Skip to content
ParaafLaws and rules, read through

Paraaf

What Paraaf checks

https://paraaf-psi.vercel.app/en/rules

Rules

What Paraaf checks

Every rule with the law behind it, who it applies to and when we last checked it. A rule that hasn’t been checked yet is never shown as an obligation.

62 rules, 58 of them checked

What's new: the rule changes we track

Registration and registers

Registration in the CBE

Mandatory
Why
Under book III of the Code of Economic Law, every business must be in the CBE before it starts. A sole trader registers through an accredited business counter; a company or non-profit first files its deed of incorporation with the court registry.
What to do
Go to an accredited business counter (ondernemingsloket/guichet d'entreprises) of your choice. Check your data on CBE Public Search and have new activities or establishments added.
Deadline
Before the activity starts.
Who can help
The competent authority

VAT exemption scheme for small businesses

Mandatory
Why
Under the exemption scheme (art. 56bis of the VAT Code) you charge no VAT as long as your annual turnover does not exceed 25,000 euros. Above that, you must switch to the normal VAT regime.
What to do
Track your turnover during the year. If you are likely to exceed the threshold, talk to your accountant and report the switch via MyMinfin.
Who can help
Your accountant

UBO register

Mandatory
Why
The Act of 18 September 2017 requires every company, non-profit (vzw/ASBL) and foundation to register its ultimate beneficial owners (UBOs), report changes within 30 days and confirm the data every year, even if nothing changed.
What to do
Log in to the FPS Finance UBO register (via MyMinfin, with eID or itsme) and enter or confirm the beneficial owners. Your accountant can do this for you.
Deadline
Within 30 days of incorporation or a change; then confirm yearly.
If it’s not in order
An administrative fine or removal from the CBE.
Who can help
Your accountant

Social insurance fund

Mandatory
Why
According to the NISSE (RSVZ/INASTI), you must be affiliated with a social insurance fund of your choice before you start as self-employed. Through that fund you pay your social contributions and build up rights.
What to do
Choose an accredited social insurance fund and join online, often together with your registration at the business counter. Discuss the contributions for your situation with the fund, especially for a side occupation.
Deadline
Before the self-employed activity starts.
If it’s not in order
An administrative fine of 500 to 2,000 euros; without affiliation after a reminder you are affiliated automatically with the National Auxiliary Fund.
Who can help
The competent authority

Annual accounts at the National Bank

Mandatory
Why
A BV/SRL, NV/SA or CV/SC must file its annual accounts with the Central Balance Sheet Office of the National Bank, within 30 days of approval by the general meeting and at the latest 7 months after the end of the financial year.
What to do
Have your accountant prepare the accounts and file them through the Central Balance Sheet Office application (nbb.be). Hold the general meeting within 6 months of the year end.
Deadline
At the latest 7 months after the end of the financial year.
If it’s not in order
Late filing adds a surcharge to the filing fee.
Who can help
Your accountant

Accounts of the non-profit (vzw/ASBL)

Mandatory
Why
Large and very large non-profits file their annual accounts with the National Bank. Small non-profits may keep simplified accounts and file them with the registry of the enterprise court (Companies and Associations Code art. 2:7 and 2:9). You are large if you exceed more than one criterion: 5 employees, 391,000 euros of income or 1,562,000 euros of total assets.
What to do
Check which category your non-profit falls into and file the accounts: through the Central Balance Sheet Office on nbb.be if large, at the court registry if small. Your accountant or a non-profit support service can help.
Who can help
Your accountant

Details on letters, invoices and website

Mandatory

Not checked yet: read this as something to ask about, not as an obligation.

