← All resources

NIS2 Luxembourg: are transport and logistics firms in scope?

Published October 24, 2026 · 8 min read · CyberNovaLabs.io

Luxembourg's law does not put road hauliers inside NIS2. It puts road authorities, intelligent transport system operators, aviation, rail and ports there — and, through Annex II, forwarding services. Here is how to settle your own case, with the articles, the authority and the real deadlines.

The short answer

A Luxembourg road haulier, freight forwarder or warehouse operator is, as a rule, not a NIS2 entity because of its transport activity. In Luxembourg the law of 5 May 2026 on measures for a high level of cybersecurity entered into force on 10 May 2026^[1][2]. For road transport, its Annex I lists only two kinds of entity: road authorities responsible for traffic management control, and operators of intelligent transport systems^[1]. Loading semi-trailers at Bettembourg is not on that list.

Three doors nonetheless bring much of the sector back in: the forwarding services line in Annex II, the supplier position towards an in-scope customer, and a self-registration deadline that has already passed — 10 July 2026^[3]. All three can be checked in an hour.

NIS2 Luxembourg: are you in scope? The tests in order

1. Is your activity named in an annex? This is the first filter and usually the decisive one for transport. The table below reproduces the four sub-sectors as Luxembourg law writes them.
2. Your size, measured at group level. The ILR applies the size-cap rule: an entity is medium-sized from 50 staff, or with annual turnover between EUR 10m and EUR 50m, or a balance sheet total between EUR 10m and EUR 43m; above that it is large^[4]. The calculation includes 100% of linked enterprises and a pro-rata share of partner enterprises^[4]. Exceeding the medium-sized ceilings in an Annex I sector makes you essential; other listed entities are important (Article 11)^[1].
3. Were you an operator of essential services under NIS1? Article 11(1)(7) carries over, automatically as essential entities, those identified as operators of essential services under the law of 28 May 2019^[1]. No fresh decision is needed: the status already applies.
4. Do you provide forwarding services? Annex II covers postal service providers within the meaning of Article 1(12) of the amended law of 26 December 2012 on postal services, including providers of forwarding services^[1]. This is the most misread line in the sector: courier, parcel delivery or groupage work can be enough where pure haulage was not. Our page on NIS2 Luxembourg for postal and courier services covers that case.

Transport: what the Luxembourg annex actually says

The law does not simply copy the directive. Each line points to a national text, and that pointer is what settles your case.

Two readings follow. First, the "port managing bodies" line can only have one application in Luxembourg: the river port of Mertert. Second, road is the only sub-sector where the law explicitly excludes public entities for which traffic management or the operation of intelligent transport systems is a non-essential part of their general activity^[1]. A municipality running three traffic lights is out; the operator of a real-time traffic information system is in.

What the law requires in Luxembourg — and what it adds

One authority, with one exception. The Institut luxembourgeois de régulation is the competent authority for every Annex I and II sector and for critical entities. By derogation, the Commission de surveillance du secteur financier is competent for banking, financial market infrastructure, and the digital infrastructure or ICT service management activities that fall under its supervision^[1]. For a transport business, the counterpart is the ILR and nobody else.

Two CSIRTs, depending on who you are. The Haut-Commissariat à la Protection nationale, acting as GOVCERT.LU, is the CSIRT for State administrations and services, public establishments and critical entities. CIRCL is the CSIRT "for all other cases"^[1]. A private logistics SME therefore calls CIRCL, not GOVCERT.LU — worth writing into the crisis sheet before you need it.

Registration, and what follows it. Self-registration with the ILR had to be completed within two months of entry into force, so by 10 July 2026 at the latest^[3]. The ILR puts it bluntly: failing to self-register does not release an entity from its obligations^[3]. A detail few directors know: any change to the registered information must be notified within two weeks^[1]. A new contact address or a new IP range starts that clock.

One distinctly Luxembourgish obligation. Beyond the ten headings of risk-management measures in Article 12(2) — risk analysis, incident handling, business continuity and backups, supply chain security, vulnerability handling and disclosure, cyber hygiene and training, cryptography, access control, multi-factor authentication — Article 12(3) requires essential entities to notify their measures to the competent authority, in a format and within a deadline set by regulation or circular^[1]. That is a file to produce, and it does not exist in this form in every neighbouring country.

