Transposition
Directive on the security of network and information systems · UE 2022/2555
Transposition
1. By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive. They shall immediately inform the Commission thereof.
They shall apply those measures from 18 October 2024.
2. When Member States adopt the measures referred to in paragraph 1, they shall contain a reference to this Directive or shall be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.
In Luxembourg, the NIS 2 directive was transposed by the law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025. The ILR (Luxembourg Regulatory Institute) is the competent authority: it designates essential and important operators, receives incident notifications, conducts inspections and imposes administrative sanctions. The Luxembourg transposition is ahead of many Member States, which means ILR inspections have already started in the country.
Luxgap practice: check your qualification without delay via the ILR form and proceed to the mandatory registration on the dedicated platform. Our teams prepare the registration dossier and the article 21 risk mapping within 4 to 6 weeks, with board approval minutes ready to sign.