← All resources

NIS2 Luxembourg: are law firms in scope?

Published October 30, 2026 · 7 min read · CyberNovaLabs.io

A Luxembourg law firm is not a NIS2 entity. Three side doors in the Law of 5 May 2026 reach it anyway, and Article 35 of the 1991 Act imposes a constraint the cyber law ignores.

The short answer

No. A Luxembourg law firm is not a NIS2 entity because it practises law. The Law of 5 May 2026, in force since 10 May 2026, applies only to entities of a type listed in its Annexes I and II^[1]. The Luxembourg regulator, the ILR, publishes the sixteen sectors: energy, transport, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration, space, postal and courier services, waste, chemicals, food, manufacturing, digital providers, research^[3]. Legal services appear on no line of that list. So the real question behind NIS2 Luxembourg and law firms is not whether the law names you, but through which side door it reaches you. There are three, and all three are written into the Luxembourg text.

NIS2 Luxembourg and law firms: are you in scope?

• Does your activity fall within one of the sixteen sectors? For a firm on the roll of the Bar: no.
• Do you run, alongside legal practice, a separate activity that does? A firm that hosts a platform for clients, resells managed IT or operates a B2B ICT service gets a different answer. What counts is the actual activity, not the professional status.
• Do you exceed the size cap? The ILR treats an entity as medium-sized when it has at least 50 and no more than 249 staff, or annual turnover between 10 and 50 million euros, or a balance sheet total between 10 and 43 million euros, assessed at group level^[3]. That test only bites once the first one is met: outside the annexes, size is irrelevant.
• Are you a direct supplier or service provider to an essential or important entity? If so, the rest of this page is about you.

What the Law of 5 May 2026 puts in place

The ILR is the single competent authority for Annexes I and II, with a carve-out for the financial regulator CSSF covering banking, financial market infrastructures, and the digital infrastructure and ICT service management activities under its own supervision^[1]. The High Commission for National Protection is the single point of contact and the cyber crisis management authority. The CSIRT function is split: GOVCERT.LU for the State, public establishments and critical entities; CIRCL for all other cases^[1]. A private firm hit by an incident therefore calls CIRCL, whose operational statistics are public^[11].

Self-registration was due within two months of entry into force, that is by 10 July 2026^[10]. Significant incidents follow three steps: early warning at twenty-four hours, formal notification at seventy-two hours, final report at one month^[1]. The ILR published operational guidance for incident handling on 28 September 2026^[5], and four templates on 3 August 2026: description of measures in place, analysis of cyber risk scenarios, multi-year action plan, and list of dependencies^[2]. That last one is the one that concerns you.

The three doors that reach a Luxembourg firm

1. The list of dependencies. When setting its supervisory priorities under Article 21(1) of the Law, the ILR may require certain categories of essential entities to submit the list of their dependencies on their direct suppliers or service providers, and then to submit it annually^[4]. A dependency exists as soon as the entity's activity requires recourse to another entity. In plain terms: your name may sit every year in a document filed with the regulator by your client, without you ever becoming a NIS2 entity.

2. Supply chain security. Article 12(2)(4) requires entities to address supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers; Article 12(4) adds that the entity must take into account the vulnerabilities specific to each direct provider and the overall quality of its practices^[1]. And Article 22(2) lets the authority demand from an essential entity access to documents and evidence of the implementation of its policies, including audit results^[1]. The pressure travels down to the firm, by contract and by questionnaire.

3. Voluntary notification. Article 20(1)(2) expressly allows entities other than essential and important ones, irrespective of whether or not they fall within the scope of this Law, to notify the ILR of a significant incident, a cyber threat or a near miss; Article 20(2) states that a voluntary report imposes no additional obligations on the reporting entity^[1]. It is the only provision in the law that opens a door without locking you behind it.

Professional secrecy, the constraint NIS2 does not know

Here Luxembourg professional law goes further than the cyber law. Article 35(1) of the Law of 10 August 1991 subjects the avocat to professional secrecy in accordance with Article 458 of the Criminal Code; Article 35(3) declares inviolable the lawyer's place of work and the secrecy of communications, by whatever means, between lawyer and client, and requires, where a civil procedure or criminal investigation measure is carried out at or in respect of a lawyer, the presence of the President of the Bar or a representative, recorded in seizure and search records on pain of nullity^[6].

The Bar's internal regulation, the RIO, extends the rule into your systems. Article 7.1.3 sets out what secrecy covers: advice, correspondence, meeting notes, the names of clients, the lawyer's diary, and the financial settlements between lawyer and client^[7]. An exfiltrated client directory or a stolen diary is therefore not merely a data breach: it is a breach of secrecy. Article 7.1.5 adds that the lawyer must ensure that the people they employ and any other person with whom they cooperate and/or collaborate in professional activity comply with it^[7]: your host and your managed service provider sit inside the secrecy perimeter by professional rule, before any NIS2 contract.