Why
The Companies and Associations Code requires companies and non-profits to state their identity on their documents. The FPS Economy lists what must be on your website, such as address, e-mail, company number and VAT number.
What to do
Update your letterhead, invoice template, e-mail signature and website footer. Your accountant can check that all the details are there.
Who can help
Your accountant

Professional competence for certain trades

Recommended
Why
Proof of basic business management knowledge was abolished in Brussels (since 15 January 2024) and Wallonia (since 1 October 2025). For certain trades, including food, hospitality and construction, proof of professional competence is still required. In Flanders the establishment conditions have been abolished.
What to do
Ask your business counter whether your activity is a regulated trade and which diploma or experience counts as proof.
Who can help
The competent authority

Invoices and payments

E-invoicing via Peppol

Mandatory
Why
Since 1 January 2026, all Belgian VAT-registered businesses must use structured electronic invoices with each other (art. 53, § 2bis of the VAT Code). This also applies under the small-business exemption scheme. A PDF by e-mail is no longer enough; invoices to consumers are not covered.
What to do
Choose accounting or invoicing software that can send and receive via Peppol, and get registered on the Peppol network. Information and a list of solutions on efactuur.belgium.be.
Deadline
Mandatory since 1 January 2026; the general tolerance period ended on 31 March 2026.
If it’s not in order
Fines of 1,500 euros for a first breach, 3,000 euros for a second and 5,000 euros for each one after that.
Who can help
Your accountant

Mandatory invoice details

Mandatory

Not checked yet: read this as something to ask about, not as an obligation.

Why
The EU VAT Directive (art. 226) and Royal Decree no. 1 to the Belgian VAT Code set out what an invoice must contain. Under the exemption scheme you state that the scheme applies instead of charging VAT.
What to do
Have your accountant check your invoice template or invoicing software.
Who can help
Your accountant

Offering electronic payment

Mandatory
Why
Since 1 July 2022, every business selling to consumers must offer at least one electronic payment method (art. VI.7/4 of the Code of Economic Law). A bank account number or a QR code is enough. You must still accept cash.
What to do
Offer a payment terminal, a payment app, a QR code or bank transfer, and say so clearly. Do not charge extra for paying electronically.

Cash payment limit

Mandatory
Why
The Act of 18 September 2017 (art. 67) limits cash payments for goods and services to 3,000 euros for the total amount, even when paid in parts. Cash is banned entirely for buying real estate.
What to do
For amounts above 3,000 euros, ask for a bank transfer or electronic payment, and refuse the balance in cash.
If it’s not in order
A fine of up to 10 percent of the amount.

Retention period for invoices and books

Mandatory

Not checked yet: read this as something to ask about, not as an obligation.

Why
The VAT Code (art. 60) requires you to keep invoices and books. The FPS Finance mentions 7 years from 1 January after issue (15 or 25 years for real estate); for documents from 2023 onwards, 10 years is also cited.
What to do
Keep everything for at least 10 years in its original form (e-invoices electronically), and ask your accountant which period applies to your documents.
Who can help
Your accountant

Staff

Dimona declaration

Mandatory
Why
The Royal Decree of 5 November 2002 requires every employer to report employment to the NSSO immediately, at the latest when the worker starts. The end is reported by the next working day at the latest.
What to do
File the declaration online via Dimona on socialsecurity.be (with eID or itsme), or let your social secretariat do it. Choose the right type, e.g. STU for students and FLX for flexi-jobs.
Deadline
At the latest when the worker starts; the end by the next working day.
If it’s not in order
Penalty under the Social Criminal Code (art. 181) and a solidarity contribution to the NSSO.
Who can help
Your social secretariat

Registration as an employer with the NSSO

Mandatory

Not checked yet: read this as something to ask about, not as an obligation.

Why
Anyone hiring staff for the first time registers with the NSSO and receives an employer number. Every quarter you report wages and working time (DmfA) and pay the social contributions.
What to do
Register through WIDE on socialsecurity.be. You may file the returns yourself or outsource them to an accredited social secretariat; that is not mandatory.
Deadline
DmfA and contributions by the last day of the month after the quarter.
Who can help
Your social secretariat

Workplace accident insurance

Mandatory
Why
The Workplace Accidents Act of 10 April 1971 requires every employer to insure its employees against workplace accidents from the first working day.
What to do
Take out a workplace accident policy with an insurer before the first employee starts, and report new employees to your insurer right away.
If it’s not in order
Without insurance, Fedris affiliates you automatically, backdated and with a flat-rate contribution per employee, and recovers the compensation for an accident from you.
Who can help
Your insurer or broker

