Luxembourg transposed NIS2 through the Law of 5 May 2026, in force since 10 May 2026. It covers medium and large companies in eighteen sectors, plus some entities of any size. The ILR supervises most of them, and in-scope entities had to register by 10 July 2026. Significant incidents must be reported within 24 hours, and fines reach EUR 10 million or 2% of worldwide turnover.
This guide covers the law’s timeline, who is in scope, essential versus important entities, who supervises you, registration, the ten measures, the management body’s duties, incident reporting, supervision and fines, the overlaps with GDPR and DORA, and what to do now. It is not legal advice.
| Luxembourg NIS2 law | |
|---|---|
| Law | Law of 5 May 2026 on measures to ensure a high level of cybersecurity (Mémorial A 225), in force 10 May 2026 |
| Competent authority | ILR for most sectors; CSSF for banking, financial market infrastructures and the activities it already supervises |
| CSIRT | CIRCL for most private entities; GOVCERT.LU for State bodies and critical entities |
| Registration | Article 11(4): within two months of entry into force, so by 10 July 2026; changes within two weeks |
| Security measures | Article 12: ten measures, identical to Article 21(2) of the directive |
| Management body | Article 13: approves the measures, oversees them, can be held liable, must be trained |
| Incident reporting | Article 14: early warning in 24 hours, notification in 72 hours, final report in one month |
| Fines | Article 26: up to EUR 10M or 2% (essential), EUR 7M or 1.4% (important); Article 25: up to EUR 250,000 for other duties |
For the directive itself, see the NIS2 compliance guide. For how CloudSoul handles the programme end to end, see NIS2 compliance.
When did NIS2 enter into force in Luxembourg?
The Law of 5 May 2026 was published in the Official Journal (Mémorial A 225) and has applied since 10 May 2026. The bill was filed as Parl. doc. 8364. The full text is on Legilux at legilux.public.lu/eli/etat/leg/loi/2026/05/05/a225/jo.
It replaces the Law of 28 May 2019 that transposed NIS1, which Article 30 expressly repeals, and amends the laws on electronic commerce, on the High Commission for National Protection (HCPN) and on electronic communications networks and services.
If you were an operator of essential services under NIS1, you do not start from a clean slate. Article 11(1), point 7°, carries previously designated operators over as essential entities. The designation carries over; your compliance posture does not. The differences between the two regimes are in NIS1 vs NIS2: key differences.
Who is in scope of NIS2 in Luxembourg?
Article 1 mirrors the directive’s two-step test.
Sector plus size. The entity must be of a type listed in Annex I or Annex II, and be at least a medium-sized enterprise under Commission Recommendation 2003/361/EC.
- Annex I lists eleven sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, ICT service management (business to business), public administration and space.
- Annex II lists seven other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers (online marketplaces, search engines, social networks) and research.
Regardless of size. Article 1(2) to (4) also brings in:
- providers of public electronic communications networks and services, trust service providers, top-level domain registries and DNS service providers;
- the sole provider in Luxembourg of a service essential to critical societal or economic activities;
- entities whose disruption could significantly affect public safety, security or health, or create significant systemic risk;
- entities critical at national or regional level;
- public administration entities;
- entities identified as critical under the Law of 5 May 2026 on the resilience of critical entities;
- entities providing domain name registration services.
Financial sector. Financial entities covered by DORA (Regulation (EU) 2022/2554) follow DORA’s equivalent risk-management and incident-reporting rules, so under Article 1(8) the matching provisions of the NIS2 law do not apply to them. Article 1(5) separately excludes the entities that DORA itself allows Member States to leave out, under its Article 2(4). The boundary is covered in NIS2 and the financial sector and NIS2, DORA and CER.
The fastest first check is the NIS2 scope checker, which walks through sector and size in three clicks. The scoping logic is explained in NIS2 scope and applicability, and what it means for smaller companies in does NIS2 apply to SMEs.
Is your company an essential or an important entity?
Article 11 decides the category, and the category decides how you are supervised.
