Recital 12
Directive on the security of network and information systems · UE 2022/2555
| (12) | Postal service providers as defined in Directive 97/67/EC of the European Parliament and of the Council (7), including providers of courier services, should be subject to this Directive if they provide at least one of the steps in the postal delivery chain, in particular clearance, sorting, transport or distribution of postal items, including pick-up services, while taking account of the degree of their dependence on network and information systems. Transport services that are not undertaken in conjunction with one of those steps should be excluded from the scope of postal services. |
In Luxembourg, the ILR (Institut Luxembourgeois de Regulation) designates essential and important entities and receives self-registration declarations from postal providers. The law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, transposes recital 12 and requires postal providers and courier services (POST Luxembourg, DHL, FedEx, Michel Greco, and all last-mile players active on Luxembourg territory) to register with the ILR as soon as they perform at least one step of the postal chain.
Luxgap practice: even a cross-border player based in Belgium or France that distributes postal items in Luxembourg must register with the ILR. We systematically check the cross-border dimension of logistics flows before concluding out-of-scope qualification.
