NIS2by country

NIS2 in Luxembourg

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité

Law in force since

Law
NIS 2 Act
Authority
Luxembourg Regulatory Institute (ILR)
Classes
entité essentielle (essential), entité importante (important)
Register
ILR self-registration form
ISO 27001
Not named in the law
Self-check
ILR NIS 2 simulator

Check your company for Luxembourg

Get the NIS2 dates for Luxembourg

  • 2 dates as a calendar file.
  • An alert when the rules change.

This site stores your email and emails you when the NIS2 rules in Luxembourg change. Unsubscribe at any time.

The law

The law took effect on 2026-05-10. It repeals the earlier NIS 1 law. The ILR issued Regulation ILR/N26/10 on 2026-10-26 to set the yearly security-measure notification.

Name
Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécuritéLaw of 5 May 2026 on measures for a high level of cybersecurity (NIS 2 Act)
Published
2026-05-06
In force
2026-05-10
Text
Read the NIS 2 Act

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

The Luxembourg law keeps the Directive's size and class rules.

Also note

  • Public administration entities are essential entities.
  • Entities that the authority named operators of essential services before the law are essential entities.

Registration

Register yourself with the competent authority by 2026-07-10. That is 2 months after the law took effect. Report a change within 2 weeks. A missed registration does not remove your duties. Registrations made before the law stay valid if the data is correct.

Portal
ILR self-registration form
Rule
Fixed deadline
Deadline
2026-07-10
You need
The ILR online form. It asks for entity data, including entity size and group size.
Changes
Report changes to your data within 14 days

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the incident notification

Send the reports to the competent authority (ILR or CSSF), through the SERIMA platform.

Trust service providers notify within 24 hours. The ILR page says an extension of up to 1 month is possible for the final report.

Measures and proof

Essential
Essential entities face supervision before and after an incident. They notify the ILR each year of their measures, a risk-scenario analysis and a multi-year action plan.
Important
Important entities face supervision after the fact only. They skip the routine submissions unless there is evidence of non-compliance.

The dates, in order

  1. NIS 2 Act in force
  2. Self-registration deadline
  3. Regulation ILR/N26/10 in force Next
  4. First yearly security-measure notification for essential entitiesEssential entities only. Derived from a rule in the law

Duties of management

Management bodies approve the security measures and supervise them. They can be held liable for breaches. Members must follow regular training.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, Art. 26(4)-(5) NIS 2 Act. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

Breaches of some duties carry a lower ceiling of EUR 250,000. Periodic penalties reach EUR 1,250 per day, with a total cap of EUR 25,000.