How to comply with article 44 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 44 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 44 repeals the NIS 1 Directive (EU 2016/1148) with effect from 18 October 2024 and redirects all references to NIS 2. The trap is not textual, it is documentary: many entities still operate with security policies, incident notification procedures and contractual clauses that cite the old NIS 1 framework. During an inspection, the ILR does not sanction the wrong legal citation as such, but the underlying finding that an outdated set of documents reflects a frozen risk management programme, hence non-compliant with the strengthened requirements of Articles 21 and 23 of NIS 2.What the repeal actually changes for your complianceBeyond the legal housekeeping, moving from NIS 1 to NIS 2 changes both scope and obligations. Concrete points to check:Your status may have changed: NIS 2 introduces the essential / important entity duality, with a far broader sectoral scope than NIS 1 (public administration, ICT service management, space, etc.).Incident notification deadlines are tighter: early warning within 24h, notification within 72h, final report within one month, where NIS 1 remained vague.The liability of management bodies is explicitly engaged (Article 20), with a training obligation.Your supplier contracts, cyber insurance policies and internal procedures still referencing Directive 2016/1148 must be reread against the correlation table in Annex III.Cross-references in your supply chain risk analyses (Article 21.2.d) must point to the new framework.How Luxgap automates this riskOur Luxgap Regulatory Drift Tracker makes it impossible to leave a document citing NIS 1 dormant while your entire framework has shifted to NIS 2. A specialised AI agent continuously parses your document base (SharePoint M365, Confluence, Odoo contract space, eBRC document management) and detects every obsolete legal reference to remap it automatically to the equivalent NIS 2 article, following the correlation table in Annex III.Scans your security policies, notification procedures and supplier contracts to spot any residual mention of Directive 2016/1148.Proposes the corresponding NIS 2 reference based on the Annex III correlation table, with the exact passage to fix.Reassesses your essential or important entity qualification against the broadened Annexes I and II and alerts you if your status has changed.Aligns your internal incident notification deadlines with the 24h / 72h / one-month sequence and flags procedures still based on the old framework.Produces a timestamped PDF report, enforceable before the ILR during an inspection, demonstrating that your documentary framework reflects the law in force.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real data, with a free blank audit within 48h to measure your exposure before any commitment.

Repeal

They trust us

Before we chat