The Complex Landscape of Cybersecurity Regulations
by Erik Valgaeren, Lawyer at Stibbe
In today’s rapidly digitising world, the cybersecurity landscape is no longer just a technical concern—it's a legal and strategic imperative. At the BE-CEC conference in Brussels on March 27, 2025, Erik Valgaeren, a leading IT and cybersecurity lawyer at Stibbe, provided a sobering yet empowering perspective on how businesses can navigate the ever-expanding web of cybersecurity regulations. His central message was clear: the regulatory burden may be growing, but with clarity and strategic intent, companies can not only comply but emerge stronger and more resilient.
Real-World Incidents: Wake-Up Calls for Business
Valgaeren opened with a stark reminder—cyber threats are not theoretical. Belgium has seen high-profile cases such as the Proximus breach, allegedly involving state-sponsored espionage by the British intelligence agency GCHQ, and the cyberattack on aviation supplier Asco. These are not isolated incidents but symptomatic of a broader trend: cyberattacks are persistent, targeted, and increasingly sophisticated.
In these crises, Stibbe, Valgaeren’s firm is often on the front lines—not only providing legal counsel but managing compliance fallout and reputational risk. The takeaway is simple: if you wait for a breach to prepare, you're already too late.
From GDPR to the Cyber Resilience Act: A Tangle of Acronyms with a Common Purpose
Valgaeren dissected the increasingly crowded regulatory environment, which many businesses find daunting. Yet, he emphasized that these regulations share a common goal: reinforcing digital trust and resilience.
What’s more concerning is not just the volume of rules, but the rigor of enforcement. Regulatory authorities are growing in both power and assertiveness. As Valgaeren warns: “Compliance missteps now carry real legal and financial consequences.”
Grey Areas, Big Risks
One of the thorniest challenges is ambiguity. Because EU directives like NIS2 require national implementation, interpretations can vary across member states. Valgaeren gave real-world examples of businesses puzzled about their obligations—like a firm with solar panels wondering if it falls under “energy sector” rules, or a cleaning product manufacturer unsure if it’s covered by NIS2.
Other complex areas include:
These aren’t academic questions—they have direct implications for compliance, liability, and risk exposure.
M&A: The Cyber Blind Spot
Valgaeren highlighted a frequently overlooked vulnerability: cyber readiness in mergers and acquisitions. While businesses routinely assess legal, financial, and operational risks, they often neglect cybersecurity due diligence. In today’s threat environment, that’s a costly omission. Acquiring a company with poor cyber hygiene can mean inheriting latent breaches, regulatory liabilities, and reputational fallout.
Charting a Way Forward: From Chaos to Control
Despite the growing complexity, Valgaeren offered a pragmatic blueprint for businesses:
And above all, Valgaeren reminded attendees of a fundamental legal principle: the duty of due care. Known in civil law as the obligation of the bonus pater familias (a good family father), this principle means businesses are expected to act prudently. Regulatory compliance is, in many ways, simply formalizing that basic expectation.
Conclusion: From Regulation to Opportunity
Valgaeren closed on a positive note: “Cybersecurity compliance isn’t about fear—it’s about responsibility, resilience, and readiness.” Companies that take cybersecurity seriously aren’t just checking regulatory boxes—they’re gaining trust, protecting assets, and securing their long-term future.
In an age where digital risks can derail entire enterprises, navigating the regulatory storm isn’t just smart business. It’s essential leadership.