Prevention and protection service

Mandatory
Why
The Well-being at Work Act of 4 August 1996 requires every employer to have an internal prevention and protection service. With fewer than 20 workers you may act as prevention advisor yourself, but tasks such as the risk analysis go to an external service if you lack that expertise in-house.
What to do
Join an accredited external service for prevention and protection at work and agree who is the internal prevention advisor. Explanation on employment.belgium.be.
Who can help
An external prevention service

Work rules

Mandatory
Why
The Act of 8 April 1965 requires every employer, from the first employee, to have work rules covering working hours, pay and the procedures for psychosocial risks, among other things.
What to do
Draft the rules (your social secretariat has templates), post them for 15 days with a register for comments, then send the final version to the Inspection of Social Laws, online via arbeidsreglement.belgie.be.
Deadline
Copy to the inspection within 8 days of entry into force.
Who can help
Your social secretariat

Risk analysis and prevention plans

Mandatory
Why
The Well-being at Work Act and book I of the Code on well-being at work require every employer to map the risks for its workers and plan in writing how to prevent them.
What to do
Have the risk analysis done with your (external) prevention advisor, write the global prevention plan, and set the priorities each year in an annual action plan.
Who can help
An external prevention service

Psychosocial risks

Mandatory
Why
The Well-being at Work Act requires every employer to have a prevention advisor for psychosocial aspects; below 50 workers this is someone from the external service. Since 1 December 2023, employers with 50 or more workers must also have an internal confidential counsellor.
What to do
Ask your external prevention service who your psychosocial prevention advisor is, and put the contact details and procedures in the work rules. From 50 workers, appoint a confidential counsellor from the staff, who completes training within two years.
Who can help
An external prevention service

Internal whistleblowing channel

Mandatory
Why
The Act of 28 November 2022 requires private-sector legal entities with 50 or more workers to have an internal reporting channel with a follow-up procedure. For 50 to 249 workers this has applied since 17 December 2023.
What to do
Set up a confidential channel (e.g. a protected e-mail address or form), appoint an independent person to handle reports, and put the procedure in writing. Have it checked by a lawyer.
If it’s not in order
Obstructing reports or retaliating against whistleblowers can lead to criminal penalties (art. 33).
Who can help
A lawyer

Part-time schedules

Recommended
Why
The Programme Act of 22 December 1989 requires you to include part-time schedules or the framework for variable schedules in the work rules, announce variable schedules in writing in advance, and record deviations. Since 1 June 2026 the work rules may use a framework of normal working hours.
What to do
Have your social secretariat check the work rules. Announce variable schedules in writing at least 7 working days ahead and record deviations with a reliable time-tracking system or in a document.
Who can help
Your social secretariat

Privacy

Record of processing activities

Mandatory
Why
The GDPR requires every controller to keep such a record (art. 30). The exemption for organisations with fewer than 250 people only applies when processing is occasional, carries no risk and involves no sensitive data. According to the Belgian Data Protection Authority (GBA/APD), anyone who manages staff, customers or patients almost never qualifies.
What to do
Make a simple overview per processing activity (customers, staff, suppliers, website): purpose, types of data, people concerned, recipients, retention period and security. The authority offers a template and a flowchart to check whether you are exempt.
If it’s not in order
Administrative fine of up to 10 million euros or 2% of worldwide annual turnover (GDPR art. 83); the authority can ask for the record at any time.
Who can help
A lawyer

Privacy notice for customers and staff

Mandatory
Why
Whoever collects personal data must inform the person at that moment: who you are, why and on what legal basis you use the data, who receives it, how long you keep it and what rights the person has (GDPR art. 13 and 14).
What to do
Write a short privacy notice in plain language and hand it out wherever you ask for data: on the website, at sign-up or with a quote, and when new staff start.
Who can help
A lawyer

