← All resources

NIS2 Luxembourg: are construction firms in scope?

Published November 4, 2026 · 8 min read · CyberNovaLabs.io

In Luxembourg, construction is not on the NIS2 sector list published by the ILR. The Act of 5 May 2026, the size-cap and the 10 July 2026 registration do not apply merely because a firm builds.

The short answer

No, in the great majority of cases. A construction or building firm established in Luxembourg is not an NIS2 entity merely because it builds. The page of the Luxembourg Regulatory Institute (ILR) that summarises the sectors in Annexes I and II does not list construction of buildings, civil engineering, or specialised construction work.^[1]

Three facts are specific to Luxembourg, and they do not copy across from Belgium or France. The Act of 5 May 2026 entered into force on 10 May 2026. The authority that supervises the sectors under that Act is the ILR.^[2] Registration of entities that are actually in scope was required no later than 10 July 2026.^[3] Implementing Regulation (EU) 2024/2690, which the ILR publishes, covers types of digital entities, not building sites.^[4]

This guide cites the ILR pages and the texts they point to. It does not replace the statute or advice from your own counsel. The ILR itself says its questions and answers are not a final interpretation.^[6]

Are you in scope?

This guide is for you if you run, or if you sell to, a firm whose main trade is the building site in Luxembourg:

• a main contractor, structural works, finishing trades, or a developer that builds;
• civil engineering, roads, earthworks, special foundations;
• specialist trades: building electrics, HVAC, roofing, joinery, painting, scaffolding;
• a group with a Luxembourg contracting subsidiary and another activity elsewhere;
• a supplier answering a security questionnaire from a client, a hospital, an energy operator or a public administration.

The word "construction" is not enough. The ILR applies the Act to entities active in one or more sectors of Annexes I and II, and then, by default, to those that reach a certain size.^[1] If the trade is not on the list, size does not create the duty.

What the law requires in Luxembourg

Directive (EU) 2022/2555 was transposed by the Act of 5 May 2026 on measures to ensure a high level of cybersecurity. The ILR states that this Act entered into force on 10 May 2026. It repealed the NIS1 Act, and Articles 42 and 43 of the Law of 17 December 2021 on electronic communications networks and services.^[2] The text is published on Legilux.^[7]

The list summarised by the ILR, and re-read for this guide, is: energy; transport; health; drinking water; waste water; digital infrastructure; ICT service management (B2B); public administration; space; postal and courier services; waste management; manufacture, production and distribution of chemicals; production, processing and distribution of food; manufacturing; digital providers; research.^[1] Construction is not on it. The word does not appear on that page.

The size-cap applies only if the sector is listed

For an activity that is on the list, the ILR restates the size rule. An entity is medium-sized if it has at least 50 and no more than 249 employees, or an annual turnover between 10 and 50 million euros, or an annual balance-sheet total between 10 and 43 million euros. If any of these criteria is exceeded, the company is large.^[1]

The calculation is made at group level. The ILR points to Article 6 of the Annex to Recommendation 2003/361/EC: 100 percent of the data of the enterprise under review, 100 percent of linked enterprises, and the pro-rata share of partner enterprises. Partners of partners are not counted.^[1] A Luxembourg site with 30 people can therefore count toward the threshold of a parent whose other activity is listed. The reverse is not true: 400 operatives on building sites do not, by themselves, make an NIS2 entity.

Regardless of size, the ILR notes that an entity may be identified as essential or important under specific criteria, for example if it is already identified as a critical entity, or if it is the sole supplier in its field.^[1] That is an identification, not an automatic consequence of the building trade.

Activity of the group	On the ILR list	Practical consequence
Building site, structural works, finishing, civil engineering	No. These trades are not in the annex summary.[1]	Not an NIS2 entity by reason of this trade alone. No registration "just in case".
A factory or manufacturing	"Manufacturing" is a separate line. The ILR notes that some sectors have sub-sectors.[1]	Do not conclude from the building site. Read the sector definition before deciding.
Transport, waste, energy, health, water, digital, managed ICT services	Yes, if that is the activity, not a tool used on site.[1]	The threshold is then calculated at group level. Registration was aimed at 10 July 2026.[3]
Supplier to a client already in scope	The client may be. You are not, for that reason.	A contractual questionnaire. Not an ILR registration.

