How to comply with article 40 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 40 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 40 is an institutional clause: it requires the Commission to review the scope of NIS 2 every 36 months, assessing in particular the relevance of the size thresholds and the sectors of Annexes I and II. The trap for entities is not a direct sanction, but a blind spot: the NIS 2 scope is moving. A company out of scope today can become an important entity at the next review, or because the ILR designates it following a sectoral evolution. Organisations that freeze their applicability analysis once and for all wake up non compliant the day the scope changes, without having seen the assujettissement coming.Why your NIS 2 status must be monitored continuouslySize thresholds (medium enterprise under recommendation 2003/361/EC) change with your turnover and headcount: growth can push you over the line without warning.The sectors and subsectors of Annexes I and II can be broadened by legislative proposal after each review, adding new types of entity.The ILR can individually designate an essential or important entity beyond the automatic criteria, based on its criticality for the Luxembourg economy.A change of activity (new digital subsidiary, acquisition of a health or energy player) can trigger assujettissement overnight.Status drives heavy obligations: governance, risk management (article 21), incident notification (article 23), registration with the ILR.How Luxgap automates this riskOur Luxgap Scope Radar turns the question "am I in scope for NIS 2 ?" into continuous monitoring rather than a one off analysis that quickly becomes obsolete. The tool cross references your headcount and turnover data (Sage BOB 50, Cegid Quadra, Workday LU), your activity mapping and the NACE codes of your trade register to recalculate your in scope status at each variation, and it automatically integrates the scope changes coming from the Commission article 40 reviews and ILR designations.Continuously assesses your qualification (out of scope, important entity, essential entity) by matching your headcount and turnover against the thresholds of recommendation 2003/361/EC.Automatically detects any threshold crossing or change of activity through your connected HR and accounting systems, and alerts before assujettissement becomes effective.Monitors Commission and ILR publications to integrate the broadening of Annexes I and II sectors from the triennial reviews.Generates a timestamped applicability sheet documenting the basis of your qualification, enforceable before the ILR during an inspection or registration request.Produces a prioritised compliance plan (governance, article 21 measures, article 23 notification) triggered as soon as a status change is detected.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any commitment.

Review

They trust us

Before we chat