Processor agreements

Mandatory
Why
When another party processes personal data on your behalf, this must be governed by a contract with the mandatory content of article 28(3) GDPR. According to the Belgian Data Protection Authority, that contract is always required.
What to do
List the suppliers that can access personal data. Large services usually include the data processing agreement (DPA) in their terms: download and keep it. With smaller partners, sign one based on a template.
Who can help
A lawyer

Data breach procedure

Mandatory
Why
A personal data breach must be reported to the Belgian Data Protection Authority (GBA/APD) without undue delay and where feasible within 72 hours, unless it is unlikely to result in a risk. Every breach must be documented internally, and if the risk is high you also inform the people concerned (GDPR art. 33 and 34).
What to do
Write down on one page who reports a breach, who decides, how to notify the authority (online form) and where breaches are logged. Walk through it once with your staff.
Deadline
Notify the authority within 72 hours of discovering the breach.
Who can help
A lawyer

Retention periods

Mandatory
Why
Personal data may not be kept longer than needed for the purpose it was collected for (GDPR art. 5(1)(e), storage limitation). The retention period, or the criteria for it, must also be stated in your privacy notice (art. 13(2)(a)).
What to do
Put the periods in your record: for example as long as the law requires for accounting and staff files, and shorter for quotes, job applications or newsletter lists. Plan a yearly clean-up.
Who can help
A lawyer

Marketing e-mail only with consent

Mandatory
Why
Advertising by e-mail is prohibited without the recipient's prior, free, specific and informed consent, and you must be able to prove that consent (Code of Economic Law art. XII.13). Exception: existing customers whose address you obtained in a sale, for your own similar products, if they could object free of charge when it was collected, and impersonal addresses of legal entities (such as info@) (Royal Decree of 4 April 2003).
What to do
Ask for consent with an unticked box, keep when and how someone signed up, put a working unsubscribe link in every e-mail and handle unsubscribes promptly.

Health data and other sensitive data

Mandatory
Why
Data about health, and also for example about religious beliefs or sexual orientation, may in principle not be processed. Article 9 GDPR only allows it in specific cases, such as explicit consent or when it is needed for health care. At a hairdresser or beauty salon this means, for example, allergies or skin conditions on a client card.
What to do
Only note what you really need, ask for explicit written consent where required, limit who can see the cards and store them securely (no open folder or shared spreadsheet).
Who can help
A lawyer

Data protection officer (DPO)

Recommended
Why
A DPO is mandatory for public bodies and when your core activity consists of large-scale processing of sensitive data or large-scale regular and systematic monitoring of people (GDPR art. 37). According to the Belgian Data Protection Authority, an individual doctor or care provider does not process on a large scale; a group practice, lab or care platform may.
What to do
Check the authority's criteria to see whether you are covered and write down your conclusion. If it is required, the DPO can be a staff member or an external service; notify the authority of their contact details.
Who can help
A lawyer

Selling to consumers

Clear, all-in prices

Mandatory
Why
Anyone offering goods or standard services to consumers must show the price in writing, legibly and unambiguously (Code of Economic Law art. VI.3). The price shown is the total price the consumer pays, including VAT, all other taxes and mandatory services (art. VI.4); this also applies to advertising that mentions a price (art. VI.6).
What to do
Check your labels, price list, menu, website and ads: the final price including VAT everywhere, with no mandatory surcharge added only at the till.

Information before the contract

Mandatory
Why
Before a consumer is bound, you must inform them clearly and comprehensibly about, among other things, the main characteristics of the product, your identity, the total price with all costs, payment and delivery, your complaints policy, the legal guarantee of conformity and, where relevant, your terms of sale and the duration of the contract (Code of Economic Law art. VI.2), unless this is already clear from the context.
What to do
Put this information on your quote, order form, website or at the counter. General terms only apply if the customer could actually read them before the contract was concluded: not just on the invoice.
Who can help
A lawyer

