Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
66 articles found · #veille · Veille Luxgap
AI Act: labelling of AI content, 50 days to comply
The Commission confirms the Code of Practice on AI content labelling. Systems placed on the market before 2 Aug 2026 must comply by 2 Dec 2026.
DORA: CSSF tightens major ICT incident reporting
CSSF releases additional operational instructions for DORA major ICT incident reporting. Deadlines, content and data quality are tightened, aligning with the EU framework.
NIS 2 Luxembourg: ILR releases incident guide via SERIMA
The ILR, with HCPN/ANSSI-GOVCERT.LU, CIRCL and CSSF, releases rulebooks to handle NIS 2 incidents and meet the 24h/72h/1-month milestones via SERIMA.
EDPB harmonizes GDPR fines: a unified EU methodology
On 21 September 2026, the EDPB adopted guidelines aligning how GDPR fines are decided and calculated. Luxembourg companies gain predictability—alongside stricter enforcement.
40 medical practices hit: cyberattack at an IT provider
On 22 August 2026, a cyberattack crippled the cloud infrastructure of BMS Engineering in Luxembourg. The company confirmed 40 practices affected, no confirmed leak, while one practice reported patient data loss.
CNIL fines a hospital: €500,000 and security requirements
The CNIL fines the Hôpital privé de la Loire €500,000 after a large-scale EHR breach. A reminder of security (MFA, access rights, detection) and data subject notification requirements, with direct implications in Luxembourg.
MAG: 8.7M customers exposed — third‑party risk hits airports
Manchester Airports Group confirms unauthorized access to parking, lounge, Fast Track and Wi‑Fi data, affecting around 8.7M customers. The case highlights third‑party risk and GDPR/NIS 2 notification duties.
MyDr: 19M health records exposed — third‑party risk hits Europe
Polish health software vendor MyDr suffered a breach disclosed August 12–13, 2026: nearly 19M people and over 12,000 facilities may be affected. Poland’s PM suggested extortion as the motive.
WEBA (BE) hit by Qilin: ransomware, customer data accessed, 48 h recovery
On August 10, 2026, Belgian retailer WEBA was hit by a ransomware attack. Customer data was accessed; operations resumed on August 12. Qilin claimed responsibility on August 16; WEBA says no ransom was paid.
French Education Ministry: data breach targeting millions of students
On 18 August 2026, France’s Education Ministry confirmed an intrusion and investigation into a breach claimed to target several million students and tens of thousands of teachers. Highly detailed databases are reportedly involved.
15 August 2026: the Dutch Cybersecurity Act (NIS 2 NL) has entered into force
As of 15 August 2026, the Dutch NIS 2 law (Cyberbeveiligingswet) applies. For groups in Luxembourg with activities or providers in the Netherlands, obligations now apply on both sides of the border.
August 11, 2026: cold calling banned without consent
Since August 11, 2026, B2C cold calling in France is banned without prior explicit consent. Fines can reach €375,000 per breach for legal entities.