CORRELATION TABLE
Directive on the security of network and information systems · UE 2022/2555
| Directive (EU) 2016/1148 | This Directive |
| Article 1(1) | Article 1(1) |
| Article 1(2) | Article 1(2) |
| Article 1(3) | - |
| Article 1(4) | Article 2(12) |
| Article 1(5) | Article 2(13) |
| Article 1(6) | Article 2(6) and (11) |
| Article 1(7) | Article 4 |
| Article 2 | Article 2(14) |
| Article 3 | Article 5 |
| Article 4 | Article 6 |
| Article 5 | – |
| Article 6 | – |
| Article 7(1) | Article 7(1) and (2) |
| Article 7(2) | Article 7(4) |
| Article 7(3) | Article 7(3) |
| Article 8(1) to (5) | Article 8(1) to (5) |
| Article 8(6) | Article 13(4) |
| Article 8(7) | Article 8(6) |
| Article 9(1), (2) and (3) | Article 10(1), (2) and (3) |
| Article 9(4) | Article 10(9) |
| Article 9(5) | Article 10(10) |
| Article 10(1), (2) and (3), first subparagraph | Article 13(1), (2) and (3) |
| Article 10(3), second subparagraph | Article 23(9) |
| Article 11(1) | Article 14(1) and (2) |
| Article 11(2) | Article 14(3) |
| Article 11(3) | Article 14(4), first subparagraph, points (a) to (q) and (s), and paragraph (7) |
| Article 11(4) | Article 14(4), first subparagraph, point (r), and second subparagraph |
| Article 11(5) | Article 14(8) |
| Article 12(1) to (5) | Article 15(1) to (5) |
| Article 13 | Article 17 |
| Article 14(1) and (2) | Article 21(1) to (4) |
| Article 14(3) | Article 23(1) |
| Article 14(4) | Article 23(3) |
| Article 14(5) | Article 23(5), (6) and (8) |
| Article 14(6) | Article 23(7) |
| Article 14(7) | Article 23(11) |
| Article 15(1) | Article 31(1) |
| Article 15(2), first subparagraph, point (a) | Article 32(2), point (e) |
| Article 15(2), first subparagraph, point (b) | Article 32(2), point (g) |
| Article 15(2), second subparagraph | Article 32(3) |
| Article 15(3) | Article 32(4), point (b) |
| Article 15(4) | Article 31(3) |
| Article 16(1) and (2) | Article 21(1) to (4) |
| Article 16(3) | Article 23(1) |
| Article 16(4) | Article 23(3) |
| Article 16(5) | – |
| Article 16(6) | Article 23(6) |
| Article 16(7) | Article 23(7) |
| Article 16(8) and (9) | Article 21(5) and Article 23(11) |
| Article 16(10) | – |
| Article 16(11) | Article 2(1), (2) and (3) |
| Article 17(1) | Article 33(1) |
| Article 17(2), point (a) | Article 32(2), point (e) |
| Article 17(2), point (b) | Article 32(4), point (b) |
| Article 17(3) | Article 37(1), points (a) and (b) |
| Article 18(1) | Article 26(1), point (b), and paragraph (2) |
| Article 18(2) | Article 26(3) |
| Article 18(3) | Article 26(4) |
| Article 19 | Article 25 |
| Article 20 | Article 30 |
| Article 21 | Article 36 |
| Article 22 | Article 39 |
| Article 23 | Article 40 |
| Article 24 | – |
| Article 25 | Article 41 |
| Article 26 | Article 45 |
| Article 27 | Article 46 |
| Annex I, point (1) | Article 11(1) |
| Annex I, points (2)(a)(i) to (iv) | Article 11(2), points (a) to (d) |
| Annex I, point (2)(a)(v) | Article 11(2), point (f) |
| Annex I, point (2)(b) | Article 11(4) |
| Annex I, points (2)(c)(i) and (ii) | Article 11(5), point (a) |
| Annex II | Annex I |
| Annex III, points (1) and (2) | Annex II, point (6) |
| Annex III, point (3) | Annex I, point (8) |
In Luxembourg, the law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, transposes NIS 2 and repeals the national NIS 1 framework. The ILR is the sole competent authority: it designates essential and important entities, receives incident notifications (early warning within 24h, full notification within 72h, final report within 1 month), runs inspections and issues administrative sanctions. Former OES designated under ILR regulation N18/14 must actively re-onboard under the new regime, NIS 1 designation does not roll over automatically.
Luxgap practice: we preload the ILR reference set into the NIS Migration Bridge (notably sectoral requirements for eBRC, LuxConnect, POST and ILR regulation N25/1) and we map your existing documentation directly onto the ILR essential/important entity declaration form, ready to file.