Two-year legal guarantee

Mandatory
Why
The seller is liable to the consumer for any lack of conformity that becomes apparent within two years of delivery; for second-hand goods a shorter period of at least one year can be agreed, provided you state it clearly (old Civil Code art. 1649quater). You must also remind the consumer of this guarantee before the purchase (Code of Economic Law art. VI.2 and VI.45).
What to do
Mention the legal guarantee in your terms and on your website, and don't write that you can limit it (e.g. 'six-month guarantee'). Since 27 September 2026, the reminder in distance selling uses the EU harmonised notice (Implementing Regulation (EU) 2025/1960).
Who can help
A lawyer

Discounts with the 30-day prior price

Mandatory
Why
Every announcement of a price reduction to consumers must state the prior price: the lowest price you applied in the thirty days before the reduction, per outlet or sales channel (Code of Economic Law art. VI.18). For goods on the market for less than thirty days a shorter period of at least seven days applies; for perishable goods these periods don't apply. For a progressively increasing discount, the price before the first reduction counts (art. VI.19).
What to do
Keep a price history (your till or web shop can often do this) and show the lowest price of the past 30 days as the struck-through price with every discount.

Showing customer reviews honestly

Mandatory
Why
Anyone who gives access to consumer reviews must state whether and how they ensure the reviews come from consumers who actually used or bought the product; otherwise it is a misleading omission (Code of Economic Law art. VI.99 § 7). Claiming reviews are genuine without reasonable checks, or posting or commissioning fake reviews, is always unfair (art. VI.100, 25° and 26°).
What to do
Add one sentence next to the reviews on how they are collected and checked (e.g. 'only after an order' or 'not verified'), and don't remove negative reviews without reason.

Required information in the web shop

Mandatory
Why
Before a consumer is bound by a distance contract, you must give them a long list of information clearly and comprehensibly, including your identity and company number, your geographical address, phone and e-mail, the total price with all costs, payment and delivery arrangements, the conditions of the right of withdrawal with the model form, and the legal guarantee (Code of Economic Law art. VI.45). If information about extra costs is missing, the consumer doesn't have to pay them (art. VI.45 § 5).
What to do
Walk through your checkout with the list in article VI.45: general terms, a delivery and returns page, contact details and the price with all costs before the order button.
Who can help
nealvdv (your website)

14-day right of withdrawal

Mandatory
Why
For a distance contract the consumer has 14 days to withdraw without giving a reason (Code of Economic Law art. VI.47), with a few exceptions (art. VI.53). You must give them the conditions, the period and the model form from annex 2 to Book VI in advance (art. VI.45 § 1, 8°). If you don't, the period is extended by twelve months (art. VI.48).
What to do
Put a clear withdrawal page with the model form on your site, link to it in the confirmation e-mail and state who pays for returning the goods.
If it’s not in order
Without correct information the withdrawal period runs up to twelve months longer (Code of Economic Law art. VI.48).
Who can help
nealvdv (your website)

Withdrawal button in the web shop

Mandatory
Why
For distance contracts concluded through an online interface, the consumer must be able to withdraw using a withdrawal function: labelled 'withdraw from contract here' or an equivalent unambiguous wording, available throughout the withdrawal period, clearly visible and easily accessible. It is followed by a 'confirm withdrawal' button, after which you send an acknowledgement on a durable medium without delay (Code of Economic Law art. VI.61/2).
What to do
Add a withdrawal form to your web shop (e.g. in the customer account and the confirmation e-mail) that asks for name, order and e-mail address, with a confirmation button and an automatic acknowledgement by e-mail.
Deadline
Mandatory since 14 August 2026.
Who can help
nealvdv (your website)
SourcesChecked on October 10, 2026 · Applies since August 14, 2026

Remove the outdated ODR platform link

Recommended
Why
The European online dispute resolution platform has been abolished: Regulation (EU) 2024/3228 repealed the regulation that required the link with effect from 20 July 2025, and the European Commission closed the platform. A link to a platform that no longer exists sends customers the wrong way.
What to do
Remove the ODR link and text from the footer and the general terms. If you want to mention an alternative, refer to the Consumer Ombudsman Service or the competent dispute committee.
Who can help
nealvdv (your website)

