How to comply with article 45 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 45 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 45 sets the entry into force of the directive itself, but the real trap lies in the transposition date and the national application date. Many entities confuse the directive's entry into force (January 2023) with the moment their obligations become binding. In Luxembourg, the national transposition law triggers ILR oversight, and an entity that waits until the last minute ends up with no cyber governance, no incident management plan and no working notification process the day the authority can sanction.Why an effective date is a compliance risk, not a formalityA date is never neutral under NIS 2: it opens the liability window for management bodies (Article 20), the 24h and 72h incident notification duties (Article 23) and the ILR's sanctioning power (up to 10 M EUR or 2% of worldwide turnover for essential entities). The most common pitfalls:Confusing the directive's entry into force with the entry into application of the transposed national obligations.Failing to track sector-specific key dates (energy, health, digital infrastructure, public administration) once the ILR has classified you as essential or important.Starting compliance after official designation, when technical and organisational measures take months to deploy.Forgetting that notification deadlines run from application, with no automatic grace period.Keeping no dated evidence of the progressive rollout of measures, which weakens your defence during an inspection.How Luxgap automates this riskOur Luxgap Compliance Clock turns the fog of regulatory dates into an opposable roadmap aligned with your actual classification. The tool cross-references the entity status the ILR notified to you, your Annex I or II sector and the real state of your technical measures to continuously compute your exposure against each NIS 2 deadline, without asking the CISO to maintain a spreadsheet by hand.Automatically detects the deadlines applicable to your entity (transposition, application, 24h/72h notification windows) and projects them onto your M365 or Teams calendar.Calculates a lateness score per domain (governance, incident handling, continuity, supply chain) by connecting to Microsoft Defender, Azure Sentinel and your ISO 27001 baseline.Alerts instantly on Teams as soon as a mandatory measure remains uncovered ahead of a binding date.Generates a timestamped log of your compliance build-up, an opposable diligence record for the ILR during an inspection.Produces a sealed PDF report demonstrating that each obligation was covered by its application date.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free white audit within 48h to measure your exposure before any commitment.

Entry into force

They trust us

Before we chat