How to comply with article 43 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 43 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 43 deletes Articles 40 and 41 of Directive (EU) 2018/1972 (the European Electronic Communications Code) with effect from 18 October 2024. These two articles imposed specific security and incident-notification obligations on providers of electronic communications networks and services. The trap: many Luxembourg telecom operators (POST, internet access providers, private network operators) still believe they apply the old Code regime, while their obligations now shift entirely under NIS 2. The ILR does not sanction the lack of awareness of this transfer: it sanctions the persistence of notification procedures built on the old Article 40 when the deadlines, the scope and the competent authorities have changed.What actually changes for electronic communications operatorsThis transfer is not a simple article renumbering. The requirements tighten and align with the general NIS 2 regime.Cybersecurity risk-management obligations move from Article 40 of the Code to Article 21 of NIS 2 (technical and organisational measures, supply chain, cryptography, incident handling).Incident notification migrates from Article 40 to Article 23 of NIS 2, with its tiered system: early warning within 24h, notification within 72h, final report within 1 month.Telecom operators become essential or important entities within the meaning of Annexes I and II, rather than entities governed by a separate sectoral regime.The competent authority remains the ILR in Luxembourg, but the reference framework, the criticality thresholds and the inspection powers are those of NIS 2.The risk: keeping a business continuity plan and an incident runbook that still reference the old Code, hence unenforceable during an ILR audit.How Luxgap automates this riskOur Luxgap Regulatory Drift Detector guarantees that your internal procedures never reference a repealed or transferred legal article. The tool ingests your security policies, incident runbooks, continuity plans and contractual clauses from your M365 SharePoint, your Confluence or your document store, then a specialised LLM agent continuously confronts them with the living regulatory corpus (NIS 2, the Communications Code, the Luxembourg law of 28 July 2023) to detect every reference that has become obsolete.Scans your compliance documents and automatically detects references to Articles 40 and 41 of the Code, repealed since 18 October 2024, with the mapping to Articles 21 and 23 of NIS 2.Generates corrected versions of your incident notification runbooks, aligned with the 24h / 72h / 1 month triptych required by Article 23.Alerts on Teams or by email as soon as a repeal or transfer of an article impacts a document you have already published internally.Rebuilds your obligation matrix as an electronic communications operator, requalified as an essential or important entity under NIS 2.Produces a time-stamped PDF report, enforceable before the ILR during an inspection, demonstrating that your documentary baseline ref...

Amendment of Directive (EU) 2018/1972

They trust us

Before we chat