NIS2 obligations in Luxembourg

Competent authority & CSIRT Legal ref: Chapter 2, Art. 3-10

• The Luxembourg Institute of Regulation (competent authority for all sectors except financial, digital infrastructure and ICT service management). ecs-org.eu · 28 Oct 2026 · secondary source
• The Commission for the Supervision of the Financial Sector (competent authority for the financial sector. ecs-org.eu · 28 Oct 2026 · secondary source
• The digital infrastructure sector and the ICT service management sector). ecs-org.eu · 28 Oct 2026 · secondary source
• HCPN (single point of contact). ecs-org.eu · 28 Oct 2026 · secondary source
• GOVCERT and CIRCL (CSIRTS). ecs-org.eu · 28 Oct 2026 · secondary source
• HCPN (competent authority for crisis management). ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Annex 1, 2

• Corresponds to NIS2 ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 17

• Entities in scope will be required to self-register via an online registration form. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities are required to submit the following information to the competent authority: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification, as well as the type of entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Addresses of the main establishment, other establishments in the EU and legal representatives outside the EU. ecs-org.eu · 28 Oct 2026 · secondary source
• Up-to-date contact details of the entity and its legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address . ecs-org.eu · 28 Oct 2026 · secondary source
• Link: Registration form ecs-org.eu · 28 Oct 2026 · secondary source
• Entities were requested to submit the information by 17 January 2025. ecs-org.eu · 28 Oct 2026 · secondary source
• The Forum of Industry Representatives was established as a communication channel allowing members to raise questions regarding the implementation of the measures and enforcement by national authorities. ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Registration form

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 14

• Incidents will be reported to Competent Authorities ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements : ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 26

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• A provision establishing fines for budgetary bodies under GDPR practises is considered. GDPR is also used to guide the mechanism determining the amount and type of fines according to the ‘level’ of the infringement detected. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art 12

• Reference to European and international Standards ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Law

What changed recently

1. 10 May 2026
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source