What the ILR asks of those that are in

If a listed activity of the group crosses the threshold, two differences matter, and they do not extend to the neighbouring building site.

Registration. The ILR calls it a legal obligation, to be met within two months of entry into force, so no later than 10 July 2026. Registrations made before entry into force remain valid if the data are accurate and kept up to date. Failure to register does not exempt the entity from its obligations.^[3] On 4 November 2026, that date has passed for anyone who was already in scope.

Supervision. The ILR FAQ states that important entities must in principle meet the same security requirements as essential entities. The difference is supervision: essential entities are supervised before and after; important entities, only after. Important entities do not routinely file certain deliverables, such as the risk analysis or the description of measures. After an incident, the ILR may ask for them.^[6]

The incident. For entities in the sectors it supervises, the ILR asks for a report within the first 24 hours.^[5] An incident, within the meaning of Article 2, paragraph 5, of the Act, compromises the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data, or of the services offered by, or accessible via, network and information systems. It is significant, within the meaning of Article 14, paragraph 3, if it has caused or is capable of causing severe operational disruption or financial loss for the entity, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.^[5]

The timetable published by the ILR is then: a preliminary notification no later than 24 hours after becoming aware of the significant incident; a formal notification within 72 hours; a final report no later than one month after the incident notification. If the incident is not closed, an extension of one month may be requested, with a progress report.^[5] The channel named on the ILR pages is SERIMA.^[9] That timetable is for entities in supervised sectors. It is not a penalty attached to the trade of bricklaying.

What still concerns you

Off the list is not off the subject. Three requests come back on Luxembourg building sites, and none of them is solved by registering in error.

The questionnaire of a client that is itself in scope. A hospital, an energy operator, a public administration or a listed manufacturer may require an incident contact, a rule for access to drawings, and proof of backup before letting you into its network. That is a clause of its contract. It is not proof that your firm is an essential or important entity.

The other activity of the same group. The line "ICT service management (B2B)" covers those who provide those services, not the firm that uses planning software on site.^[1] A subsidiary that operates a network, treats waste, or manufactures in a listed sub-sector is judged separately. The threshold, though, is calculated with linked enterprises.^[1]

Data and email. Operatives' files, drawings and clients' contact details remain personal data: this guide does not restate CNPD practice, which was not re-read here. A client questionnaire often asks whether the domain sends with SPF, DKIM and DMARC. That is a deliverability and impersonation measure. It is not, by itself, an NIS2 duty of the building trade.

The first 5 actions

1. Write the group's real activities against the ILR list, not against the word "construction". If only building appears, say so in writing: the trade is not in the annex summary.^[1]
2. Calculate the size threshold, at group level, only if a listed activity exists. Use the ILR's three criteria, not one of them.^[1]
3. If a listed activity crosses the threshold, register it with the ILR. The published date was 10 July 2026, and the absence of registration does not switch off the other duties.^[3] Do not register a pure building trade to "be compliant".
4. If an in-scope client sends a questionnaire, answer as a supplier: incident contact, who accesses the drawings, where the backups are. File that answer apart from any ILR registration.
5. Take the free check, then separate email security from the NIS2 question. The check shows whether another activity of the group changes the answer.

The same trade, judged in France, is covered in NIS2 and construction in France. In Luxembourg, two sectors that are on the ILR list already have a page: manufacturing and transport and logistics. The country page is NIS2 Luxembourg. For a meeting on the ground, see Luxembourg.

At CyberNovaLabs.io

CyberNovaLabs.io does not sell an NIS2 registration, and does not promise a compliance outcome. The free check is there to see whether an activity of the group is on the list, before any meeting. B2B appointment setting, when it is asked for, is quoted, per meeting or on a retainer, with no term commitment. No volume is promised. No price is shown here.

The check is on the NIS2 check page. To have the group's activity list read, describe the firm.

Review the position

Sources

1. ILR, Scope and field of application of the NIS 2 Act
2. ILR, The NIS 2 Act (loi du 5 mai 2026, entrée en vigueur le 10 mai 2026)
3. ILR, Self-registration
4. ILR, Commission Implementing Regulation (EU) 2024/2690
5. ILR, Incident notification
6. ILR, Frequently asked questions about NIS2
7. Legilux, loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité
8. Directive (UE) 2022/2555
9. SERIMA, notification d'incident

Read next