NIS2 Luxembourg: manufacturing, who is actually in scope?
Luxembourg's NIS 2 Act has applied since 10 May 2026, and self-registration with the ILR was due by 10 July 2026. For a manufacturer, everything hinges on one line of Annex II: five NACE divisions, and nothing else. This guide settles the scope, the reporting clock, the fines and the public funding available.
The short answer
Part of manufacturing is in scope of NIS2 in Luxembourg, but not all of it. The Act of 5 May 2026 on measures to ensure a high level of cybersecurity entered into force on 10 May 2026 and repealed the NIS1 Act[1][2]. Its Annex II line headed Fabrication covers only two things: manufacturers of medical devices and in vitro diagnostic medical devices, and undertakings carrying out an economic activity in divisions 26 to 30 of NACE Rev. 2[1]. Computer, electronic and optical products, electrical equipment, machinery and equipment, motor vehicles and trailers, other transport equipment: you are in. Steel, fabricated metal products, plastics, rubber, glass, paper, food processing: that line does not name you, and the difference changes everything that follows.
Where it does apply, an Annex II entity is an important entity[3]. The obligations are not upcoming: they have been running since May 2026.
NIS2 Luxembourg manufacturing: four questions to settle
- Your activity. Take the NACE code you actually operate under, not the one that sits in your sales documents out of habit. Only divisions 26, 27, 28, 29 and 30, plus the manufacture of medical devices and IVDs, fall under the Fabrication line[1]. Chemicals and food have separate Annex II lines with their own definitions[1].
- Your size. A medium-sized enterprise employs at least 50 people, or exceeds 10 million euro in annual turnover or balance sheet total. A large enterprise employs at least 250 people, or exceeds 50 million euro in turnover, or 43 million euro in balance sheet total[3].
- Your group. If your company belongs to a group, the indicators are consolidated at group level under Article 6 of the Annex to Recommendation 2003/361/EC[5]. A 40-person Luxembourg site owned by a 3,000-person group is not a small enterprise. In a country where a large share of industrial capacity belongs to foreign groups, this is the criterion that pulls the most plants into scope unexpectedly. The Act also expressly disapplies Article 3(4) of that same Annex[1].
- Your national role. Regardless of size, the Act applies where the entity is the sole provider in the Grand Duchy of a service essential to the maintenance of critical societal or economic activities, or where disruption of its service could significantly affect public safety, public security or public health[1]. In a market this size, a one-of-a-kind manufacturer can be caught well below 50 employees.
The ILR publishes an applicability simulator. The result is explicitly indicative and does not constitute self-registration within the meaning of the Act[5]. Date and archive the answer anyway: it is the first document in your file.
Who supervises you, and who helps during an incident
Luxembourg has split the roles precisely. A manufacturer does not deal with the same bodies as a bank.
| Role | Body |
|---|---|
| Competent authority for Annex I and II sectors | Institut luxembourgeois de régulation (ILR)[1] |
| Carve-out: banking and financial market infrastructures | Commission de surveillance du secteur financier[1] |
| CSIRT for the State, public bodies and critical entities | Haut-Commissariat à la Protection nationale, acting as GOVCERT.LU[1] |
| CSIRT for all other cases, so for your plant | CIRCL[1] |
| Single point of contact and major cyber crisis management | Haut-Commissariat à la Protection nationale[1] |
Remember the CIRCL line. That is the team which may, at the request of the entity, run a proactive scan of its network and information systems to detect vulnerabilities with a potentially significant impact[1]. The right exists and costs one letter.
Registration was due on 10 July 2026
Self-registration with the competent authority is a legal obligation to be completed within two months of the Act entering into force, that is by 10 July 2026 at the latest[4]. Registrations made before entry into force remain valid, provided the data stays accurate and is kept continuously up to date[4]. One ILR sentence belongs on the boardroom wall: failing to self-register does not release an entity from its obligations under the NIS 2 Act[4]. Not registering has never taken anyone out of scope; it adds a breach.
Reporting an incident: 24 hours, 72 hours, one month
An incident is significant if it has caused or is capable of causing severe operational disruption of services or financial loss for the entity, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material, bodily or non-material damage[1]. The notion is deliberately broad: it covers cyberattacks, but also human error, technical failure and physical events[3]. A production line halted by ransomware meets the definition.
| Deadline | What you send the ILR |
|---|---|
| 24 hours after becoming aware | Early warning, stating where applicable whether the incident is suspected of being caused by unlawful or malicious acts and whether cross-border impact is possible[1] |
| 72 hours | Incident notification: update, initial assessment of severity and impact, indicators of compromise where available[1] |
| On request of the CSIRT or the authority | Intermediate report on relevant status updates[1] |
| One month after the incident notification | Final report: detailed description, threat type or likely root cause, mitigation measures applied, cross-border impact[1] |
The clock starts when you become aware of the incident, not when you fix it. If the incident is still ongoing at the time of the final report, you provide a progress report and then a final report within one month of handling the incident[1]. In return, the authority must respond where possible within 24 hours of the early warning, with initial feedback and, at your request, operational guidance or advice[1].
The ten measures, and one nuance in your favour
The Act requires an all-hazards approach comprising at least ten families of measures[1]: risk analysis and information system security policies; incident handling; business continuity, backups, disaster recovery and crisis management; supply chain security, including aspects of relationships with direct suppliers and service providers; security in acquisition, development and maintenance, including vulnerability handling and disclosure; policies to assess the effectiveness of the measures; basic cyber hygiene practices and security training; cryptography and, where appropriate, encryption; human resources security, access control policies and asset management; multi-factor or continuous authentication and secured communications.
