Is NIS2 in force in Luxembourg?

Yes. The loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité was published in Mémorial A n° 225 on 6 May 2026 and entered into force on 10 May 2026, the fourth day after publication, under the default rule of the 2016 law on the Journal officiel. It repealed the 2019 NIS1 law, and the European Commission closed its infringement case INFR(2024)0282 on 8 July 2026.

Who supervises NIS2 in Luxembourg, the ILR or the CSSF?

The Institut luxembourgeois de régulation (ILR) for the sectors of Annexes I and II and for critical entities. By derogation, the CSSF for banking and financial market infrastructures, and for digital infrastructure and ICT service management as regards the activities it supervises (Art. 3). The HCPN is the single point of contact (Art. 5).

Where does a Luxembourg entity notify a significant incident, and how fast?

To the competent authority, not to a CSIRT: the ILR through SERIMA (serima.lu/notification), or the CSSF for the entities in its remit. The authority forwards the notification to CIRCL or GOVCERT.LU and to the single point of contact (Art. 14(1)). From awareness: a notification préliminaire within 24 hours, a notification d'incident within 72 hours, and a final report at the latest one month after the 72-hour notification (Art. 14(4)).

What do essential entities in Luxembourg have to send the ILR about their security measures?

Essential entities notify the measures they take to the competent authority (Art. 12(3)). The ILR asks them every year for a description of the measures in place, an analysis of the main cyber-risk scenarios and a multi-annual action plan, and may ask some of them for the list of their dependencies on direct suppliers. Important entities are exempt unless there is evidence that they do not comply. The format and deadlines belong to ILR regulations that had not been adopted on 28 October 2026.

← Back to Reglyze

Transposed & Enforced

NIS2 in Luxembourg

Everything you need to know about the NIS2 directive in Luxembourg: transposition law, competent authority, fines, deadlines, and how Reglyze helps SMEs become compliant.

Luxembourg transposed NIS2 with the loi du 5 mai 2026, published in Mémorial A n° 225 and in force since 10 May 2026. The Institut luxembourgeois de régulation (ILR) supervises most sectors and the CSSF supervises its part of the financial and digital market. What sets Luxembourg apart is the reporting route: a significant incident is notified to the competent authority through SERIMA, which forwards it to CIRCL or GOVCERT.LU, and essential entities also notify the security measures they take, with three annual deliverables expected by the ILR.

Key facts at a glance

Transposition Law

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité (Mémorial A n° 225 du 6 mai 2026)

In force since: 2026-05-10

Competent Authority

Institut luxembourgeois de régulation (ILR); the CSSF for banking, financial market infrastructures and the digital and ICT-service activities it supervises (ILR)

https://www.ilr.lu/en/sectors/niss/nis-2/

Fines — Essential

Up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for breaches of the risk-management or incident-notification duties (Art. 26(4)); a periodic penalty of at most EUR 1,250 a day and EUR 25,000 in total may be added (Art. 26(7))

Fines — Important

Up to EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher, for the same breaches (Art. 26(5)); registration, governance, training and domain-data duties carry their own sanctions, a fine of at most EUR 250,000 among them (Art. 25(1))

These ceilings come from the directive — see how NIS2 fines are calculated, recent enforcement cases and director personal liability.

Start now in Luxembourg: nothing to redo later

Reglyze runs your Luxembourg NIS2 compliance on the EU baseline today: scoping, the AI-guided assessment, AI-drafted documents and incident notification to CIRCL (GOVCERT.LU for the State, public establishments and critical entities), reached through the competent authority: entities file with the ILR on SERIMA, which forwards the notification.

Your national rules (Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité (Mémorial A n° 225 du 6 mai 2026)) layer national specifics on top of NIS2. When they apply to you, what you have built carries straight over: your scores, your documents and your evidence are kept, not reset. You simply add the national layer (registration with ILR and local incident notification) onto your existing work. You never start from scratch.

Priority sectors for NIS2 in Luxembourg

NIS2 covers 18 sectors across Annex I (highly critical) and Annex II (other critical); the class depends on the annex and the size together, and an Annex II entity is never essential by its size alone. These are the sectors where Luxembourg's transposition and ILR supervision focus most.

Banking, financial market infrastructures and the activities the CSSF supervises

The CSSF, not the ILR, is the competent authority for credit institutions and financial market infrastructures (Annex I, points 3 and 4) and for digital infrastructure and ICT service management as regards the activities that fall under its supervision (Art. 3). Where a sectoral EU act imposes at least equivalent risk-management or incident-reporting duties, the matching provisions of the act do not apply (Art. 1(8)).

Digital infrastructure, cloud, data centres and managed ICT services

Trust service providers, TLD registries and DNS providers are in scope whatever their size, and qualified trust service providers, TLD registries and DNS providers are essential entities (Arts. 1(2) and 11(1)). Cloud, data-centre, content-delivery, managed and managed security service providers file a separate set of information under Art. 17 and notify any change within three months. Trust service providers notify incidents within 24 hours, not 72.

