The EU AI Act in Belgium, who supervises and what applies now

The short answer

Belgium has not yet adopted the law that designates its EU AI Act authorities. That does not pause the AI Act. It is an EU regulation, its obligations apply directly, and several already do. What is missing is the Belgian enforcement structure, which is being built on existing regulators with the BIPT expected to lead.

Where Belgium stands

The AI Act required member states to designate their market surveillance and notifying authorities by 2 August 2025. Belgium has not yet done so in law.

The federal government set out its approach in a written answer to the Senate in November 2025. The FPS Economy coordinates implementation. The plan relies on existing market surveillance authorities and regulators, and no new authority will be created for the AI Act. Authorities that already supervise products under the EU laws in Annex I of the AI Act can extend their oversight to AI in those products, while some Annex III areas have no existing surveillance body. Market surveillance is a federal competence, the regions have been consulted, and competent authorities were preparing changes to their own laws ahead of a single draft AI Act bill.

By late July 2026 the FPS Economy had confirmed that the BIPT, which already regulates telecoms and post, will become Belgium’s AI supervisor. That role becomes official only once Parliament passes a law, and the FPS Economy was still preparing the preliminary draft. Supervision of AI in education and job placement, which are regional competences, remained the subject of negotiation between the federal government and the regions.

The BIPT already publishes information pages on the AI Act, including its timeline and the requirements for high-risk systems.

What already applies

• Prohibited practices (since 2 February 2025). Uses such as social scoring, emotion recognition in workplaces and schools, and untargeted scraping of facial images are banned. Two more prohibitions, on AI used to generate non-consensual intimate content and child sexual abuse material, apply from 2 December 2026.
• AI literacy (since 2 February 2025). Providers and deployers take measures to support the AI literacy of the people who operate AI on their behalf.
• Transparency (since 2 August 2026). People must be told when they are interacting with an AI system, synthetic content must be marked and deepfakes disclosed. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking.
• General-purpose AI models (since 2 August 2025). Supervised at EU level by the European Commission’s AI Office, not by Belgian authorities.

What comes next

Obligations for Annex III high-risk systems apply from 2 December 2027. They cover AI used in areas such as recruitment and worker management, education, access to essential public services and benefits, credit scoring of natural persons, and risk assessment and pricing in life and health insurance. Deployers must use these systems according to the instructions, assign competent human oversight, monitor them and keep logs, and public bodies and some private deployers must carry out a fundamental rights impact assessment. The deployer obligations guide covers the detail, and the high-risk classification guide helps decide what is in scope.

Where data protection fits

Whatever the AI Act structure turns out to be, the GDPR already applies to every AI system that processes personal data, and the Belgian Data Protection Authority enforces it. Its brochure Artificial Intelligence Systems and the GDPR is the clearest Belgian statement of what it expects. It works through lawful basis, purpose limitation, accuracy, automated decisions, security, data subject rights and accountability, each read alongside the AI Act.

Two points from it matter most for AI. GDPR Article 22 gives people the right to have a human reconsider a solely automated decision, while the AI Act requires human oversight of high-risk systems across their whole lifecycle. And accountability means being able to show your legal basis, your records and your impact assessments for each system.

Financial institutions also remain under the National Bank of Belgium and the FSMA for how they govern risk, including the ICT risk management DORA requires, which reaches AI systems as it does any other ICT system.

A working approach

1. Find the AI you run. Include generative AI tools staff use and AI built into vendor products. The shadow AI guide covers the methods.
2. Register and classify. Record each system’s purpose, owner, your role as provider or deployer, and its risk tier.
3. Meet what applies now. Confirm no system falls under a prohibition, put transparency notices in place and run AI literacy measures.
4. Link each system to its GDPR records. Legal basis, records of processing and data protection impact assessments, as the Data Protection Authority’s brochure describes.
5. Prepare high-risk systems for December 2027. Plan oversight, logging, monitoring and impact assessments, and watch for the Belgian law that names your supervisor.

Aicura supports this work with discovery, the AI register, risk and impact assessments, policies, training and monitoring. It assesses against the EU AI Act from the Essentials plan, and against ISO/IEC 42001 and the NIST AI RMF from Pro. The decisions, and the dialogue with your supervisors, stay with you.