NIS 2 Luxembourg: 5 May 2026 law published, ILR self-registration window until 10 July 2026

Luxembourg's law of 5 May 2026 transposing Directive (EU) 2022/2555 (NIS 2) was published in the Memorial on 6 May 2026 (Memorial A No. 225) and entered into force on 10 May 2026. For affected organisations, the legal countdown has begun.

The bottom line

Key point: a two-month statutory window has opened for self-registration with the Luxembourg Institute of Regulation (ILR), the designated competent authority for NIS 2 operators. The deadline is 10 July 2026. All in-scope entities must register via the dedicated portal: ilr.lu/secteurs-activites/niss/nis-2.

Self-registration is more than a formality: it triggers official classification as an Essential Entity (EE) or Important Entity (IE), and determines the scope of inspections, incident reporting obligations and the basis for calculating sanctions.

Who is in scope?

The law distinguishes two categories of obligated entities based on the directive's criteria:

• Essential Entities: large companies (250 employees or more, or turnover above EUR 50M and balance sheet above EUR 43M) in the 11 highly critical sectors of Annex I (energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration, space); they also include, among others and whatever their size, public administration entities, qualified trust service providers, top-level domain name registries and DNS service providers.
• Important Entities: as a rule, the other entities in scope, from medium size upwards (50 employees or more, or turnover and balance sheet both above EUR 10M): in particular medium-sized companies in those 11 sectors, and medium-sized or large companies in the 7 other critical sectors of Annex II (postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research).

According to the ILR, between 1,500 and 2,000 entities could be in scope in Luxembourg (estimate given on 6 July 2026, reported by Paperjam). Every organisation that meets the criteria must register itself (Article 11 of the law): self-registration is a positive obligation.

What to prepare for registration

In practical terms, the ILR form requires:

• Company identification (RCS, NACE activity code, headcount, turnover).
• Details of a security point of contact (often the CISO), reachable by email and phone 24/7.
• List of critical services provided and operating sites in Luxembourg.
• Where applicable, identification of the European representative (for entities not established in the EU).

Before filling in the form, plan a formal internal nomination of the cyber officer, or appointment of an external CISO mandate if the function is not staffed. The law engages the personal liability of senior management for breaches (Article 20 of the directive).

After registration: triggered obligations

Self-registration is only the entry point. Once identified, the operator must:

• Implement a cyber risk management policy (Article 21 of the directive) covering 10 minimum measures: risk analysis, incident handling, business continuity, supply chain security, acquisition and development security, effectiveness assessment, cyber hygiene and training, cryptography, HR security and access, MFA.
• Implement an incident notification system to the ILR (the CSSF for the digital infrastructure and ICT services it supervises): early warning within 24 hours, incident notification within 72 hours, final report no later than one month after it; an intermediate report may be requested in between. Banks and financial market infrastructures notify under DORA.
• Have the cyber policy validated by the governance body (board or executive management). Directors must complete cyber training.
• Audit the ICT supply chain and insert NIS 2 clauses in contracts with critical providers.

Penalties for breach

The transposition law replicates the ceilings set by the directive. For Essential Entities: administrative fine up to EUR 10 million or 2% of annual worldwide turnover, whichever is higher. For Important Entities: up to EUR 7 million or 1.4% of worldwide turnover.

To these are added immediate corrective measures (injunctions, temporary suspension of certification or activity) and the personal liability of senior management (individual sanctions, temporary prohibition from holding executive positions in the affected sector).

How Luxgap helps

Eight weeks is a tight window for organisations starting from scratch. Our External CISO approach covers the full sequence: nomination of a cyber officer declared to the ILR, drafting of the risk management policy, deployment of the 24h incident alert system, supply chain audit, board cyber training.

For financial entities (including banks, investment firms, fund managers, insurers), DORA (applicable since 17 January 2025) sets ICT risk management and incident reporting; for those also covered by NIS 2 (banks, financial market infrastructures), it replaces the corresponding provisions of the NIS 2 law (Article 1(8) of the law; DORA, Article 1(2)). Our CISO Luxembourg mandate addresses both frameworks in a single programme.

Useful links

• Official text of the law of 5 May 2026 (Memorial A 225 of 6 May 2026)
• ILR NIS 2 portal and self-registration
• Directive (EU) 2022/2555 (NIS 2)
• Our NIS 2 practical sheet