New habits of trust

The news: a national proposal, a local decision

On 16 September 2026, Vanessa Matz presented a proposed AI Strategy 2.0. The announcement describes a basis for developing a national strategy with Belgium’s federated entities, not a new general obligation on businesses. Its ambition to retain control of AI use nevertheless poses a practical question for SMEs and non-profits: who approves tools, for which documents and with which safeguards? [1]

On 29 May, Belgium’s Data Protection Authority highlighted risks in chatbot conversations. Free-text exchanges can include highly personal data; retention must be justified and uses explained. This was an Inspectorate communication, not a sanction decision concerning the fictional scenario above. [2]

A business account is not legal immunity

Where personal data are processed, the GDPR requires, among other things, a lawful basis, a defined purpose, data minimisation and appropriate protection. The controller must be able to demonstrate compliance. Purchasing a business licence does not, by itself, provide that demonstration. A product label cannot establish what actually happens to a particular document. [3]

Examine the organisation’s and provider’s actual roles. If the provider acts as a processor, Article 28 governs that relationship. A data protection impact assessment is required where the intended processing is likely to result in a high risk, not automatically whenever AI corrects a piece of text. [4]

Not all confidential information is personal data. Negotiated prices and business plans also require attention to contractual confidentiality commitments. Conversely, removing a name does not necessarily prevent identification through the remaining details. The assessment concerns the software, but also the content, context and destination of the information.

An enacted reform, not a universal rate

This overview primarily concerns Belgian-resident individuals holding securities as part of their private assets. You sell securities. The proceeds appear in your account. Yet that amount does not tell you your taxable gain or what you will retain after tax. The decisive question is not simply: “What rate applies?” It is also: “What starting value can I establish?” This article concerns Belgian tax law.

The Act of 6 April 2026, published in the Belgian Official Gazette on 21 April, introduced a tax on capital gains on financial assets, taking effect from 1 January 2026. This is no longer merely a government announcement. However, the tax applying since January must be distinguished from the statutory withholding mechanism starting on 1 June, which is subject to transitional rules. [1]

Four distinctions that protect the calculation

Classify before calculating. The legislation distinguishes internal transfers, shareholdings of at least 20% and the ordinary regime. A private portfolio, a holding in your own company and a business asset are not interchangeable. A professional transaction or one outside the normal management of private assets requires a different analysis. “Ten per cent on everything” is therefore misleading. [1]

Establish the starting value. For assets acquired before 2026, the reference is generally their value on 31 December 2025: the last closing price of 2025 for listed securities, and specific statutory valuation methods for unlisted securities. Subject to the statutory conditions, a proven historical acquisition value may be relied upon for disposals up to 31 December 2030. This does not permit a free choice of valuation. [1]

Evidence genuinely matters. Without reliable evidence of the acquisition value, the proceeds received may constitute the taxable capital gain. A statement, subscription agreement or transaction history passed on with a gift is therefore more than an archive. For the products it describes, the Belgian Debt Agency stresses the importance of preserving these records when securities have been gifted, inherited or transferred. [1,2]

Separate withholding from the final tax. Under the ordinary regime, the annual exemption is €10,000 for 2026. Withholding by the intermediary does not take that exemption into account. Where withholding tax has been deducted, claiming the exemption requires a request for credit and, where applicable, a refund through the tax return, with supporting documents available. Losses cannot be offset without limits: they must concern the same taxpayer, the same taxable period and the same statutory category. [1,2]

A documented risk, not a newly invented alert

On 24 January 2026, Belgium’s federal prosecutor and Centre for Cybersecurity warned about scams impersonating the King and other public figures. Business leaders were among those targeted. The announcement describes video images as likely AI-generated. That wording matters: it is not public forensic confirmation of every individual recording. [1]

The fraud does not always depend on spectacular technology. Safeonweb also describes preparatory research into an organisation, impersonation of a trusted person, and requests for money or information. Urgency and secrecy are used to bypass controls. Convincing video strengthens an appearance; it does not authorise a transaction. [2,3]

Recognition, authority and evidence are different questions

A credible request is not necessarily authentic. Even if an identity is verified, the transaction must still be approved through the organisation’s decision-making process. Our practical approach separates three steps: recognising the person, checking the instruction and confirming the necessary authority. Success at one step should not silently replace the others.

If the incident also reveals a personal data breach, a separate GDPR assessment is required. Under Article 33, the controller notifies the supervisory authority without undue delay and where feasible within 72 hours of awareness, unless the breach is unlikely to result in a risk to rights and freedoms. The processor informs the controller without undue delay. Informing affected individuals involves a high-risk threshold and the conditions of Article 34. Not every impersonation call therefore automatically triggers a GDPR notification. [4]

Neither recovery of funds nor reimbursement can be promised merely because impersonation is alleged. The facts, transactions and applicable legal framework require examination. Prevention, reporting and securing relevant information can proceed without prejudging that assessment. An urgent operational response and a legal conclusion are not the same thing.