How to comply with article 41 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 41 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 41 sets the transposition deadline at 17 October 2024, with measures applying from 18 October 2024. The trap is not in the directive text: it lies in the gap between the theoretical application date and the actual national transposition in each Member State. Many essential and important entities thought they were buying time by waiting for the national law, while the ILR already applies a designation, incident notification and inspection regime in Luxembourg. Waiting for the designation letter before starting compliance work is the classic mistake: once the ILR notifies that an entity falls under Annex I or II, the clock has already started and the transposition delay protects no one.What the application date actually changesThe risk management obligations (Article 21) and incident notification duties (Article 23) apply as soon as the national regime enters into force, regardless of when you receive your designation letter.Self-identification is the rule: an entity cannot invoke the absence of an ILR notification to justify the absence of cybersecurity measures.The entity register kept by the ILR requires you to register, particularly for digital infrastructure providers (DNS, cloud, datacenters, marketplaces).Administrative sanctions are enforceable from the application of national measures: up to 10 M EUR or 2% of worldwide turnover for essential entities.Management body liability (mandatory training, approval of measures) runs from application, not from designation.How Luxgap automates this riskOur Luxgap Scope Radar eliminates the most dangerous blind spot of NIS 2: not knowing you are in scope until the ILR reminds you. The tool cross-references your NACE code, headcount, turnover and real activity mapping (pulled from your Odoo contracts, Active Directory and Microsoft Defender asset inventory) to automatically determine whether you fall under Annex I or II, and whether you are an essential or important entity.Automatically classifies your organisation against Annex I and II using the sectoral grid of the law of 28 July 2023 and the SME thresholds of recommendation 2003/361/EC.Detects every new activity or subsidiary that would shift your status, by continuously monitoring your connected HR and financial data (Sage BOB 50, Cegid).Generates your prefilled registration file for the ILR entity register, with the required contact points and technical details.Calculates a gap score between your current measures and the Article 21 obligations, prioritised by criticality.Produces a timestamped PDF report, enforceable during an ILR inspection, demonstrating your self-identification process and the date you took your obligations into account.Available as part of a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any commitment.

Transposition

They trust us

Before we chat