NIS2 Luxembourg: are accounting firms and fiduciaries in scope?
The Law of 5 May 2026 never once mentions accountancy. That does not make your firm safe: three entry points remain, and only one really concerns Luxembourg fiduciaries.
The short answer
For NIS2 Luxembourg, accounting firms and fiduciaries are, in the vast majority of cases, out of scope. The Law of 5 May 2026, in force since 10 May 2026, applies only to entities « of a type referred to in Annex I or II »[1]. Those two annexes cover energy, transport, banking, financial market infrastructures, health, water, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing, online marketplaces and research. Accountancy, fiduciary work and company domiciliation appear nowhere.
Three caveats change the answer for a minority of firms, and they are exactly the ones people forget: the IT you run for your clients, being the sole provider in the Grand Duchy, and designation by the authority. This guide works through them, then deals with what reaches you anyway: the security questionnaires sent by your regulated clients, and the fact that you hold the legal keys to dozens of companies.
NIS2 Luxembourg: are you in scope? The tests in order
Take them in this order. The first « yes » puts you in scope.
- Size. The law only reaches entities that qualify as at least a medium-sized enterprise under Article 2 of the Annex to Recommendation 2003/361/EC, or that exceed its ceilings[1]. A Luxembourg specificity: Article 1 expressly disapplies Article 3(4) of that Annex[1], so ownership structures cannot be used to stay « small » on paper.
- Entity type. Does your main activity match a line in the annexes? For an accountancy practice, no. For a fiduciary that also runs a data centre, yes.
- IT services supplied to clients. This is the sector's only real trap: see the next section.
- Sole provider. Article 1(2) brings an entity into scope regardless of size where it is « in the Grand Duchy of Luxembourg, the sole provider of a service that is essential for the maintenance of critical societal or economic activities »[1]. In a market this size, that test is not theoretical.
- Designation. The same paragraph allows an entity to be caught because of « its specific importance at national or regional level »[1]. That is the authority's decision, not a calculation you make alone.
- DORA. The law expressly excludes entities that fall outside Regulation (EU) 2022/2554 under its Article 2(4)[1]. If your structure is a DORA financial entity, DORA governs its digital resilience.
The sector trap: the fiduciary that becomes a managed service provider
Annex I contains a line for « ICT service management (business-to-business) », covering « managed service providers » and « managed security service providers »[1]. The statutory definition is broad: an entity providing services related to « the installation, management, operation or maintenance of ICT products, networks, infrastructure or applications », through « assistance or active administration, either on client premises or remotely »[1].
Plenty of Luxembourg fiduciaries do precisely this without calling it that: they host the client's accounting software, administer its logins, manage its devices, hold its authentication certificates. Three concrete consequences:
- No automatic size exemption. Managed service providers are not on the « regardless of size » list in Article 1(2), which covers only public electronic communications networks and services, trust service providers, top-level domain registries and DNS providers[1]. A small firm therefore stays out on this ground until it reaches medium size.
- The authority changes. The ILR is the competent authority for Annexes I and II, but the CSSF is competent for digital infrastructure and ICT service management « in respect of activities falling under the supervision of the Commission de Surveillance du Secteur Financier »[1]. A licensed fiduciary running IT for financial clients does not answer to the same regulator as the firm next door.
- The registration date is already behind you. Article 17 sets 17 January 2025 as the date for managed service and managed security service providers, cloud providers and data centre providers to file their details[1] — a date earlier than the law's own entry into force. Other in-scope entities owe their details within two months of entry into force[1], that is 10 July 2026; the ILR provides a self-registration mechanism[3].
If that section describes you, read our page on managed IT services under NIS2 in Luxembourg.
Who supervises what in Luxembourg
| Role | Body |
|---|---|
| Competent authority, Annexes I and II | Institut luxembourgeois de régulation (ILR)[1][2] |
| Banking, financial market infrastructures, and ICT activities under financial supervision | Commission de Surveillance du Secteur Financier (CSSF)[1] |
| Single point of contact and cyber crisis management | Haut-Commissariat à la Protection nationale[1] |
| CSIRT for the State, public bodies and critical entities | GOVCERT.LU[1] |
| CSIRT for all other cases, so for a firm like yours | CIRCL, operated by the Luxembourg House of Cybersecurity[1] |
If you do fall in scope, this is what applies.
Three reporting stages for a significant incident: an early warning within 24 hours, a notification within 72 hours, a final report no later than one month afterwards[1]. The management body approves the risk-management measures, oversees their implementation, may be held liable for a breach, and must follow regular training — training that must also be offered to staff[1].
Administrative fines: up to €10,000,000 or 2% of total worldwide annual turnover for an essential entity, up to €7,000,000 or 1.4% for an important entity, whichever is higher[1]. The authority may add a periodic penalty payment of €1,250 per day, capped at €25,000 in total[1].
Silence has a price: on 9 September 2026 the ILR published a sanction decision against an electronic communications operator for failing to notify an incident[4]. Different sector, same regulatory reflex.
