in principle in Peppol BIS format over the Peppol network.

Expertise we bring to this sector

Public Services

Public administrations and institutions, whose services citizens and businesses rely on every day.

Typical situations

A programme bought through a framework agreement, with the documentation and reporting the procedure requires.
Digital services for citizens or members that must be accessible, secure and available in more than one language.
Case management or benefit systems to modernise while the service stays open.

What matters in this sector in Belgium

Belgian public buyers procure under the law of 17 June 2016; BOSA's e-Procurement platform, live since September 2023, handles the publication of notices and electronic tenders.
Belgium's NIS2 law of 26 April 2024, in force since 18 October 2024, covers federal public administrations, identified regional and community administrations, and the emergency zones.
The law of 19 July 2018 applies the Web Accessibility Directive to Belgian federal public sector bodies, including the federal police and the Ministry of Defence.

Expertise we bring to this sector

Retail & Consumer Goods

Retailers, distributors and consumer goods companies, whose stores, warehouses and online channels run every day.

Typical situations

Stores, warehouses or online shops that must keep running while systems change.
An ERP programme with a fixed horizon, such as moving off SAP ECC before its mainstream maintenance ends.
Supply chain, pricing and product data that has to be integrated, reliable and ready every morning.

What matters in this sector in Belgium

Belgium's law of 5 November 2023 brings the European Accessibility Act's requirements for e-commerce and consumer banking services into the Code of Economic Law; it has applied since 28 June 2025.
Since 1 January 2026, businesses in Belgium liable to VAT must issue and receive B2B invoices in structured electronic form, in principle in Peppol BIS format over the Peppol network.
Belgium's NIS2 law, in force since 18 October 2024, covers medium-sized and large industrial food producers, processors and wholesalers, and online marketplaces; they had to register with the CCB by 18 March 2025.

Expertise we bring to this sector

Aerospace & Defence

Defence organisations and the aerospace and security industry, where security, discretion and long programme horizons shape the work.

Typical situations

Programmes where clearances, discretion and continuity over several years matter.
Logistics, maintenance and information systems to modernise while operations continue.
Cooperation with allied and European partners that requires common standards and teams that work in English.

What matters in this sector in Belgium

In Belgium, defence and security contracts follow the law of 13 August 2011, which transposes Directive 2009/81/EC.
In Belgium, classified work falls under the law of 11 December 1998 on classification and security clearances; intelligence services investigate at the request and under the supervision of the National Security Authority.
A company established in Belgium that bids for classified contracts needs a company security clearance, issued by the National Security Authority.

Expertise we bring to this sector

Manufacturing & Industry

Manufacturers and industrial companies, where production, maintenance and IT systems have to work as one.

Typical situations

Plants and production lines that must keep running while IT and operational systems converge.
Products with software inside that must meet new cybersecurity and machinery rules.
An ERP or manufacturing systems programme with a fixed horizon, such as moving off SAP ECC.

What matters in this sector in Belgium

Under Belgium's NIS2 law, in force since 18 October 2024, medium-sized and large manufacturers in the listed subsectors are generally important entities; they had to register with the CCB by 18 March 2025.
Since 11 September 2026, the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform; the CCB's national CSIRT handles notifications for Belgium.
Since 1 January 2026, businesses in Belgium liable to VAT must issue and receive B2B invoices in structured electronic form, in principle in Peppol BIS format over the Peppol network.

Expertise we bring to this sector

Energy & Utilities

Energy producers, network operators and water utilities, whose operations run continuously and depend on reliable data.

Typical situations

Plants and networks that must keep running while IT and operational systems converge.
Metering, market and customer data that has to be reliable and ready on time.
Security and resilience obligations to meet as an essential or critical entity.

What matters in this sector in Belgium

The law of 19 December 2025, published on 19 January 2026, transposes the CER Directive; the National Crisis Centre coordinates, and critical entities must draw up a resilience plan.
Belgium's NIS2 law of 26 April 2024, in force since 18 October 2024, lists energy, drinking water and waste water among sectors of high criticality.
Since 19 January 2026, entities identified as critical under the law of 19 December 2025 fall within Belgium's NIS2 law whatever their size.

Expertise we bring to this sector

Healthcare

Hospitals, care providers and health insurers, where patient data, security and continuity of care come first.

Typical situations

Clinical or administrative systems to change while care continues around the clock.
Patient data to exchange securely between providers, with consent and access rules respected.
Security obligations to meet across networks, medical devices and suppliers.

What matters in this sector in Belgium

Under Belgium's NIS2 law, in force since 18 October 2024, the CCB supervises healthcare providers with the federal minister for public health as sectoral authority (Royal Decree of 9 June 2024).
Essential entities under Belgium's NIS2 law had a first conformity assessment step due by 18 April 2026 and need full CyberFundamentals verification or ISO/IEC 27001 certification by 18 April 2027.
Belgium's Health Data Agency, set up by the law of 14 March 2023, handles the secondary use of health data. EHDS rules on secondary use apply from 26 March 2029.

Expertise we bring to this sector

The notes on regulation summarise the rules and dates, in force or announced as of September 2026, that shape the work in each sector. They are not legal advice: which obligations apply to your organisation depends on its own situation.

Tell us about your sector.

A dedicated Neurho Single Point of Contact (SPOC) comes back to you with a first reading of your constraints and the expertise to bring together.

Describe your context