Energy, transport, health and water: the former operators of essential services

Every entity identified as an operator of essential services under the 2019 NIS1 law before 10 May 2026 is an essential entity (Art. 11(1) 7°). Essential entities are supervised under Art. 22 (ex ante and ex post, in the ILR's words), notify their security measures (Art. 12(3)) and are asked by the ILR for an annual description of their measures, a cyber-risk scenario analysis and a multi-annual action plan.

Key deadlines

2026-05-06

The loi du 5 mai 2026 was published in Mémorial A n° 225, repealing the 2019 NIS1 law (Art. 30).

2026-05-10

The act entered into force on the fourth day after its publication, under Art. 4 of the loi du 23 décembre 2016 on the Journal officiel, since it sets no date of its own.

2026-07-10

The self-registration window closed: entities had two months from entry into force to file their information with the competent authority (Art. 11(4)), through the ILR's self-registration form; changes are notified within two weeks.

Is your company in scope? Common Luxembourg scenarios

Two worked examples of how NIS2 scoping plays out in Luxembourg. Not sure where you land? Run the free NIS2 scope checker.

A 60-person managed IT services provider in Luxembourg City

In scope, important entity

ICT service management (business-to-business) is an Annex I sector and a medium-sized provider is in scope as an important entity (Art. 11(2)). It had to self-register with the ILR by 10 July 2026, notifies significant incidents to the ILR on SERIMA within 24 and 72 hours, and is supervised ex post. If its activities fall under CSSF supervision, the CSSF is its competent authority instead (Art. 3).

A 20-person trust service provider

In scope whatever its size

Trust service providers are covered regardless of size (Art. 1(2) 1°); a qualified one is an essential entity (Art. 11(1) 2°), a non-qualified one an important entity unless the authority designates it otherwise. Either way it notifies significant incidents affecting its trust services within 24 hours of becoming aware of them, instead of 72 (Art. 14(4)).

What Luxembourg businesses need to know

Luxembourg transposed NIS2 with the loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, published in Mémorial A n° 225 on 6 May 2026 and in force since 10 May 2026. It repealed the NIS1 law of 28 May 2019 (Art. 30), and the European Commission closed its infringement case INFR(2024)0282 on 8 July 2026.
The Institut luxembourgeois de régulation (ILR) is the competent authority for the sectors of Annexes I and II and for critical entities. By derogation the CSSF is competent for banking and financial market infrastructures, and for digital infrastructure and ICT service management as regards the activities it supervises (Art. 3).
Significant incidents are notified to the competent authority, not to a CSIRT: the ILR receives them through SERIMA and forwards them to the CSIRT concerned and to the HCPN, the single point of contact (Art. 14(1)). The CSIRT is GOVCERT.LU for the State, public establishments and critical entities, and CIRCL for every other case (Art. 7(1)).
The clock runs from awareness: a notification préliminaire within 24 hours, a notification d'incident within 72 hours and a final report at the latest one month after the 72-hour notification, with a progress report if the incident is still running (Art. 14(4)). Trust service providers notify within 24 hours.
Essential entities notify the security measures they take to the competent authority (Art. 12(3)). The ILR asks them every year for a description of the measures in place, an analysis of the main cyber-risk scenarios and a multi-annual action plan; important entities are exempt unless there is evidence that they do not comply.
There is no national control catalogue: Art. 12(2) lists ten measures in general terms, and the ILR's draft regulations on the notification of measures and of incidents were consulted from July to August 2026 and had not been adopted on 28 October 2026.
Operators of essential services identified under the 2019 law before the act's entry into force are essential entities (Art. 11(1) 7°). Management bodies approve and supervise the measures, can be held responsible and must be trained (Art. 13).

How ILR enforces NIS2 in Luxembourg

The ILR and, within its remit, the CSSF supervise. Essential entities can be subjected to on-site inspections, regular and targeted security audits and security scans (Art. 22), which the ILR describes as ex ante and ex post supervision; important entities are supervised ex post, on evidence of non-compliance (Art. 23). Breaches of the risk-management and incident-notification duties carry administrative fines of at most EUR 10 million or 2% of total worldwide annual turnover for essential entities and EUR 7 million or 1.4% for important ones, whichever is higher (Art. 26(4) and (5)), with a periodic penalty of at most EUR 1,250 a day and EUR 25,000 in total (Art. 26(7)). Registration, governance, training and domain-data duties have their own regime: a warning, a reprimand or a fine of at most EUR 250,000 (Art. 25(1)). For an essential entity, if its earlier measures have not worked, the authority can ask the président du Tribunal d'arrondissement de Luxembourg to suspend a certification or temporarily ban a manager (Art. 22(5)). Decisions can be appealed before the tribunal administratif (Art. 25(4)).