Recital 114
Directive on the security of network and information systems · UE 2022/2555
| (114) | In order to take account of the cross-border nature of the services and operations of DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines and of social networking services platforms, only one Member State should have jurisdiction over those entities. Jurisdiction should be attributed to the Member State in which the entity concerned has its main establishment in the Union. The criterion of establishment for the purposes of this Directive implies the effective exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect. Whether that criterion is fulfilled should not depend on whether the network and information systems are physically located in a given place; the presence and use of such systems do not, in themselves, constitute such main establishment and are therefore not decisive criteria for determining the main establishment. The main establishment should be considered to be in the Member State where the decisions related to the cybersecurity risk-management measures are predominantly taken in the Union. This will typically correspond to the place of the entities’ central administration in the Union. If such a Member State cannot be determined or if such decisions are not taken in the Union, the main establishment should be considered to be in the Member State where cybersecurity operations are carried out. If such a Member State cannot be determined, the main establishment should be considered to be in the Member State where the entity has the establishment with the highest number of employees in the Union. Where the services are carried out by a group of undertakings, the main establishment of the controlling undertaking should be considered to be the main establishment of the group of undertakings. |
In Luxembourg, the ILR (Institut Luxembourgeois de Regulation) is the designated NIS 2 competent authority under the law of 28 July 2023 on cybersecurity (amended on 28 July 2025). For a cross-border group to fall under ILR jurisdiction by virtue of recital 114, it must demonstrate that cyber risk-management decisions are predominantly taken from Luxembourg, which typically applies to holdings and MSPs whose EU central administration sits in the Grand Duchy.
Luxgap practice: before any registration with the ILR, formalise in writing the location of your cyber committee and group CISO, and keep arbitration evidence (committee minutes, policy approvals) demonstrating the Luxembourg decisional anchor.
