Technology and digital law firms in Belgium

The AI Act is built on risk-based classification. Certain practices are prohibited, high-risk systems carry heavy obligations on risk management, data quality, technical documentation, logging, transparency and human oversight, and limited-risk systems carry information duties. Obligations apply differently depending on whether you are a provider or a deployer. Application is phased: the first useful step is an inventory of the AI systems used in the company and their classification.

NIS2 was transposed into Belgian law in 2024, with the Centre for Cybersecurity Belgium as national authority. The exercise starts with determining whether the entity is essential or important within the meaning of the text, which depends on sector and size. Then come registration with the CCB, risk management measures, the obligation to notify significant incidents on a multi-stage timetable, and explicit accountability of the management body. The CyFun framework developed by the CCB serves as the implementation and certification reference.

A transfer to a third country is lawful only if it rests on a basis in Chapter V of the GDPR: an adequacy decision, standard contractual clauses, binding corporate rules, or a strictly applied derogation. Since Schrems II, standard contractual clauses do not suffice on their own: they require a transfer impact assessment documenting the law of the destination country and, where needed, supplementary technical or organisational measures. That analysis must be written down and kept.

The first reactions shape everything that follows. Identify the nature of the referral, individual complaint or own-initiative investigation, check the exact scope of the information requested, and answer within the deadlines without spontaneously widening the field. Existing compliance documentation, the register of processing activities, impact assessments and internal policies, is the main line of defence. A company that produces a current register is in a radically different position from one reconstructing it after the fact.

The GDPR requires notification to the supervisory authority of any breach likely to result in a risk to the rights and freedoms of individuals, within seventy-two hours of becoming aware of it. In practice the sequence is: contain the incident, document the facts and the time of discovery, assess the risk, notify the DPA even if the analysis is incomplete, then inform data subjects if the risk is high. Every breach must be recorded in an internal register, including those that are not notified.

Look for a team that has negotiated from both the customer and the vendor side: it knows where the real friction points are. The clauses that matter are reversibility and exit, service levels and their remedies, ownership of data and bespoke developments, liability caps measured against actual exposure, and the annexed processing agreement. A SaaS contract not negotiated on exit is a dependency, not a contract.

A Belgian fintech combines digital law with a financial regulatory layer: authorisation or exemption from the FSMA or the National Bank depending on the activity, anti-money laundering duties, DORA for digital operational resilience, and the MiCA regime for crypto-assets. Check that the firm covers both the technology side and the financial regulatory side, or works with a dedicated internal team, because advice covering only half the subject creates a false sense of security.

The two texts do not target the same players. The Digital Services Act applies to all online intermediaries, with obligations scaled to size: readable terms, a notice-and-action mechanism for illegal content, reasoned moderation decisions, an internal complaint route, and for very large platforms an annual systemic risk assessment and independent audit. The Digital Markets Act concerns only a small number of gatekeepers designated by the Commission, with precise prohibitions on self-preferencing and tying. In Belgium the Digital Services Coordinator is the BIPT. So the first question to settle is which category you fall into: most Belgian platforms come under the DSA without being caught by the DMA.

The essentials sit in the Code of Economic Law. Before the order: full pre-contractual information on the price inclusive of tax, delivery costs, the seller’s identity and withdrawal arrangements. At the point of ordering: a button whose wording unambiguously states the obligation to pay. Afterwards: a fourteen-day withdrawal right for most distance sales, with limited exceptions, and the statutory conformity guarantee. Add the prohibition on unfair commercial practices, the rules on online reviews and announced price reductions, and those applying to automatically renewing subscriptions. The breaches most often sanctioned in practice are incomplete pre-contractual information and unjustified reference prices.

Legal 500, not us. The tiers shown on this page are the ones Legal 500 publishes for Belgium in ICT, digital & technology, reproduced as they stand, with no change to their order or composition. We have not run the practitioner and client interviews that would let us rank firms ourselves: rather than invent an in-house scale that would look like an assessment without being one, we cite the publication that did the work.

By us, on a single criterion: the number of Belgian practice areas in which Legal 500 lists the firm. That figure appears on every card and anyone can recount it. Legal 500 draws no distinction between firms in the same tier; we introduce this order to make the list readable, knowing what it is worth. It measures the breadth of a practice, not the quality of its work: within the same tier, a boutique and a full-service firm are treated as equals by the ranking, and it is the ranking that counts.

They are the two most widely used references on the Belgian market, and they have real value: their teams interview practitioners and clients, year after year, about concrete matters. Their limit lies in how they collect. Listing starts from a submission by the firm: a practice that does not file does not appear, which mechanically under-represents boutiques and firms that do no business development. A Tier 1 tells you a firm is recognised by its peers and clients across a whole area; it does not tell you it is the right one for your matter.

From the Legal 500 index for Belgium, worked through area by area for the 2026 edition: a firm appears here in ICT, digital & technology if it is ranked there, at its tier. The direct and accepted consequence: a firm absent from Legal 500 is absent from here, which says nothing about its quality. If you know one that belongs here, write to us. Neither Legal 500 nor Chambers is a partner of this site, and neither endorses its content.