Your business and premises

Declaration of surveillance cameras

Mandatory
Why
The Camera Act of 21 March 2007 requires anyone installing surveillance cameras to declare them to the police before they are put into use, through the FPS Interior e-portal. The declaration must be validated every year and updated where needed.
What to do
Log in at www.aangiftecamera.be with eID or itsme and declare your cameras. Your installer does not do this for you. Validate the declaration every year, even if nothing changed.
Deadline
At the latest the day before the cameras are put into use; then validate yearly.
Who can help
The competent authority

Camera surveillance sign

Mandatory
Why
The Camera Act requires a sign following the statutory model at the entrance, stating camera surveillance under the Act of 21 March 2007, the controller's name and an address. Any other logo or text is not allowed.
What to do
Post the official sign (for a shop A4 or 0.60 x 0.40 m, aluminium or laminated sticker) with your name, postal address and e-mail or phone. The model is on besafe.be.

Register of image processing

Mandatory
Why
The Camera Act and the GDPR require a register of image-processing activities from the moment the cameras are in use. The Data Protection Authority and the police can ask for it. Footage is normally kept for one month at most.
What to do
Keep a register on paper or digitally with, among other things, your details, the purpose, the type of place, camera locations, who views the footage and the retention period. The full list is in the brochure on besafe.be.

Smoking ban and no-smoking signs

Mandatory
Why
The Act of 22 December 2009 bans smoking in enclosed places open to the public and requires no-smoking signs at the entrance and inside, visible to everyone.
What to do
Post a round no-smoking sign at the entrance and inside (white background, black cigarette, red border and diagonal bar, at least 9 cm across).

Price display

Mandatory
Why
Under book VI of the Code of Economic Law, every business offering goods or services to consumers must show the total price in writing, legibly, visibly and unambiguously, including VAT and mandatory extra costs, at least in euros.
What to do
Put prices on labels, in the window or on a price list. For a discount, also show the reference price: the lowest price of the previous 30 days. If the shelf price differs from the till price, the lower one applies.

Music in the business (Unisono)

Mandatory
Why
Using music in a professional setting means paying copyright (Sabam) and the fair remuneration for performers and producers (PlayRight and SIMIM). Unisono covers both with one licence.
What to do
Apply for a licence on unisono.be. In staff areas the rate depends on the number of full-time equivalents, in public areas on the floor space.

Your sector

Registered cash register system (GKS/SCE)

Mandatory
Why
The operator of an establishment where meals are consumed and a caterer providing catering services must issue receipts with a registered cash register system once annual turnover from restaurant and catering services, excluding drinks, exceeds 25,000 euros excl. VAT (Royal Decree no. 1 on VAT, art. 21bis). The threshold applies per establishment. Below it you issue a bill or receipt for meals (art. 22). The renewed GKS 2.0 system is mandatory from 1 July 2026.
What to do
Have your accountant calculate the threshold per establishment. If you exceed it, register with the FPS Finance and use a certified GKS 2.0; ask your till supplier whether your current system has already been converted.
Deadline
GKS 2.0 has been mandatory since 1 July 2026 (existing systems in phases).
Who can help
Your accountant

Registration, permit or approval with the FAVV/AFSCA

Mandatory
Why
An operator active in the food chain in Belgium may not carry out any activity without first being registered, permitted or approved by the FAVV/AFSCA; which of the three depends on the risk of the activity (Royal Decree of 16 January 2006).
What to do
Check in the agency's operator portal which activities are listed under your name and report new or changed activities (e.g. catering, delivery, market sales) before you start them.
Who can help
The competent authority

Self-checking and traceability (food safety)

Mandatory
Why
European and Belgian rules make the operator responsible for food safety. The Royal Decree of 14 November 2003 sets out self-checking (based on HACCP), the duty to notify and traceability; there are lighter rules for small businesses.
What to do
Use your sector's self-checking guide (horeca, butcher, baker, retail …), log temperatures, cleaning and suppliers and keep your purchase documents. An audit by an accredited body can lower your FAVV/AFSCA levy.
Who can help
Your sector federation

Allergen information for non-prepacked food

Mandatory
Why
Allergens must also be declared for non-prepacked food (Regulation (EU) No 1169/2011, art. 9(1)(c)). The Royal Decree of 17 July 2014 sets out how: in writing and legibly where the product is sold, or orally provided there is a written internal procedure, staff are trained and the information is free. A notice must say where to find the information and that recipes may change.
What to do
Make an allergen list per dish or product (the 14 allergens of annex II), update it when recipes change, put up an 'Ask us about allergens' sign and show your staff where the list is kept.

