Recital 130
Directive on the security of network and information systems · UE 2022/2555
| (130) | Where an administrative fine is imposed on an essential or important entity that is an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. Where an administrative fine is imposed on a person that is not an undertaking, the competent authority should take account of the general level of income in the Member State as well as the economic situation of the person when considering the appropriate amount of the fine. It should be for the Member States to determine whether and to what extent public authorities should be subject to administrative fines. Imposing an administrative fine does not affect the application of other powers of the competent authorities or of other penalties laid down in the national rules transposing this Directive. |
In Luxembourg, the law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, designates the ILR as the competent authority for imposing NIS 2 administrative fines. The Luxembourg legislator clarified the treatment of public entities: municipalities, ministries and public establishments qualified as essential entities (public administration, Annex I) are subject to ILR corrective measures and injunctions, with a fine regime modulated according to their nature.
Luxgap practice: for groups whose parent is a Luxembourg holding (SOPARFI), document upfront the operational reality of each subsidiary (governance, accounts, strategic decisions) to argue autonomy before the ILR and reduce the 2% calculation base.
