← All resources

NIS2 Luxembourg: are hotels and tourism in scope?

Published October 20, 2026 · 9 min read · CyberNovaLabs.io

Hospitality appears in no annex of Luxembourg's NIS2 Act. Three obligations still reach you, and one of them already decides whether your corporate contracts get renewed.

The short answer

No. In Luxembourg, a hotel, a campsite, a restaurant or a travel agency is not a NIS2 entity. The Act of 5 May 2026 on measures to ensure a high level of cybersecurity entered into force on 10 May 2026^[1][3] and mirrors the annexes of the European directive: energy, transport, banking, health, water, digital infrastructure, public administration and space on one side; postal services, waste, chemicals, food production, manufacturing, online platforms and research on the other^[3]. Hospitality appears nowhere. You have no self-registration duty with the ILR, no 24-hour incident report, no NIS2 fine to fear.

Three things still reach you, and the third one already decides contracts: the GDPR over your guest data, supervised by the CNPD; the security questionnaires sent by your corporate clients, some of whom are NIS2 entities; and your building and kitchen controllers, reachable from the internet. This page covers all three, with Luxembourg's own authorities and figures.

NIS2 Luxembourg: are you in scope? The tests in order

One failed test puts you outside. Take them in the order the ILR takes them.

1. Is your activity listed in Annex I or II? For a hotel, a campsite, a restaurant, a caterer or a tour operator: no. Watch the Annex II line on "production, processing and distribution of food": a central kitchen producing and delivering meals to third parties is no longer a restaurant in the eyes of the Act, it is food production.
2. Do you meet the size threshold? Essential entity: at least 250 staff, or 50 million euros annual turnover, or 43 million euros balance sheet total. Important entity: at least 50 staff, or 10 million euros of turnover or balance sheet^[3]. Count the group, not the single site.
3. Do you run an activity covered regardless of size? DNS service providers, domain name registries, trust service providers and a few others are in scope with no threshold. A hotel group hosting other operators' systems in its own data centre is no longer selling rooms, it is selling digital infrastructure.
4. Are you a supplier to an entity that is in scope? You stay outside the Act, but your obligations become contractual. That is the expensive one, and it is covered below.

The ILR's official simulator at nis2.ilr.lu returns an indicative verdict in minutes^[4]; it is not a registration. If it classes you as an essential or important entity, self-registration with the ILR was due by 10 July 2026, two months after the Act took effect^[2]. A late entity fixes this by registering now on guichet.ilr.lu, not by waiting for a letter.

Who supervises what in Luxembourg

Luxembourg split the roles across four bodies. Knowing who to call buys you the first hours of an incident.

For entities in scope, notification runs in three steps: early warning within 24 hours, incident notification within 72 hours, final report no later than one month after^[1]. Administrative fines cap at 10 million euros or 2% of worldwide turnover for an essential entity^[3], and 7 million euros or 1.4% for an important entity^[5], whichever is higher.

The sector trap: your controllers talk to the internet

A modern Luxembourg hotel exposes more machines than an office of the same headcount: building management, room locks, CCTV, the check-in kiosk, the kitchen cold room, the guest Wi-Fi and the point-of-sale system. Each brick was usually installed by a different contractor, with remote access left open "for maintenance".

This is not theoretical. In October 2026 CERT-FR warned about Danfoss refrigeration controllers reachable from the internet — exactly the kind of equipment sitting behind a hotel kitchen. We covered it in our piece on refrigeration controllers exposed online. A cold room stopped on a Saturday night means Sunday service lost and stock binned; no law is needed for the bill to arrive.

The second hotspot is your reservation stack. The PMS, the channel manager and the online travel agencies handle names, stay dates, card numbers and sometimes copies of identity documents. Card data puts you under your acquirer's PCI DSS rules, which are a contract rather than a statute: lose compliance and you lose the payment method. Allergies and dietary notes taken for a banquet are health data under the GDPR, and they call for restricted access and a written retention period.