The contrast with the Law of 5 May 2026 is sharp: the only two mentions of professional secrecy in that law concern CSSF and ILR staff, never the supervised entity^[1]. The cyber text makes no accommodation for a profession whose secrecy is criminally sanctioned. Organising it is on you, and on your agreements with your providers.

One incident, three different recipients

Three addresses, three clocks, one event. This is the table a firm should have written before the incident, not during it.

What the CNPD sees, and why it lands on law firms

In 2025 the Luxembourg data protection authority received 425 data breach notifications, against 442 in 2024, close to 35 a month, and 2,893 since the GDPR became applicable on 25 May 2018^[8]. By cause: non-malicious internal acts 49 %, malicious external acts 30 %, malicious internal acts 4 %. By type: disclosure to the wrong recipient 28.7 %, hacking 24.9 %. By impact, above all: 82.6 % of notified breaches are a loss of confidentiality^[8].

For any other business, an email sent to the wrong recipient is a regrettable incident. For a Luxembourg lawyer, the same click touches Article 7.1.3 of the RIO and Article 458 of the Criminal Code. The CNPD also notes that hacking and phishing acts target management staff and those around them, assistants or executive secretariats^[8]: in a law firm, that is precisely the desk through which fee agreements and bank details pass.

The first five actions

1. Map your NIS2 clients. Record for each whether it is essential or important: they are the ones who will ask you for evidence, and it is their list of dependencies that will carry your name. Our free NIS2 check qualifies a client in minutes.
2. Prepare your answers to the supplier questionnaire. One set of written, dated, signed and reusable answers: hosting and data location, encryption, backups and restore testing, logging, multi-factor authentication, subcontractors. Our supplier security questionnaire covers the sections most often requested.
3. Put your secrecy perimeter in writing in your IT contracts. Article 7.1.5 of the RIO already requires it of you; make your agreements with your host, your managed service provider and your case management tool say so too, with a twenty-four-hour notification clause that leaves you able to meet your own deadlines.
4. Write the three-recipient table above, with names, numbers and the person responsible for each call, and test it once a year. The ILR's operational guidance gives a usable framework even out of scope^[5].
5. Harden the executive secretariat. Multi-factor authentication everywhere, two-person approval for any change of bank details, and a check before sending outgoing mail, given that 28.7 % of breaches notified in Luxembourg are a send to the wrong recipient^[8].

Funding: the condition to verify before you count on it

The Ministry of the Economy's SME Packages scheme co-finances 70 % of the eligible costs of a digital-impact solution, for a project between 3,000 and 25,000 euros excluding VAT. The conditions published on Guichet.lu are cumulative: holding a business permit granted by the Ministry of the Economy, meeting the SME criteria on headcount, turnover and balance sheet, and having the registered office in Luxembourg; the company is reimbursed after the package is implemented^[9]. For a law firm, whose practice rests on admission to the roll of the Bar rather than on a permit from the Ministry of the Economy, that first condition is exactly the point to have confirmed before putting the grant into a budget. We keep cybersecurity grants and deadlines by country up to date.

For comparison, our guide on NIS2 France and law firms takes the same question under French law, and NIS2 Luxembourg for accounting firms and fiduciaries shows how a Luxembourg fiduciary can itself fall into scope by becoming a managed service provider. Country detail sits on our NIS2 in Luxembourg page and its managed IT services sheet.

At CyberNovaLabs.io

We help Luxembourg firms hold two requirements at once: the professional secrecy of Article 35, and the evidence their NIS2-regulated clients demand. In practice: client and dependency mapping, a supplier questionnaire answer file, a review of IT contracts through the lens of RIO Article 7.1.5, and hardening of the most exposed desk, the executive secretariat. We also work on inbound demand, through custom software and B2B appointment setting in Luxembourg; for the professional conduct rules on prospecting, see B2B appointment setting for law firms. Pricing on request.

Discuss your case with CyberNovaLabs.io

Sources

1. Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité — Legilux
2. ILR — La loi NIS 2 (aperçu, nouveautés, publications)
3. ILR — NIS 2 : périmètre et champ d'application (secteurs et size-cap)
4. ILR — Modèle NIS 2 : liste des dépendances (publié le 3 août 2026)
5. ILR — Operational Guidance For Incident Handling (publié le 28 septembre 2026)
6. Loi du 10 août 1991 sur la profession d'avocat — Legilux
7. Barreau de Luxembourg — Règlement intérieur de l'Ordre (RIO), version consolidée au 23.08.2022
8. CNPD — Rapport annuel 2025 (violations de données notifiées)
9. Guichet.lu — SME Packages : solution à impact digital (ministère de l'Économie)
10. ILR — Auto-enregistrement des entités importantes et essentielles
11. CIRCL — Operational Statistics (CSIRT du Luxembourg)

Read next