News from Belac

10.12.2025 - BELAC transition plan CyberFundamentals

1/ From CyFun®2023 to CyFun®2025

On 1 October 2025, the new version of the CyberFundamentals Framework was published by the Centre for Cybersecurity Belgium (CCB) with the abbreviated name "CyFun®2025". The previous version of 1 March 2023 has the abbreviated name "CyFun®2023".

The documentation relating to CyFun®2023 and CyFun®2025 can be consulted on the website www.cyfun.eu.

The BELAC transition arrangement has been drawn up in consultation with the Belgian Certification Authority (NCCA) of the CCB and takes into account the specific application of CyFun® in determining the presumption of conformity with Belgian NIS2 legislation.

Key points from the transition scheme

• Verification and Certification Bodies (VBs and CBs) must obtain accreditation for verification or certification against CyFun® 2025 by 18 April 2027 at the latest.
• CyFun®2023 and CyFun®2025 will continue to coexist until 18 April 2027, and entities will have the choice of which version of CyFun® to apply until then.
• Verification and Certification bodies (VBs and CBs) have the option to carry out verifications or certifications according to CyFun®2023 until 18 April 2027 at the latest. Verification statements and certificates according to CyFun®2023 are valid until 18 April 2028 at the latest.

Application for extension required

As a VB/CB already accredited for verification/certification according to the CyFun® Conformity Assessment Scheme (CyFun® CAS) with CyFun®2023 as its scope, you can now apply for an extension of your accreditation for CyFun®2025. This can be done in the usual way via the BELAC 6-201 application form.

The transition assessment can be combined with regular surveillance or renewal audits or can be requested separately as an extension. The assessment will be carried out as follows: a two-hour off-site documentation audit of the documents listed below as part of the extension application, a two-hour remote consultation between the BELAC audit team and the VB or CB, and a two-hour off-site reporting by the BELAC audit team. A witness audit is not required to grant the transition. A witness audit will be scheduled during the first subsequent regular BELAC assessment, provided that files are already available.

For the extension application, we ask you to provide us with the following, in addition to the usual documents as indicated in the application form:

• The report of the internal audit on this transition to CyFun®2025.
• A gap analysis of the changes in your management system (documentation and implementation) for CyFun®2025 compared to CyFun®2023.
• An action plan (actions and timing) for the transition based on the gap analysis.
• The method and content of the information you provide to your customers about the changes.
• Information demonstrating that auditors and decision-makers have been trained for CyFun®2025 and how this is guaranteed in the management system.

Adjustment of the scope

After obtaining accreditation for CyFun®2025, both versions of CyFun® will be mentioned in the scope. In addition, CyFun®2023 will state that the accreditation granted according to this version is valid until 18 April 2028. This means that verifications/certifications for CyFun®2023 can be carried out until 18 April 2027 at the latest and that verification statements and certificates based on CyFun®2023 are valid until 18 April 2028 at the latest.

2/ CyFun® Conformity Assessment Scheme (CAS) and Clarifications: from version 2025-03-07 to version 2025-11-26

Following the publication of CyFun®2025, the CCB, in consultation with the Belgian Certification Authority (NCCA) and BELAC, has decided to also publish a new version of the 'CyberFundamentals Framework Conformity Assessment Scheme' (CyFun® CAS) and the 'CyberFundamentals Framework Conformity Assessment Scheme Clarifications'.

CyFun® CAS and Clarifications with version 2025-11-26 will replace version 2025-03-07 with immediate effect at the time of publication.

The application of this new version is independent of the version of the CyberFundamentals Framework and therefore applies to both verification/certification for CyFun®2023 and CyFun®2025.

Version 2025-11-26 of the CyFun® CAS and the Clarifications can be consulted at www.cyfun.eu

No extension request necessary

Given that the changes are limited and have no substantive impact, verification bodies that are already accredited for verification according to the CyFun® CAS version 2025-03-07, including the accompanying CAS Clarifications, do not need to submit an explicit extension application.

Adjustment of the scope

BELAC will adjust the scope concerned by means of an administrative change whereby the reference to 'CyberFundamentals Conformity Assessment Scheme (version 2025-03-07)' will be replaced by 'CyberFundamentals Conformity Assessment Scheme (version 2025-11-26) incl. CyberFundamentals Conformity Assessment Scheme Clarifications' (latest version)'.

