Tech··4 min
NIS2 in Luxembourg: which companies are affected and where to start
Since May 2026, the law transposing the NIS2 directive has imposed new cybersecurity obligations on hundreds of Luxembourg companies. Here is how to find out whether you are affected, and what to do if you missed the 10 July deadline.
Translated from French · Lire l'original en français
Since 10 May 2026, the law of 5 May 2026 “concernant des mesures destinées à assurer un niveau élevé de cybersécurité” (“on measures for a high common level of cybersecurity”) has transposed the European NIS2 directive (EU 2022/2555) into Luxembourg law, according to the Institut Luxembourgeois de Régulation (ILR). Published in Mémorial A 225, it extends cybersecurity obligations well beyond the large established operators, to industrial, logistics and agri-food SMEs that did not think they were concerned.
The ILR, single point of contact for the new law
The ILR acts as lead competent authority and single point of contact for NIS2 in Luxembourg, according to its own information. The CSSF retains its specific competence for the banking sector and financial market infrastructures, which avoids double registration for institutions already supervised by the Commission de surveillance du secteur financier. For any company outside finance, registration, incident notification and compliance questions therefore go to the ILR.
Am I affected? Two categories, precise thresholds
The law distinguishes two categories of entities, according to their size and sector of activity, based on the government press release of 6 July 2026.
| Category | Thresholds | Sectors concerned |
|---|---|---|
| Essential entities | ≥ 250 employees, or turnover > €50 million, or balance sheet > €43 million | Sectors of high criticality in Annex I: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public administration, space |
| Important entities | ≥ 50 employees, or turnover > €10 million | Annex I SMEs, or Annex II companies: manufacturing, online platforms, food production, postal services, waste management, chemicals, research |
In practice, this covers a broad spectrum: a hosting or cloud service provider falls under Annex I digital infrastructure and becomes an essential entity as soon as it exceeds the size thresholds, a Luxembourg haulier or logistics provider enters the same highly critical sector through transport, a clinic or laboratory falls under health, and a medium-sized food manufacturer can find itself an important entity under Annex II food production, even with a modest headcount. The right reflex is to cross-check your main sector of activity against your headcount, turnover and balance sheet, rather than relying on a sense of your size.
You missed the 10 July self-registration: what to do now
Entities concerned had to self-register with the ILR by 10 July 2026 at the latest, a deadline presented by the ILR at a press conference on 6 July 2026, according to gouvernement.lu. If your company passed that date without registering, the situation is not blocked: according to the ILR FAQ, the self-registration form remains continuously accessible, with no firm closing date announced. It is therefore better to regularise without delay rather than leave the matter pending, using the form and FAQ published by the regulator.
Failure to comply with the obligations of the law also exposes companies to fines of up to 10 million euros or 2% of annual worldwide turnover, according to gouvernement.lu. It is this scale of penalty that shows the risk of letting a late registration drag on.
Incident notification: the 24-hour countdown
Once registered, essential and important entities must notify any incident with a significant impact within 24 hours, according to gouvernement.lu. In practical terms, this means having identified in advance who, internally, receives the alert on a Sunday evening, who decides whether the incident crosses the threshold of an “impact important” (“significant impact”), and through which channel the notification is sent to the ILR. A company that discovers this procedure at the moment of the incident loses precious time on an already tight deadline. Further reading on this topic: Business backup solutions in Luxembourg.
- Check your status on the ILR self-registration form if you have not already done so.
- Designate an internal point of contact and a decision chain for incident notification within 24 hours.
- Consult the ILR NISS/NIS2 FAQ for questions specific to your sector.
What this article does not replace
This article gives reference points to help you position your company in relation to the law of 5 May 2026, not a definitive legal opinion: the exact classification of your entity (essential, important, or out of scope) depends on your specific situation and should be checked directly with the ILR, via its NIS2 page and dedicated FAQ. For companies working in parallel on other digital regulatory projects, our article on B2B e-invoicing with the State sets out a comparable compliance timetable.
