Home / Cybersecurity / NIS2 in Luxembourg / Energy

NIS2 for energy companies in Luxembourg

Energy is listed in Annex I of the NIS2 directive. Large companies are essential entities; medium companies are important entities. In Luxembourg, the rules come from the Law of 5 May 2026 transposing NIS2, applicable since 10 May 2026; the authority is the Institut Luxembourgeois de Régulation (ILR).

→ Talk to a cybersecurity advisor

Who is covered in this sector

• Electricity producers, suppliers, network operators, aggregators and storage operators
• Operators of EV recharging points serving end users
• District heating and cooling
• Oil, gas and hydrogen: production, storage, transmission, supply

Companies that only consume energy are not in scope because of that; a solar installer is not an energy operator (see the Cyber Resilience Act page if you sell connected devices).

The threats we see most in energy

• Ransomware that stops dispatching, billing or metering
• Attacks on remote access to substations, inverters or charging points
• Compromise through an OT maintenance supplier
• Phishing of control-room and field staff

Five priority measures

1. 01 Separate office IT from operational technology (OT) networks
2. 02 Inventory every remote access path and put MFA on it
3. 03 Test offline backups of billing and control systems
4. 04 Contractual security clauses with OT and maintenance suppliers
5. 05 A 24-hour incident reporting routine tested once a year

What Luxembourg requires

• The law of 5 May 2026 was published in the Mémorial A (No. 225) and has applied since 10 May 2026.
• The competent authority is the ILR. Self-registration was due within two months, i.e. by 10 July 2026.
• Entities must adopt a cyber-risk management policy covering the ten minimum measures of the directive (risk analysis, incident handling, business continuity, supply-chain security, cryptography…).
• Incident reporting: early warning within 24 hours, notification within 72 hours, final report within one month.

Significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month. Fines set by the directive: up to €10 million or 2% of worldwide turnover for essential entities, and up to €7 million or 1.4% for important entities (whichever is higher).

Tools and guides

Energy in other countries

Other sectors in Luxembourg

Frequently asked questions

Is my energy companie company in scope of NIS2 in Luxembourg?

Energy is an Annex I sector. Large companies are essential entities; medium companies are important entities. Small companies are generally out of scope unless designated. Our NIS2 check gives you the answer in two minutes.

What should we do first?

Register if you are in scope, name an owner, run a short risk assessment, and fix the basics: MFA, tested backups, patching, incident routine.

We are a supplier to this sector. Does it affect us?

Yes, indirectly: your customers must secure their supply chain and will ask you for evidence. See our supplier questionnaire guide.

Sources

• Guichet.lu / ILR — NIS2
• PwC Luxembourg — NIS2 in Luxembourg
• Paperjam — Up to 2,000 entities face NIS2 deadline

Last checked: 28 September 2026. This page is general information, not legal advice.