Essential entities (Article 11(1)) include:
- Annex I entities above the ceilings for medium-sized enterprises, in other words large companies in the eleven high-criticality sectors;
- qualified trust service providers, top-level domain registries and DNS service providers, whatever their size;
- providers of public electronic communications networks or services that are medium-sized;
- public administration entities;
- entities the competent authority designates as essential, entities identified as critical under the resilience law, and former NIS1 operators of essential services.
Important entities (Article 11(2)) are every other in-scope entity of a type in Annex I or II, including those the authority designates as important. In practice, most medium-sized companies in scope are important entities.
The comparison of obligations and supervision is in essential vs important entities.
Who supervises NIS2 in Luxembourg?
The law names each body and its role, which tells you exactly who you deal with.
| Body | Role under the law |
|---|---|
| ILR (Institut Luxembourgeois de Régulation) | Competent authority for the sectors in Annexes I and II and for critical entities (Article 3): inspects, audits, issues instructions and fines |
| CSSF (Commission de surveillance du secteur financier) | Competent authority for banking and financial market infrastructures, and for digital infrastructure and ICT service management activities it already supervises (Article 3) |
| HCPN (Haut-Commissariat à la Protection nationale) | Single point of contact for cross-border cooperation (Article 5) and cyber crisis authority, representing Luxembourg in EU-CyCLONe (Article 6) |
| GOVCERT.LU | CSIRT for State administrations and services, public establishments and critical entities (Article 7(1)), operated by the HCPN |
| CIRCL | CSIRT for every other case (Article 7(1)) and coordinator for vulnerability disclosure (Article 9), operated by the Luxembourg House of Cybersecurity |
The ILR’s NIS2 page is at ilr.lu/en/sectors/niss/nis-2. The EU-wide pattern behind these roles is in NIS2 institutional architecture.
The law also amends the HCPN law to require a national cybersecurity strategy, reviewed at least every five years, and a national response plan for large-scale cyber crises. The background is in national cybersecurity strategies under Article 7 and the Cooperation Group, EU-CyCLONe and the CSIRTs network.
How do you register with the ILR?
General registration (Article 11(4)). Entities had to send the competent authority, within two months of the law entering into force, so by 10 July 2026:
- the entity’s name;
- its address and up-to-date contact details, including email addresses, IP ranges and telephone numbers;
- where relevant, its sector and subsector from Annex I or II;
- where relevant, the EU Member States in which it provides services in scope;
- its size and, where relevant, the size of its group.
Any change must be notified within two weeks. The law requires the authorities to offer self-registration, and the ILR publishes its registration form on its NIS2 page. The authority then confirms whether you are an essential or an important entity. The step-by-step process is in NIS2 registration with the ILR.
If you are in scope and did not register, do it now. The deadline has passed, and Article 25 sanctions a breach of Article 11(4) with a warning, a reprimand or a fine of up to EUR 250,000.
Digital-sector registration (Article 17). DNS service providers, top-level domain registries, domain registration services, cloud and data centre providers, content delivery networks, managed service providers, managed security service providers, and online marketplaces, search engines and social networks submit a fuller dataset, and notify changes to it within three months. The single point of contact forwards it, without the IP ranges, to ENISA for the EU registry. See are MSPs and MSSPs regulated under NIS2 and NIS2 for cloud and data centres.
What security measures does Article 12 require?
Article 12 is the operational core. Essential and important entities take appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach. The ten categories are identical to Article 21(2) of the directive:
- policies on risk analysis and information system security;
- incident handling;
- business continuity, including backup management, disaster recovery and crisis management;
- supply-chain security, including the security aspects of relationships with direct suppliers and service providers;
- security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure;
- policies and procedures to assess the effectiveness of the measures;
- basic cyber-hygiene practices and cybersecurity training;
- policies and procedures on cryptography and, where appropriate, encryption;
- human resources security, access control policies and asset management;
- multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems, as appropriate.
Two Luxembourg-specific points:
- Essential entities notify their measures. Article 12(3) requires essential entities to notify the competent authority of the measures they have taken, in a format and timeline the ILR or CSSF sets by regulation or circular. Expect a structured submission, not a one-line confirmation.
