Criminal law and criminal procedure basics
You need the architecture of Belgian criminal law: the offence requires a legal basis, a material element (actus reus), and a moral element (mens rea - intention or negligence). Know the distinction between crimes (misdaad/infraction), delicts and contraventions (the tripartite classification), and the notions of attempt, complicity, and justification grounds (self-defence, necessity, lawful authority, consent where valid).
Criminal procedure: the flagrant offence (ontdekking op heterdaad / flagrant délit) is central for guards. The Criminal Procedure Code allows anyone to arrest a person caught in the act of a crime punishable by imprisonment, and to bring him before a police officer - but this is a citizen's arrest, strictly limited, and the person must be handed to police immediately. Guards cannot detain for investigation, cannot interrogate, cannot search. The police have powers of identity check and arrest that guards lack.
Traps: (1) confusing detention with citizen's arrest; (2) thinking a guard may use force to recover stolen goods - force is only justified under self-defence or necessity, proportionately; (3) confusing civil liability with criminal responsibility; (4) assuming an offence is flagrant when the guard only has suspicion. Also know prescription periods and the role of the procureur des Konings / procureur du Roi.
Worked example: A man runs out of a store with a stolen jacket; the guard sees him take it. This is flagrant. The guard may stop him, use minimum necessary physical contact, recover the item, and call police; he must not search him or hold him for hours. Rule of thumb: the clock runs from the flagrant act; the sooner police take over, the better.
Know also offences against persons (assault, threats), against property (theft with aggravating circumstances, vandalism), and public-order offences.