New accreditation applications

Verification and/or certification bodies submitting a new accreditation application for CyberFundamentals will be evaluated on the basis of version 2025-11-26 of the CyFUn® CAS and the latest version of the accompanying Clarifications.

This application can be submitted in the usual manner using the BELAC 6-201 application form.

05.12.2025 – Mandatory invoicing via PEPPOL and new bank account

Mandatory electronic invoicing via PEPPOL from 1 January 2026

From 1 January 2026, it will be a legal requirement to send all invoices * to BELAC electronically via the PEPPOL network. Paper or PDF invoices will no longer be accepted from that date.

(* This does not apply to private persons as described in point 6.1 of document BELAC 7-06, who can still send claim statements to belacfinance@economie.fgov.be. Expense claims, such as for transport, can also be sent via belacfinance@economie.fgov.be)

This measure is part of the federal strategy to digitise and standardise invoicing processes. Electronic invoicing via PEPPOL offers numerous advantages:

• Security: Data is exchanged via a secure network.
• Efficiency: Faster processing and fewer administrative errors.
• Uniformity: One standard for all suppliers and partners.

 What does this mean for assessors and experts?

• Ensure that your company is ready to send invoices via PEPPOL.
• Check whether your accounting software is compatible with the PEPPOL network.
• Contact your software supplier or accountant in good time to plan the transition.

More information and practical guidelines can be found here:

• e-invoicing within everyone's reach - e-invoice (belgium.be)

Migration of the BELAC bank account to BNP Paribas (with new BIC code)

From 15 December 2025, the FPS's bank accounts will migrate from BPOST to BNP Paribas. The account numbers and IBAN numbers will remain the same, but the BIC code will change to GEBABEBB instead of PCHQBEBB. The change is necessary to avoid potential problems with the collection of these sums due to the use of incorrect BIC codes (the risk arises mainly with foreign debtors).

BELAC's full payment details are therefore as follows:

679-2005874-11

IBAN BE30 679200587411

BIC  GEBABEBB

What does this mean for companies who need to make payments to BELAC?

• Check the payment details in your accounting software and adjust the BIC code if necessary
• Payments made on or after 15 December 2025 must be made using the new BIC code

27.11.2025 – New invoicing procedure

BELAC has revised the document containing the Guidelines for preparing an assessment report and the request for payment of the assessment hours (BELAC 4-01 – only available in French and Dutch) following a significant change in the invoicing procedure resulting from new regulations stipulating that invoices must be paid by public authorities within 30 days of receipt. Given that an invoice can only be paid once the service has been fully provided, it is important not to submit the invoices too early in order to avoid the period between submission and payment exceeding 30 days.

What does this mean for assessors and experts in practical terms?

 When submitting module E:

• For each assessment day the actual time worked (am, pm or am+pm) must be stated. This information is necessary for accurate invoicing.

An invoice can only be submitted after:

• submitting the final version of module D and module E (including the evaluation of the non-conformities) and the Excel accreditation scope completed with the assessed activities (for technical assessors and experts);
• submitting the full report (module A, module C, all final modules D and E (including the evaluation of the non-conformities) and the Excel accreditation scope completed with the assessed activities (for lead assessors).

Consequence of this new rule:

• It is no longer possible to submit an invoice before the final assessment report has been completed (including the evaluation of the non-conformities).
• BELAC will only give the go-ahead for payment after all required documents have been received and checked for completeness.

09.06.2025 World Accreditation Day

June 9th 2025 marks World Accreditation Day: a global initiative established by the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC) to promote the value of accreditation.

This year’s theme is Accreditation: Empowering Small and Medium Enterprises (SMEs)

Discover the video, the joint statement of ILAC and IAF and the brochure of the World Accreditation Day 2025.

01.06.2025 Extension of the mutual recognition of BELAC

The mutual recognition of BELAC was extended by IAF with additional subscopes, namely

• IFS Logistics Version 3, Part 2
• IFS Broker Version 3.2, Part 2

Details about all activities granted under the mutual recognition agreements of EA, ILAC and IAF can be found under EA-MLA, ILAC-MRA and IAF-MRA.

