Generative AI in Belgium: GDPR, NIS2 and board level AI governance

In Belgium, the same team may write in French in the morning, in Dutch in the afternoon and in English for the European head office. Generative AI has quickly become the favourite tool for moving between languages: translating a contract, rewording a customer email, summarising a technical report. It is convenient. It is also a quiet exit route for data that should never leave the company.

For boards and executive committees, this is no longer just a technical matter. Between the GDPR, enforced by the Data Protection Authority, and Belgium's NIS2 law, overseen by the Centre for Cybersecurity Belgium, AI governance has moved up to board level.

A multilingual economy, heavy use of AI

In a Belgian company, translation is not a side task. A retail group answers customers in Flanders, Wallonia and Brussels. A logistics firm in the port of Antwerp deals with partners all over the world. A Brussels consultancy works with the European institutions. Pasting text into an AI assistant to get a clean version in another language has become a reflex.

The problem is what that text contains. A dismissal letter, a customer file, a commercial offer or an incident report then goes to an external service, often with no contract, no control and no record. This is exactly what we describe in our anatomy of an AI data leak.

What the Data Protection Authority says

The Data Protection Authority, known as the Autorité de protection des données (APD) in French and the Gegevensbeschermingsautoriteit (GBA) in Dutch, enforces the GDPR in Belgium. In September 2024 it published an information brochure on artificial intelligence systems and the GDPR, available in French, Dutch and English, and opened a dedicated AI section on its website.

The brochure makes clear that GDPR principles apply fully to AI: a legal basis for every processing operation, transparency towards individuals, purpose limitation, data minimisation and security of processing. It also stresses accountability: the company must be able to document its choices and risk assessments. For a board, the message is plain: using AI does not shift responsibility to the vendor.

NIS2 in Belgium: management on the front line

Belgium transposed the NIS2 directive through the Act of 26 April 2024, which came into force on 18 October 2024. The Centre for Cybersecurity Belgium (CCB) is the competent authority and also runs the national CSIRT. Entities in scope had to register through Safeonweb@Work, by 18 March 2025 for most of them.

The part that directly concerns leaders is this. Management bodies must:

• approve the cybersecurity risk management measures;

• oversee their implementation;

• take training to understand the risks and their impact;

• answer for the entity's failures to meet these obligations.

AI assistants are part of the risk surface. An unmanaged tool that receives internal data is one more supplier in the chain, and sometimes a source of incidents. To go further, read our article on NIS2 and AI data handling.

Incident reporting: very short deadlines

Under NIS2, a significant incident must be reported to the CCB in stages: an early warning within 24 hours, a notification within 72 hours, then a final report no later than one month afterwards. If personal data is affected, the GDPR notification to the Data Protection Authority comes on top, generally within 72 hours.

These deadlines assume you know what happened. Yet when an employee pastes a customer file into a public chatbot, the company often sees nothing. Without logging, it is impossible to measure the scale of a leak or answer the authority precisely.

Governing AI at board level

A board does not need to become an AI expert. It does need to ask the right questions and demand documented answers:

1. Inventory: which AI tools are used, by which departments, with which data?

2. Policy: which uses are allowed, in which languages and for which types of document?

3. Contracts: are vendors covered by a data processing agreement and safeguards on transfers?

4. Control: how does the company know the policy is followed day to day?

5. Evidence: what records can be shown to the Data Protection Authority or the CCB if asked?

The EU AI Act adds an AI literacy obligation for staff, which has applied since 2 February 2025. Training teams is therefore necessary, but training alone does not guarantee behaviour.

A control that speaks every language

In a country with three official languages, an effective control must recognise sensitive data whatever the language of the text. A national register number, an IBAN, a patient's name or a confidentiality clause stay sensitive in French, Dutch, German or English.

An AI DLP solution acts at the moment text leaves for the assistant. It detects sensitive data, replaces it with realistic placeholders through format preserving anonymisation, warns or blocks according to the rule, and keeps a usable record. Teams keep translating and drafting without exposing what must stay internal.

Key takeaways

In Belgium, generative AI often serves as a bridge between languages, and that is where data slips out. The Data Protection Authority confirms that the GDPR applies fully to AI. The NIS2 law makes management directly accountable. A well informed board asks for an inventory, a clear policy, solid contracts and a control that produces evidence.

Want to see how ZeusLock protects your teams' exchanges with AI, in every language they use? Book a demo.