How to comply with article 42 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 42 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 42 deletes Article 19 of the eIDAS Regulation (EU 910/2014) with effect from 18 October 2024. In practice, the security and incident notification obligations of trust service providers (qualified electronic signatures, seals, timestamping, archiving) are no longer governed by eIDAS but shift to the general NIS 2 regime. The trap: many Luxembourg providers assumed they would remain under their eIDAS supervisory body alone, whereas they become Annex I entities (digital infrastructure) supervised by the ILR, with far stricter incident notification deadlines. The ILR sanctions late notification and risk management still modelled on eIDAS, now insufficient.What concretely changes for trust service providersSecurity risk management rules are no longer those of eIDAS Article 19 but those of NIS 2 Article 21, which are broader (supply chain, cryptography, continuity).Incident notification switches to the NIS 2 cadence: early warning within 24h, full notification within 72h, final report within one month, to the ILR and the national CSIRT.The dual regime disappears: no longer a single eIDAS notification, but full compliance with the NIS 2 sequence.Cross supervision between the eIDAS supervisory body and the ILR must be mapped to avoid blind spots.Existing eIDAS certifications and audits no longer cover Article 21 NIS 2 requirements on their own: a compliance gap appears as of 18 October 2024.How Luxgap automates this riskOur Luxgap Trust Service Bridge eliminates the blind spot created by the deletion of eIDAS Article 19 by automatically reconciling your historical eIDAS obligations with the new NIS 2 regime. The AI agent reads your certification policies, eIDAS audit reports and incident logs, then precisely maps what remains covered and what must be closed under NIS 2 Article 21, without asking your CISO to review line by line.Detects gaps between your existing eIDAS measures and the Article 21 NIS 2 risk management requirements (supply chain, cryptography, continuity).Generates the preconfigured NIS 2 notification sequence (24h warning, 72h notification, one month final report) with templates ready to submit to the ILR and the national CSIRT.Cross checks your eIDAS certificates, ETSI audits and Defender or Sentinel logs to materialise the real coverage of your trust service.Alerts in real time via Teams as soon as an incident meets the NIS 2 notification criteria, with the regulatory countdown running.Produces a timestamped, sealed PDF report, enforceable before the ILR during an inspection, demonstrating the eIDAS to NIS 2 Article 21 migration.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a free blind audit within 48h to measure your exposure before any commitment.

Amendment of Regulation (EU) No 910/2014

They trust us

Before we chat