What applies to you even out of scope
A firm outside NIS2 is not a firm without duties. Four specific points, particular to the Luxembourg marketplace.
- Your clients' security questionnaires. Your regulated clients are in scope of NIS2 or DORA, and must control their supply chain. The question arrives from their procurement team, not from a regulator. Our supplier security questionnaire guide sets out how to answer.
- Domiciliation makes you critical to your clients. The amended Law of 31 May 1999 reserves the role of domiciliation agent to a closed list of regulated professions: credit institutions and other financial and insurance sector professionals, avocats à la Cour on list I, European lawyers on list IV, réviseurs d'entreprises, approved réviseurs d'entreprises, and expert-comptables[5]. A written agreement is mandatory, and breaching that rule is « a serious contravention of the law » that can expose the domiciled company to judicial dissolution or closure[5]. In security terms: you hold the registered office, the mail, the register logins and often the banking mandates of dozens of companies. One compromised mailbox at your end puts their legal existence at stake.
- Anti-money-laundering files. The Law of 12 November 2004[7] and the Law of 10 June 1999 organising the profession of expert-comptable[6] require you to build and keep identification files: identity documents, source-of-funds evidence, beneficial ownership charts. That is exactly the raw material of a successful CEO-fraud attempt.
- GDPR does not depend on NIS2. Your security and breach-notification duties stand on their own, under the supervision of the Commission nationale pour la protection des données.
The first five actions
- Settle the scope question in writing, on one page. The six tests above, your answer, the date, a partner's signature. That is the document you will produce if asked, and it is better written before the question comes.
- List what you operate for clients. Hosting, access administration, backups, remote maintenance. If the list is not empty, reread the managed service provider definition and run the size test.
- Put multi-factor authentication on everything exposed. Email, VPN, filing portals, payment tools. Firms are attacked through their mailbox, not their firewall.
- Write the incident procedure before you need it. Who decides, who calls the client, who calls the CSIRT, and within how long. CIRCL is your default contact point[1].
- Find the funding before you buy. The Ministry of the Economy's SME Packages – Cybersecurity scheme reimburses 70% of eligible costs for a project between €3,000 and €25,000 excluding VAT, after a mandatory pre-analysis by the Luxembourg House of Cybersecurity, with the application prepared at the Chamber of Commerce's House of Entrepreneurship or the Chamber of Skilled Trades' Service Cybersecurity eHandwierk[8]. The Fit4Cybersecurity self-assessment from SECURITYMADEIN.LU is free and a sensible starting point[9].
Two neighbouring reads: the same exercise for accounting firms and fiduciaries in France, and the case of manufacturing in Luxembourg, where Annex II genuinely bites.
At CyberNovaLabs.io
Start with our free NIS2 check: six questions, a reasoned answer on your situation, no sign-up. Available support is summarised on our cybersecurity grants page.
If what your firm really needs is new mandates, we book qualified meetings for accounting firms and fiduciaries, including on the Luxembourg market, with no minimum term and on qualification criteria written down before launch. The method is set out on our B2B appointment setting page. For security awareness training, write to us: we answer with a programme and a quote.
Sources
- Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité (Mémorial A n° 225)
- ILR — La loi NIS 2
- ILR — Auto-enregistrement NIS 2
- ILR — Décision ILR/N26/9 contre Eltrona Interdiffusion S.A. pour défaut de notification d'un incident (9 septembre 2026)
- CSSF — Loi modifiée du 31 mai 1999 régissant la domiciliation des sociétés (texte coordonné)
- Loi du 10 juin 1999 portant organisation de la profession d'expert-comptable
- Loi du 12 novembre 2004 relative à la lutte contre le blanchiment et le financement du terrorisme
- Guichet.lu — SME Packages – Cybersecurity
- SECURITYMADEIN.LU — Fit4Cybersecurity
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 16, 2026 · 9 min readNIS2 France: are law firms in scope?
Legal services are absent from Annexes I and II of NIS2, and France had not finished transposing as of 16 October 2026. Yet the directive reaches firms through their in-scope clients' supply chain, through the GDPR and through CARPA transfer fraud. Here is what is enforceable today, and in what order to act.
Read the article →October 15, 2026 · 7 min readAI in SMEs: 42% already use it, 49% held back by law (14/10/2026)
On 14 October 2026 the European Commission published a survey of 12 826 SME owners across the 27 Member States. The 42% adoption headline matters less than the detail: only 12% have genuinely deployed, and the law holds firms back as much as the price does.
Read the article →October 14, 2026 · 7 min readWindows zero-day: the download warning is gone (13/10/2026)
A Windows Shell flaw already used in attacks strips the « this file came from the internet » warning. A second exploited flaw hits Ivanti remote access. Both fixes are dated 13 October 2026.
Read the article →October 14, 2026 · 7 min readNIS2 Belgium: manufacturing, who is actually in scope?
Most Belgian factories are outside the scope of NIS2, and those inside find out through a NACE code, not through their revenue. The six Annex II categories, the Belgian deadlines that have already lapsed, the fine ceilings, and the Flemish grant few manufacturers claim.
Read the article →