Recital 131
Directive on the security of network and information systems · UE 2022/2555
| (131) | Member States should be able to lay down the rules on criminal penalties for infringements of the national rules transposing this Directive. However, the imposition of criminal penalties for infringements of such national rules and of related administrative penalties should not lead to a breach of the principle of ne bis in idem, as interpreted by the Court of Justice of the European Union. |
In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) empowers the ILR to impose NIS 2 administrative sanctions (up to EUR 10 million or 2% of global turnover for essential entities). Related criminal offences (forgery, inspection obstruction, endangerment) fall to the Luxembourg public prosecutor under the Criminal Code. ILR / prosecutor coordination is not codified: it relies on practice and on the defence invoking ne bis in idem.
Luxgap practice: require a written coordination note from the first investigative act, and keep timestamped proof of every ILR notification to block any second prosecution on the same facts.