Penalties, and a case already decided

For a breach of risk-management or reporting obligations, Article 26 allows up to EUR 10m or 2% of total worldwide annual turnover for an essential entity, and up to EUR 7m or 1.4% for an important entity, whichever is higher^[1]. For the registration, information and cooperation failures listed in Article 25, the administrative fine cannot exceed EUR 250,000, after adversarial proceedings, with an appeal on the merits to the administrative tribunal; collection is handled by the Administration de l'enregistrement, des domaines et de la TVA^[1].

These figures are not theoretical. On 11 June 2026 the ILR imposed a EUR 25,000 fine on Eltrona Interdiffusion S.A. for failing to send a 24-hour early warning about a major outage detected on 9 April 2026: the regulator learned of it from an affected user and from the press^[5]. That decision sits under the electronic communications regime rather than NIS2 — but it is the same authority, the same 24-hour deadline, and the same lesson: what gets punished first is the silence, not the outage.

What still applies if you are out of scope

• Your customers' security questionnaires. Article 12(2)(4) requires in-scope entities to secure their supply chain, including relations with direct suppliers and service providers, taking each one's specific vulnerabilities into account^[1]. Your essential shipper will ask, and your answer will weigh on the renewal. The same mechanism hits Luxembourg accounting firms and fiduciaries, rarely in scope either but questioned constantly.
• Voluntary reporting. Article 20 lets any entity, in scope or not, report a significant incident, a cyber threat or a near miss to the ILR, without that report creating additional obligations^[1].
• The risk itself. ENISA analysed 98 publicly reported incidents in European transport between January 2021 and October 2022, of which 24 (24%) hit road transport, automotive included. In that sub-sector ransomware accounts for 43% of threats, ahead of data-related threats (26%) and malware (17%); across transport as a whole, the ransomware share rose from 13% in 2021 to 25% in 2022^[6].

And volumes are growing: lux-Airport is planning for 1.25 million tonnes of freight by 2050, a 50% increase^[7]. More flows mean more data exchange systems and more attack surface. The same logic applies in France, where we published the NIS2 guide for transport and logistics: different tests, identical risk.

The five first actions

1. Run a scope test twice. The ILR publishes a NIS 2 simulator giving an indicative result^[3]; cross-check it with our free NIS2 check. Two matching answers beat one hunch.
2. Settle the forwarding question. Pull up your activity codes and your three largest contracts: is there courier, parcel or groupage work in them? If so, Annex II applies and you are at least an important entity.
3. Compute your size at group level. Headcount, turnover and balance sheet, including linked enterprises at 100% and partners pro rata^[4]. Plenty of 30-person Luxembourg subsidiaries come into scope through their parent.
4. If you are in scope, register now. The 10 July 2026 deadline has passed^[3]: registration is still owed, and every later change runs on a two-week clock. Our cybersecurity deadlines page tracks all four countries.
5. Write the 24-hour incident sheet before you need it. Who detects, who qualifies, who decides, who opens SERIMA, who calls CIRCL, which ILR address the notification goes to. One page, posted up, tested once a year. That is the document missing from the Eltrona file.

At CyberNovaLabs.io

We work in the Netherlands, Belgium, France and Luxembourg, and we help transport and logistics firms on two fronts: setting the NIS2 perimeter down in writing, and preparing the answers to the security questionnaires that decide contracts. We also work on automating the sector's administrative flows and on pipeline, with B2B appointment setting in Luxembourg for suppliers selling into the logistics market. Engagements are quoted case by case, with no minimum term.

For a view on your own position, write to us: describe your activity, your headcount and your two biggest customers, and we will tell you which annex looks at you.

Sources

1. Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité (Mémorial A n° 225, doc. parl. 8364)
2. ILR — La loi NIS 2
3. ILR — Auto-enregistrement NIS 2 et simulateur
4. ILR — Périmètre et champ d'application (size-cap)
5. ILR — Décision ILR/N26/9 du 11 juin 2026 contre Eltrona Interdiffusion S.A.
6. ENISA Threat Landscape: Transport Sector (21 mars 2023)
7. lux-Airport — communiqué masterplan de l'aéroport de Luxembourg, 16 avril 2026
8. ILR — Notification d'incident sous NIS 2 (plateforme SERIMA)

Read next