Site attendance registration (Checkinatwork)

Mandatory
Why
For construction work on sites where the total value of the works is 500,000 euros excl. VAT or more, attendance registration through Checkinatwork is mandatory: daily and before the person starts work (NSSO). From 1 April 2027 this becomes 'Check in and out at work': departure is registered too, in real time (Programme Act of 30 May 2026, art. 124-131).
What to do
Agree with the main contractor who registers, use the app or a system connected to Checkinatwork, and prepare to register both IN and OUT from April 2027.
Deadline
From 1 April 2027: registration of arrival and departure (Check in and out at work).
Who can help
Your social secretariat

Website and web shop

Legal mentions on the website

Mandatory
Why
Every information society service provider must give users easy, direct and permanent access to, among other things, its name, geographical address, contact details including an e-mail address, company number, supervisory authority where a licence applies, details of a regulated profession and the VAT number (Code of Economic Law art. XII.6). Every business must also make its legal form and registered office available (art. III.74).
What to do
Put a complete block of details in the footer of every page or on a 'Legal information' page reachable from every page. For a regulated profession (e.g. architect, accountant), also add the professional title and professional body.
Who can help
nealvdv (your website)

Privacy notice on the website

Mandatory
Why
Whoever collects personal data through the website must inform visitors at that moment about who is responsible, the purposes and legal basis, the recipients, the retention period and their rights, including complaining to the Data Protection Authority (GDPR art. 13).
What to do
Publish a privacy notice that matches what your site really does, link to it in the footer and next to every form, and update it whenever you add a new service or plug-in.
Who can help
nealvdv (your website)

Consent before non-essential cookies

Mandatory
Why
Storing or reading information on a visitor's device is only allowed after clear information and consent, unless it is strictly necessary for the communication or for a service the visitor explicitly requested (Act of 30 July 2018, art. 10/2). According to the Data Protection Authority, consent must be prior, free, specific, informed, active and revocable: no pre-ticked boxes, continued browsing is not consent, and next to 'accept all' there must be a 'reject all' button on the same layer.
What to do
Load statistics, ad pixels, embedded videos and external fonts only after consent, or choose cookie-free alternatives. Make 'reject' as visible as 'accept' and provide a link to change the choice later.
Who can help
nealvdv (your website)

Accessible web shop (European Accessibility Act)

Mandatory
Why
Since 28 June 2025, e-commerce services to consumers must meet the accessibility requirements of annex 1 to Book VIII of the Code of Economic Law (art. VIII.58 and VIII.59, transposing Directive (EU) 2019/882). Service providers must also explain how their service meets the requirements and publish that information in an accessible way (art. VIII.60). Micro-enterprises (fewer than 10 staff and at most 2 million euros turnover or balance sheet total) fall under a separate regime.
What to do
Have the shop checked for keyboard use, contrast, alt texts, form labels and an accessible checkout, fix the issues and publish an accessibility statement with a contact address.
Deadline
Applies since 28 June 2025.
Who can help
nealvdv (your website)

Accessible web shop, even for a small business

Recommended
Why
A micro-enterprise (fewer than 10 staff and at most 2 million euros annual turnover or balance sheet total, Code of Economic Law art. I.9/1) can be excluded from the accessibility requirements by Royal Decree (art. VIII.59 § 2), and complaints about services of micro-enterprises are only handled for facts from 28 June 2030 (art. XV.18/5). With 10 or more staff, or more than 2 million euros turnover, you are not a micro-enterprise. Accessibility helps all customers and your findability anyway.
What to do
Have the biggest barriers removed: keyboard use, contrast, alt texts, form labels and a checkout that works without a mouse.
Who can help
nealvdv (your website)