- Supply-chain assessments count. Article 12(4) requires entities to take into account the results of the EU coordinated risk assessments of critical supply chains under Article 22 of the directive.
Each measure is explained in the ten measures of NIS2 Article 21. The all-hazards principle is covered in the all-hazards approach, and suppliers in supply chain security under NIS2. If you already hold ISO 27001, most of the work maps across, as set out in ISO 27001 vs NIS2.
What must the management body do?
Article 13 is short and consequential. The management bodies of essential and important entities:
- approve the cybersecurity risk-management measures;
- oversee their implementation;
- can be held liable for breaches of Article 12;
- must follow regular training, and the entity must offer similar training to its staff.
Cybersecurity is therefore a board matter, with documented approval, oversight and training records. What a defensible governance record looks like is in board accountability under NIS2.
How do you report an incident under the Luxembourg NIS2 law?
Article 14 reproduces the directive’s three clocks for significant incidents, reported to the competent authority:
| Step | Deadline | Content |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Whether the incident is suspected to be unlawful or malicious, and whether it could have cross-border impact |
| Incident notification | Within 72 hours | An update with an initial assessment of severity and impact and, where available, indicators of compromise |
| Final report | Within one month of the notification | Detailed description, root cause, mitigation applied and ongoing, cross-border impact |
If the incident is still being handled at one month, you send a progress report, then a final report within one month of closing it. Trust service providers work to a single 24-hour notification clock. The ILR asks entities to report incidents through its SERIMA platform. What each report must contain, with a template, is in NIS2 incident notification in Luxembourg.
An incident is significant under Article 14(3) if it has caused or can cause severe operational disruption or financial loss for the entity, or considerable material or non-material damage to others. The authority forwards notifications to the CSIRT and the single point of contact, and gives an initial response within 24 hours where possible.
Running the clocks is covered in the NIS2 incident reporting timeline, and the hardest call in the first 24 hours in what makes an incident significant.
Does the Luxembourg law require certification?
Not yet. Article 15 allows the competent authority, by regulation, to require the use of ICT products, services or processes certified under European schemes adopted under the Cybersecurity Act (Regulation (EU) 2019/881), and encourages qualified trust services. It signals direction rather than a mandate today. How ISO 27001 fits is covered in NIS2, ISO 27001 and certification schemes.
How is NIS2 supervised and enforced in Luxembourg?
The law draws a clear line between the two categories.
- Essential entities (Article 22) face supervision before and after the fact: on-site inspections, off-site supervision including random checks, regular and targeted audits, ad hoc audits after significant incidents, security scans and information requests. The authority can require an audit by an independent body at the entity’s cost.
- Important entities (Article 23) face supervision after the fact, typically triggered by signs of non-compliance.
Both face warnings, binding instructions, orders to remedy deficiencies or inform service recipients, orders to implement audit recommendations, public disclosure of infringements, and fines. Essential entities can also be given a monitoring officer to oversee compliance. For essential entities only, if those measures fail, the authority can ask the President of the District Court for a temporary suspension of a certification or authorisation, or a temporary ban on the CEO or legal representative exercising management functions.
How authorities use these tools is in NIS2 enforcement powers.
What are the NIS2 fines in Luxembourg?
| Breach | Maximum fine |
|---|---|
| Article 12 measures or Article 14 reporting, essential entity (Article 26) | EUR 10,000,000 or 2% of total worldwide annual turnover, whichever is higher |
| Article 12 measures or Article 14 reporting, important entity (Article 26) | EUR 7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher |
| Registration (Art. 11(4)), management body (Art. 13(1) and (2)), certification (Art. 15), digital-sector registration (Art. 17), DNS data (Art. 18) (Article 25) | EUR 250,000, or a warning or reprimand |
| Periodic penalty payment to end a breach (Article 26(7)) | EUR 1,250 per day, capped at EUR 25,000 per breach |
The Administration of Registration, Domains and VAT (AED) recovers the fines, and an action for reformation lies before the Administrative Court. The procedure is adversarial: you can consult the file, submit observations and be represented.
