Home / Cybersecurity / NIS2 in Luxembourg

NIS2 in Luxembourg: what applies and what to do now

Law of 5 May 2026 transposing NIS2 — applies since 10 May 2026. Authority: the Institut Luxembourgeois de Régulation (ILR). Estimates of the number of Luxembourg entities in scope range from about 1,200 to 2,000.

→ Talk to a cybersecurity advisor

The essentials

• The law of 5 May 2026 was published in the Mémorial A (No. 225) and has applied since 10 May 2026.
• The competent authority is the ILR. Self-registration was due within two months, i.e. by 10 July 2026.
• Entities must adopt a cyber-risk management policy covering the ten minimum measures of the directive (risk analysis, incident handling, business continuity, supply-chain security, cryptography…).
• Incident reporting: early warning within 24 hours, notification within 72 hours, final report within one month.

Obligations once in scope

1. 01 Risk analysis and information-security policies
2. 02 Incident handling
3. 03 Business continuity, backups and crisis management
4. 04 Supply-chain security (your suppliers and service providers)
5. 05 Security in buying, developing and maintaining systems, including vulnerability handling
6. 06 Policies to assess whether the measures work
7. 07 Basic cyber hygiene and staff training
8. 08 Cryptography and encryption
9. 09 HR security, access control and asset management
10. 10 Multi-factor authentication and secured communications

Significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month.

Fines set by the directive: up to €10 million or 2% of worldwide turnover for essential entities, and up to €7 million or 1.4% for important entities (whichever is higher).

NIS2 by sector in Luxembourg

Not in scope yourself?

If you supply companies that are, you will receive their requirements. See the 30 questions of a supplier security questionnaire →

Other countries

Frequently asked questions

Does NIS2 apply to my company in Luxembourg?

It applies to medium and large companies in the sectors listed by the directive, and to some providers whatever their size. Use our free NIS2 check to get an answer for Luxembourg in two minutes.

Who is the authority in Luxembourg?

The Institut Luxembourgeois de Régulation (ILR).

What if we missed the registration deadline?

Register now and document the reason. Authorities look at good faith and at what you do next; staying unregistered is the worst option.

Sources

• Guichet.lu / ILR — NIS2
• PwC Luxembourg — NIS2 in Luxembourg
• Paperjam — Up to 2,000 entities face NIS2 deadline

Last checked: 28 September 2026. This page is general information, not legal advice.