Digital security

NIS2: registration with the CCB

Mandatory
Why
The NIS2 Act applies to medium-sized and large enterprises (50 staff or more, or more than 10 million euros turnover or balance sheet total) of a type listed in annex I or II, such as energy, transport, health, digital infrastructure and ICT services, manufacturing, waste management and food production and wholesale (Act of 26 April 2024, art. 3). Essential and important entities must register with the national cybersecurity authority and report changes within two weeks (art. 13), and they must take measures and report significant incidents.
What to do
Use the NIS2 test on Safeonweb@Work to check whether you are covered and keep your conclusion. If so, register on Safeonweb@Work and start with the CCB's CyberFundamentals framework.
Who can help
A lawyer

Chatbot recognisable as a chatbot

Recommended
Why
Since 2 August 2026, AI systems intended to interact directly with people must be designed so that those people know they are dealing with an AI system, unless that is obvious to a reasonably well-informed person (AI Act, Regulation (EU) 2024/1689, art. 50(1)). This duty lies with the provider of the system; if you build the chatbot yourself or put it on the market under your own name, that is you. If you use an off-the-shelf service, check that the notice is there.
What to do
Show a short notice at the start of every conversation such as 'You are chatting with an automated assistant', don't give the chatbot a misleading human name, and offer a way to reach a staff member.
Deadline
Applies since 2 August 2026.
Who can help
nealvdv (your website)

Basic security: backups, two-factor authentication, updates

Recommended
Why
The Centre for Cybersecurity Belgium recommends these basic measures to small organisations in its CyberFundamentals framework: they greatly reduce the risk of the most common attacks, such as phishing and ransomware. An offline backup prevents your backup from being encrypted or wiped as well.
What to do
Turn on automatic updates, enable two-factor authentication for mail, accounting, banking and your website, and make automatic backups with a weekly or monthly copy that is not connected to the network. Test now and then that you can restore a file.

Insurance

Business liability insurance

Recommended
Why
General business liability insurance is not required by law for most businesses, but the FPS Economy strongly recommends it. Some professions do have their own mandatory professional liability insurance.
What to do
Ask an insurer or broker for quotes, and check whether your profession requires professional liability insurance.
Who can help
Your insurer or broker

Strict liability for fire and explosion

Recommended
Why
The Act of 30 July 1979 makes operators of certain publicly accessible establishments liable for damage from fire or explosion, even without fault, and requires them to insure it. The Royal Decree of 28 February 1991 lists, among others, cafés and restaurants from 50 m² open to the public, hotels, shops from 1,000 m², offices from 500 m² open to the public, sports halls, schools and care facilities.
What to do
Check the list in the Royal Decree of 28 February 1991. If your business is on it, take out strict liability insurance with an insurer.
Who can help
Your insurer or broker

Ten-year liability insurance in construction

Recommended
Why
The Act of 31 May 2017 requires contractors, architects and other construction service providers to take out this insurance for homes in Belgium that require an architect and whose building permit was issued after 1 July 2018. It covers solidity, stability and watertightness for ten years after acceptance of the works.
What to do
Take out the insurance with an insurer, state the insurer's name and company number and the policy number in your contracts, and give the certificate to the client and the architect before work starts.
Who can help
Your insurer or broker

Motor liability insurance

Mandatory
Why
The Act of 21 November 1989 requires liability insurance for motor vehicles. According to the FPS Economy this also applies to vehicles used for more than getting around, such as forklifts, bulldozers and tractors.
What to do
Check that every vehicle is on a policy, and ask your insurer or broker about your work vehicles too.
Who can help
Your insurer or broker
Spotted a mistake?

A few words are enough. We will check and fix it.

Search

Loading…

Reading comfort

Choose what helps. Your choice is kept on this device.

Text size

Prefer your device’s own settings (zoom, screen reader, dark mode)? They work here too.