When setting a fine, the authority weighs the gravity and duration of the breach, previous breaches, damage caused, intent or negligence, mitigation taken, certification, and cooperation. Repeated breaches, failing to report or remedy significant incidents, obstructing audits and giving false information are always serious (Article 22(7)). The EUR 10 million and EUR 7 million caps are explained in administrative fines under NIS2.
How does the NIS2 law interact with GDPR and DORA?
- GDPR (Article 24). If supervision suggests a personal data breach, the NIS2 authority informs the CNPD without delay. Where the CNPD fines the same conduct under Article 58(2)(i) GDPR, the ILR or CSSF cannot add a NIS2 fine, but can still use its other measures. See NIS2 and GDPR.
- DORA. For financial entities covered by DORA, DORA’s rules count as equivalent under Article 1(8), so the matching NIS2 provisions do not apply; for entities or activities DORA does not cover, the NIS2 law continues to apply.
- Equivalent sector rules (Article 1(8)). Where another EU act imposes at least equivalent risk-management and incident-notification duties, the matching provisions of the NIS2 law, including supervision under Chapter 6, do not apply.
Sector guides: energy, transport, healthcare, cloud and data centres and MSPs and MSSPs.
What should you do now?
- Confirm scope and category. Run the NIS2 scope checker, or have counsel review Article 1 and Article 11 against your activities.
- Identify your authority. The ILR in the default case, the CSSF for banking, financial market infrastructures and CSSF-supervised activities.
- Register, or update your registration. The Article 11(4) deadline was 10 July 2026, and changes are due within two weeks. Digital providers also submit the Article 17 dataset and update it within three months of any change.
- Brief the management body. Document its approval of the measures, its oversight and its training under Article 13.
- Set up incident reporting. Map detection, classification and notification to the 24-hour, 72-hour and one-month clocks, and know how to reach SERIMA.
- Close the Article 12 gaps. Map your controls against the ten categories and start with the weakest, usually suppliers and MFA.
- Keep the evidence. Cooperation and demonstrable diligence count in the fine calculation, so build the record before the first audit.
Sources
- Law of 5 May 2026 on measures to ensure a high level of cybersecurity (Mémorial A 225), Legilux.
- ILR, NIS 2 page, ilr.lu/en/sectors/niss/nis-2.
- Directive (EU) 2022/2555 (NIS2), EUR-Lex, and the Commission’s NIS2 page.
- Regulation (EU) 2022/2554 (DORA), and Commission Recommendation 2003/361/EC on the definition of SMEs.
The ILR and the CSSF publish implementing regulations and circulars over time. Check the ILR NIS2 page for the latest guidance before finalising operational decisions.
Frequently asked questions
When did NIS2 enter into force in Luxembourg?
On 10 May 2026. Luxembourg transposed the directive through the Law of 5 May 2026 on measures to ensure a high level of cybersecurity, published in the Mémorial as A 225. It repeals the Law of 28 May 2019 that transposed NIS1.
Who is the NIS2 competent authority in Luxembourg?
The Institut Luxembourgeois de Régulation (ILR) for most sectors. The CSSF is competent for banking and financial market infrastructures, and for digital infrastructure and ICT service management activities it already supervises. CIRCL is the CSIRT for most private entities; GOVCERT.LU covers State bodies and critical entities.
What was the NIS2 registration deadline in Luxembourg?
Entities had to send their details to the competent authority within two months of the law entering into force, so by 10 July 2026, and must report any change within two weeks. The ILR runs a self-registration form. Failing to register can be sanctioned with a fine of up to EUR 250,000.
How quickly must you report an incident under NIS2 in Luxembourg?
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the notification. The ILR asks entities to report through its SERIMA platform.
What are the NIS2 fines in Luxembourg?
For breaches of the Article 12 measures or the Article 14 reporting duties, up to EUR 10 million or 2% of worldwide annual turnover for essential entities, and up to EUR 7 million or 1.4% for important entities, whichever is higher. Registration, management-body and certification breaches carry fines of up to EUR 250,000, and daily penalty payments of up to EUR 1,250 can be added.
