Committee procedure
Directive on the security of network and information systems · UE 2022/2555
Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
3. Where the opinion of the committee is to be obtained by written procedure, that procedure shall be terminated without result when, within the time-limit for delivery of the opinion, the chair of the committee so decides or a committee member so requests.
In Luxembourg, the ILR (Institut Luxembourgeois de Regulation) is the body that applies in practice the technical requirements stemming from the implementing acts adopted through the Article 39 committee, and that receives incident notifications according to the formats and deadlines they specify. The law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, designates the ILR as the competent authority, empowers it to conduct inspections and impose administrative sanctions (up to EUR 10 million or 2% of worldwide turnover for essential entities). European implementing acts apply directly, without further transposition.
Luxgap practice: subscribe your watch to EUR-Lex publications AND ILR communications in parallel, since the ILR often specifies national operational arrangements (notification channels, templates) beyond the European text.
