Home / Cybersecurity / NIS2 in Luxembourg / Postal and courier services
NIS2 for postal and courier companies in Luxembourg
Postal and courier services is listed in Annex II of the NIS2 directive. Medium and large companies are important entities (lighter supervision, after the fact). In Luxembourg, the rules come from the Law of 5 May 2026 transposing NIS2, applicable since 10 May 2026; the authority is the Institut Luxembourgeois de Régulation (ILR).
→ Talk to a cybersecurity advisor
Who is covered in this sector
- Postal service providers
- Courier and parcel services
Pure freight haulage is not a postal service; but check whether your customers impose NIS2 requirements on you.
The threats we see most in postal and courier services
- Ransomware on sorting, tracking and label systems
- Phishing campaigns using your brand
- API and customer-portal abuse
- Compromise of subcontracted delivery partners
Five priority measures
- 01 DMARC enforcement to stop brand phishing (run our email check)
- 02 MFA and rate limits on customer portals and APIs
- 03 Continuity plan for sorting centres
- 04 Security requirements for subcontracted couriers
- 05 Incident reporting routine
What Luxembourg requires
- The law of 5 May 2026 was published in the Mémorial A (No. 225) and has applied since 10 May 2026.
- The competent authority is the ILR. Self-registration was due within two months, i.e. by 10 July 2026.
- Entities must adopt a cyber-risk management policy covering the ten minimum measures of the directive (risk analysis, incident handling, business continuity, supply-chain security, cryptography…).
- Incident reporting: early warning within 24 hours, notification within 72 hours, final report within one month.
Registration. Self-register with the ILR. The window closed on 10 July 2026 — late registrants should register now.
Significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month. Fines set by the directive: up to €10 million or 2% of worldwide turnover for essential entities, and up to €7 million or 1.4% for important entities (whichever is higher).
Tools and guides
Postal and courier services in other countries
Other sectors in Luxembourg
Frequently asked questions
Is my postal and courier companie company in scope of NIS2 in Luxembourg?
Postal and courier services is an Annex II sector. Medium and large companies are important entities (lighter supervision, after the fact). Small companies are generally out of scope unless designated. Our NIS2 check gives you the answer in two minutes.
What should we do first?
Register if you are in scope, name an owner, run a short risk assessment, and fix the basics: MFA, tested backups, patching, incident routine.
We are a supplier to this sector. Does it affect us?
Yes, indirectly: your customers must secure their supply chain and will ask you for evidence. See our supplier questionnaire guide.
Sources
- Guichet.lu / ILR — NIS2
- PwC Luxembourg — NIS2 in Luxembourg
- Paperjam — Up to 2,000 entities face NIS2 deadline
Last checked: 28 September 2026. This page is general information, not legal advice.
Postal and courier services in Luxembourg: a first view, free
Tell us where you stand. An English-speaking advisor replies within one business day with a first view and, if useful, a written quote. No commitment.
- Reply within one business day
- Written scope and price before any work
- Netherlands · Belgium · Luxembourg