Recital 10
Directive on the security of network and information systems · UE 2022/2555
| (10) | Although this Directive applies to entities carrying out activities in the production of electricity from nuclear power plants, some of those activities may be linked to national security. Where that is the case, a Member State should be able to exercise its responsibility for safeguarding national security with respect to those activities, including activities within the nuclear value chain, in accordance with the Treaties. |
In Luxembourg, the nuclear question remains largely theoretical since the country does not operate any nuclear power plant on its territory. However, the Law of 28 July 2023 on cybersecurity, amended by the Law of 28 July 2025, designates ILR as the competent authority to qualify essential and important entities in the energy sector, including activities of import, transit and distribution of nuclear electricity produced abroad (Cattenom, Tihange). Coordination with the High Commission for National Protection (HCPN) is required as soon as an activity touches national security.
Luxgap practice: for any Luxembourg actor in the nuclear value chain (energy trading, interconnection, engineering), we map at the scoping stage whether your activities fall under the standard ILR NIS 2 regime or the mixed ILR / HCPN regime, to avoid an erroneous qualification as an essential entity.