The other trap: the seasonal worker who left in September

Luxembourg recorded 3,586,219 nights in paid accommodation in 2025, for 1,597,720 arrivals and an average stay of 2.24 nights^[9]. Short stays, volume concentrated in season, and teams that rotate: the sector opens and closes user accounts constantly — front desk, housekeeping, kitchen, banquet extras, trainees.

That is exactly where incidents start. The CNPD handled 425 data breach notifications in 2025, with human error the leading cause at 49%, ahead of cyberattacks and disclosure to unauthorised recipients^[8]. Complaints jumped 40% in one year, to 846^[8]: your guests know their rights. One former employee's login was enough to cause a breach at a Dutch delivery operator, which we documented in an ex-employee login was enough.

What still binds you: the client who is a NIS2 entity

Entities in scope must manage the security of their supply chain. They do it the only way available to them: by pushing it into supplier contracts. A Luxembourg hotel has plenty of those clients — a CSSF-supervised bank booking seminars, an Annex II manufacturer housing project teams, a transport operator, a European institution on Kirchberg holding a framework agreement for rooms and meeting space.

In practice, the security questionnaire arrives before renewal, not after. The questions that block deals are always the same: do you have two-factor authentication on remote access, a written notification procedure with a deadline, tested backups, a list of your own digital subcontractors? We set out how to answer in our supplier security questionnaire guide. The closest parallel to your situation is that of accounting firms and fiduciaries in Luxembourg: also out of scope, also policed by their clients. For the cross-border comparison, see our guide on NIS2 for hotels and tourism in France, and the overview of NIS2 in Luxembourg.

One country-specific point deserves attention: much of Luxembourg's hospitality workforce lives in Belgium, France or Germany, and part of the back office runs from abroad. Any remote access to your PMS from a cross-border home must go through two-factor authentication, otherwise you cannot answer a single questionnaire honestly.

The first five actions

1. Run the ILR simulator at nis2.ilr.lu and keep the dated result as a PDF^[4]. It is your written proof of being out of scope, and the document your client will ask for.
2. Close leavers' accounts and delete shared logins in the PMS, the till and the lock system. Name one owner for that list, with a monthly review in the roster.
3. Inventory your controllers and cut their remote access: cold rooms, building management, CCTV, kiosks. For every access a contractor insists on, require a named account and two-factor authentication.
4. Write your data breach procedure: who spots it, who decides, who notifies the CNPD within 72 hours, who calls CIRCL^[6][8]. One page is enough, posted at reception and with management.
5. Run the free Fit4Cybersecurity self-assessment and the MONARC risk analysis, both Luxembourgish and available through CASES.lu^[12]. The report they produce doubles as your answer to client questionnaires.

At CyberNovaLabs.io

Start with the free NIS2 check: ten questions, a written verdict on your situation, and the list of what applies to you even outside the scope. Our page on cybersecurity grants summarises the schemes in the four countries we work in.

If your question is commercial instead — filling a calendar of seminars, banquets or corporate framework agreements — we also do B2B appointment setting, including on the Luxembourg market, with no minimum term and priced on quotation. A questionnaire to fill in, a controller you are not sure is exposed, a doubt about your classification: write to us and we will look at your actual case.

Sources

1. ILR — NIS 2 (loi du 5 mai 2026)
2. ILR — Auto-enregistrement NIS 2
3. gouvernement.lu — Cybersecurite : l'ILR presente la nouvelle loi NIS 2 (06/07/2026)
4. ILR — Simulateur NIS 2
5. Directive (UE) 2022/2555, article 34 (amendes)
6. CIRCL — CSIRT national du Luxembourg
7. HCPN — Circulaire NIS2
8. CNPD — Rapport annuel 2025
9. Luxembourg for Tourism / STATEC — Key tourism figures 2025
10. Guichet.lu — Programmes Fit 4 (dont Fit 4 Cybersecurity)
11. Guichet.lu — SME Packages
12. CASES.lu — Fit4Cybersecurity et MONARC

Read next