The nuance: measures taken by essential entities must be notified to the competent authority, in a format and within a deadline it determines[1]. As manufacturing sits in Annex II, that notification of measures is not on you — which changes nothing about having to implement the measures and evidence them in a supervisory exercise. For drafting, the ILR publishes its own guidance, including six fundamental security measures and guidelines addressed to management bodies[7].
Fines, daily penalties and director liability
For a breach of Article 12 or Article 14(1) to (4), the maximum administrative fine is 7,000,000 euro or 1.4 % of the total worldwide annual turnover of the preceding financial year of the undertaking to which the important entity belongs, whichever is higher. For an essential entity the ceiling is 10,000,000 euro or 2 %[1]. The authority may also attach a daily penalty payment of up to 1,250 euro per day, capped at 25,000 euro in total for the breach established[1].
The most structural change is not financial. Management bodies approve the cybersecurity risk-management measures, supervise their implementation and may be held liable for the entity's breach of Article 12. Their members must follow regular training, and the entity must offer similar training to its staff[1]. A management committee that has never put cybersecurity on its agenda cannot prove it approved anything.
The Luxembourg funding few manufacturers claim
The Ministry of the Economy's SME Packages – Cybersecurity scheme funds 70 % of eligible costs for implementing a cybersecurity tool, for a project worth between 3,000 and 25,000 euro excluding VAT[6]. Conditions: holding a business permit from the Ministry of the Economy, meeting the SME criteria, and having your registered office in Luxembourg[6]. The route is mapped out: a mandatory pre-analysis by the Luxembourg House of Cybersecurity, the application prepared with the House of Entrepreneurship at the Chamber of Commerce — or the Service Cybersecurity eHandwierk at the Chamber of Skilled Trades for craft businesses — choice of provider, validation by the Ministry, then reimbursement after the package is in place[6]. The scheme explicitly mentions support towards NIS2 compliance[6].
Grant = 70 % × eligible costs, for a project of 3,000 to 25,000 euro excluding VAT, so a grant between 2,100 and 17,500 euro[6]. Figures computed from the published bounds: confirm your eligibility with the bodies named before committing anything.
Before spending a euro, the free and anonymous Fit4Cybersecurity self-assessment from SECURITYMADEIN.LU gives you a first picture of where you stand[8].
The first five actions
- Settle the scope in writing. The NACE code actually operated, headcount and accounts consolidated at group level, a dated result from the ILR simulator, and a conclusion signed by management. A two-page note beats a conviction.
- Register with the ILR if you have not. The 10 July 2026 deadline has passed; the obligation has not. Appoint someone to keep the contact details current, IP ranges included.
- Write the 24 h / 72 h / one month procedure. Who classifies an incident as significant, who signs the early warning, where the ILR and CIRCL contact details live, which template you send. Run it once as a drill, at night if your plant runs at night.
- Cover the shop floor, not just the offices. PLCs, supervision, maintenance workstations, remote access held by machine suppliers, update USB sticks. Supply chain and direct-supplier security is one of the ten required families of measures[1].
- Have the management committee approve and train, with dated evidence, then start the Luxembourg House of Cybersecurity pre-analysis so the SME Package file is open before you buy anything[6].
At CyberNovaLabs.io
CyberNovaLabs.io runs a free NIS2 check that gives a first read on your situation in minutes, plus a page dedicated to NIS2 for manufacturing in Luxembourg.
Two further reads: our analysis of the Cyber Resilience Act and what it imposes on manufacturers, which targets your connected products where NIS2 targets your organisation, and the guide to NIS2 in the Netherlands for transport and logistics, useful if your sites cross the border. If your commercial development also runs through the Grand Duchy, see our page on B2B appointment setting in Luxembourg.
Want a view on your scope, your reporting procedure or your funding file? Write to us and we will look at your specific case. For the mandatory training of directors and teams, tell us about your training needs.
Sources
- Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité (Mémorial A n° 225)
- ILR — La loi NIS 2
- gouvernement.lu — Cybersécurité : l'ILR présente la nouvelle loi NIS 2 (06/07/2026)
- ILR — Auto-enregistrement NIS 2
- ILR — Simulateur NIS 2
- Guichet.lu — SME Packages – Cybersecurity
- ILR — 6 mesures de sécurité fondamentales (publications NIS 2)
- SECURITYMADEIN.LU — Fit4Cybersecurity
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Data breach at FWB: three weeks before it was confirmed (05/10)
Flagged from outside in mid-September, confirmed on 5 October 2026: the EAD-online.be data breach shows where the GDPR's 72 hours are really lost, and why the weak link is so often a supplier.
Read the article →October 7, 2026 · 7 min readNIS2 France: are hotels and tourism in scope?
Tourist accommodation is absent from the NIS2 annexes, and France's transposition was still in parliament on 7 October 2026. Yet in May 2026 three French tourism operators lost their reservation databases within 72 hours. Here is what actually applies to you.
Read the article →October 6, 2026 · 7 min readDGFiP breach: stolen logins, no MFA, no detection (29/09/2026)
On 29 September 2026 France's cyber agency ANSSI published its incident report on the cyberattacks against the tax administration. No rare technique: passwords stolen from personal computers, a second factor sent by email, sensitive applications reachable without segmentation, and a portal nobody was watching. All four links exist in most SMEs.
Read the article →