Minimum harmonisation
Directive on the security of network and information systems · UE 2022/2555
Minimum harmonisation
This Directive shall not preclude Member States from adopting or maintaining provisions ensuring a higher level of cybersecurity, provided that such provisions are consistent with Member States’ obligations laid down in Union law.
In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) fully exercises the Article 5 option by going beyond the EU baseline on several points: the ILR can designate as essential entity organisations below the directive thresholds when deemed critical for the Grand Duchy (financial centre operators, sovereign communication infrastructure such as LuxConnect, eBRC). Administrative sanctions can reach EUR 10M or 2% of global turnover for essential entities, with immediate injunction power for the ILR.
Luxgap practice: verify without delay your designation status with the ILR, even if you believe you do not meet the European thresholds. Discretionary designation is possible and radically changes your obligations.