I need to bring my Luxembourg organisation into compliance with recital 135 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 135 clarifies a mutual assistance mechanism between national authorities that catches multi-jurisdictional entities off guard. Concretely, if your parent company is based in Luxembourg but you operate cloud infrastructure in Ireland, the Irish authority can ask the ILR to trigger an inspection at your premises. Essential or important entities that assume they only answer to their primary national authority often discover too late that they are controllable by any NIS 2 authority of a Member State where they have a network or information system. The trap: maintaining homogeneous cybersecurity documentation on the LU side but inconsistent with the operational reality of a site in DE or BE.What cross-border mutual assistance changes for your governanceAny subsidiary, branch or even a datacenter hosted in another Member State becomes an entry point for an inspection coordinated by the ILR at the request of a foreign counterpart.Incident notification deadlines (24h early warning, 72h notification, 1 month final report) apply in parallel in each affected jurisdiction, not in cascade.An enforcement measure taken by another Member State (audit order, injunction, provisional sanction) must be executed locally by the ILR if the mutual assistance request is validated.Cybersecurity documentation (ISMS policy, risk register, business continuity plan) must be consistent across all locations, otherwise contradictions will be exploited during a coordinated inspection.Critical subcontractors (cloud, MSP, outsourced SOC) located in another Member State also fall within the scope of a mutual assistance request.How Luxgap automates this riskOur Luxgap Cross-Border Exposure Map maps in real time all your NIS 2 regulatory touchpoints across the EU and calculates, for each Member State, your actual exposure to a mutual assistance request. The tool connects to your Azure AD, AWS Organizations, Google Cloud Resource Manager, KBO/RCS registries and Odoo supplier contracts to materialize the effective geography of your information systems, not the one declared in your ILR file.Automatically detects every cloud resource, datacenter or branch in a Member State via the Azure, AWS, GCP and OVH APIs, with precise region/AZ geolocation.Maps each competent NIS 2 authority (BSI in DE, ANSSI in FR, CCB in BE, NCSC-NL in the Netherlands, ILR in LU) likely to issue a mutual assistance request concerning you.Compares your local cybersecurity documentation against each national authority's requirements and flags inconsistencies exploitable during a coordinated inspection.Generates a prefilled mutual assistance file ready to submit to the ILR if a foreign request lands, including certified translation of critical evidence.Alerts via Teams or email as soon as a new location triggers an essential or important entity qualification threshold in another Member State.Produces a timestamped PDF report opposable to the ILR, demonstrating the cross-border consistency o...

Recital 135 NIS 2 — Recital 135 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 135

Directive on the security of network and information systems · UE 2022/2555

(135)

In order to ensure effective supervision and enforcement, in particular in a situation with a cross-border dimension, a Member State that has received a request for mutual assistance should, within the limits of that request, take appropriate supervisory and enforcement measures in relation to the entity that is the subject of that request, and that provides services or has a network and information system on the territory of that Member State.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite (modifiee par la loi du 28 juillet 2025)

In Luxembourg, the ILR is the authority designated to receive and execute NIS 2 mutual assistance requests issued by its European counterparts. The law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, explicitly empowers the ILR to conduct inspections, document reviews and enforcement measures on Luxembourg territory on behalf of a foreign authority, under the same conditions as a domestic procedure.

Luxgap practice: prepare a single cross-border consistency file covering all your EU locations, translated in French and English, and made available to the ILR within 48h upon a mutual assistance request.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 135 clarifies a mutual assistance mechanism between national authorities that catches multi-jurisdictional entities off guard. Concretely, if your parent company is based in Luxembourg but you operate cloud infrastructure in Ireland, the Irish authority can ask the ILR to trigger an inspection at your premises. Essential or important entities that assume they only answer to their primary national authority often discover too late that they are controllable by any NIS 2 authority of a Member State where they have a network or information system. The trap: maintaining homogeneous cybersecurity documentation on the LU side but inconsistent with the operational reality of a site in DE or BE.

What cross-border mutual assistance changes for your governance

Any subsidiary, branch or even a datacenter hosted in another Member State becomes an entry point for an inspection coordinated by the ILR at the request of a foreign counterpart.
Incident notification deadlines (24h early warning, 72h notification, 1 month final report) apply in parallel in each affected jurisdiction, not in cascade.
An enforcement measure taken by another Member State (audit order, injunction, provisional sanction) must be executed locally by the ILR if the mutual assistance request is validated.
Cybersecurity documentation (ISMS policy, risk register, business continuity plan) must be consistent across all locations, otherwise contradictions will be exploited during a coordinated inspection.
Critical subcontractors (cloud, MSP, outsourced SOC) located in another Member State also fall within the scope of a mutual assistance request.

How Luxgap automates this risk

Our Luxgap Cross-Border Exposure Map maps in real time all your NIS 2 regulatory touchpoints across the EU and calculates, for each Member State, your actual exposure to a mutual assistance request. The tool connects to your Azure AD, AWS Organizations, Google Cloud Resource Manager, KBO/RCS registries and Odoo supplier contracts to materialize the effective geography of your information systems, not the one declared in your ILR file.

Automatically detects every cloud resource, datacenter or branch in a Member State via the Azure, AWS, GCP and OVH APIs, with precise region/AZ geolocation.
Maps each competent NIS 2 authority (BSI in DE, ANSSI in FR, CCB in BE, NCSC-NL in the Netherlands, ILR in LU) likely to issue a mutual assistance request concerning you.
Compares your local cybersecurity documentation against each national authority's requirements and flags inconsistencies exploitable during a coordinated inspection.
Generates a prefilled mutual assistance file ready to submit to the ILR if a foreign request lands, including certified translation of critical evidence.
Alerts via Teams or email as soon as a new location triggers an essential or important entity qualification threshold in another Member State.
Produces a timestamped PDF report opposable to the ILR, demonstrating the cross-border consistency of your NIS 2 framework.

Available as a complement to a Luxgap CISO mandate or as a standalone SaaS module depending on your European footprint. Request a tailored quote and our teams will prepare a demonstration on your real mapping, with a free 48h white audit to measure your cross-border exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 135

They trust us

Before we chat