03.04.2025 Extension of the mutual recognition of BELAC

The mutual recognition of BELAC was extended by IAF with additional subscopes, namely

• BRCGS Global Standard for Agents and Brokers, Part II
• BRCGS Global Standard for Packaging Materials, Part II
• ISO 45001 (OHSMS)
• ISO/IEC 27001 (ISMS)
• ISO 50001 (EnMS)

Details about all activities granted under the mutual recognition agreements of EA, ILAC and IAF can be found under EA-MLA, ILAC-MRA and IAF-MRA.

09.06.2024 World Accreditation Day

June 9th 2024 marks World Accreditation Day: a global initiative established by the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC) to promote the value of accreditation.

This year’s theme is Accreditation: Empowering tomorrow and shaping the future.

Discover the World Accreditation Day 2024

• video
• the ILAC and IAF joint statement and
• the brochure.

05.06.2024 : Provisions for the transition from EN ISO/IEC 17043:2010 to EN ISO/IEC 17043:2023

EN ISO/IEC 17043:2023 was published on May 9, 2023. This new version will replace the current standard EN ISO/IEC 17043:2010.

ILAC (International Laboratory Accreditation Cooperation) and EA (European co-operation for Accreditation) have both approved a three-year transition period.

At the end of this transition period, all accredited proficiency test providers must have been assessed and accredited according to ISO/IEC 17043:2023, i.e. by May 31, 2026 at the latest. After this date, accreditation according to EN ISO/IEC 17043:2010 will no longer be valid.

In order to facilitate the transition to the new version of the standard, BELAC has taken the following decisions concerning the transition period:

• From March 15, 2024, all new applications for accreditation must be submitted in accordance with EN ISO/IEC 17043:2023. In other words, all initial applications for accreditation received after March 14, 2024 will be made in accordance with EN ISO/IEC 17043:2023.
• From June 1^st, 2024, all pre-assessments and initial assessments will be carried out in accordance with standard EN ISO/IEC 17043:2023. Organisations that are already accredited may, if they wish, be assessed to the new standard from this date.
• As BELAC will try as much as possible to combine the transition assessment with regular surveillance or renewal assessments, all assessments will,  also for already accredited bodies,  in principle be done according to EN ISO/IEC 17043:2023 from October 1^st,2024. However, to make this possible, the responsibility lies with the accredited body to ensure that it is ready to have the assessment performed according to the new version of the standard, i.e. that it has already taken or initiated the necessary actions within the framework of the transition when applying for the transition assessment.
  To this end, a transition plan (BELAC 6-311) must be submitted prior to the assessment, which will be initially evaluated by the secretariat.  If the transition plan shows that the accredited body has not taken sufficient steps to combine the transition assessment with the planned surveillance or renewal audits in a timely manner, a separate transition assessment will be required. The transition plan must be submitted no later than one month before the first day of the assessment and no later than June 1^st, 2025. It must list the required adjustments (in sufficient detail) and the corresponding timing for their implementation. 
• From February 1^st, 2025, BELAC will no longer issue initial accreditations according to the EN ISO/IEC 17043:2010 standard.
• June 1^st, 2025: deadline for submitting a transition plan to BELAC. If the assessment (according to EN ISO/IEC 17043:2023) takes place before this date, the deadline to submit this transition plan is 1 month before the first assessment day (see above).

For non-conformities related to different or new requirements in the new version of the standard, proficiency testing providers will have more time to carry out corrections and corrective actions. However, the implementation of these actions must be completed in order to make the transition to the new version of the standard. In any case, to make this transition on time, the corrections and corrective actions undertaken must be submitted before February 1^st, 2026. The finalisation of non-conformities is defined in accordance with the provisions of document BELAC 3-11 :

• For type A non-conformities: acceptance of the cause, impact and extent analysis, the corrections and corrective actions taken, and proof of implementation;
• For type B non-conformities: acceptance of the cause, impact and extent analysis, the proposed corrections and corrective actions and the accompanying implementation schedule.

By May 31, 2026, all certificates (and scopes) that refer to conformity with standard EN ISO/IEC 17043:2010 must be converted to accreditation certificates that refer to conformity with standard EN ISO/IEC 17043:2023.

For proficiency testing providers who have not switched to the new standard before the end of the transition period, accreditations issued on the basis of EN ISO/IEC 17043:2010 will no longer be valid from June 1^st, 2026.