Recital 16

Recital 16

Directive on the security of network and information systems · UE 2022/2555

(16)

In order to avoid entities that have partner enterprises or that are linked enterprises being considered to be essential or important entities where this would be disproportionate, Member States are able to take into account the degree of independence an entity enjoys in relation to its partner or linked enterprises when applying Article 6(2) of the Annex to Recommendation 2003/361/EC. In particular, Member States are able to take into account the fact that an entity is independent from its partner or linked enterprises in terms of the network and information systems that that entity uses in the provision of its services and in terms of the services that the entity provides. On that basis, where appropriate, Member States are able to consider that such an entity does not qualify as a medium-sized enterprise under Article 2 of the Annex to Recommendation 2003/361/EC, or does not exceed the ceilings for a medium-sized enterprise provided for in paragraph 1 of that Article, if, after taking into account the degree of independence of that entity, that entity would not have been considered to qualify as a medium-sized enterprise or to exceed those ceilings in the event that only its own data had been taken into account. This leaves unaffected the obligations laid down in this Directive of partner and linked enterprises which fall within the scope of this Directive.

Luxembourg specificity
loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the ILR (Institut Luxembourgeois de Regulation) rules on the qualification as essential or important entity, under the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025). The independence file based on recital 16 must be filed with the ILR together with the technical evidence justifying IT autonomy; otherwise the consolidated group qualification applies by default.

Luxgap practice: for Luxembourg subsidiaries of international groups (common in finance and industry), we file with the ILR an independence memorandum together with the technical map produced by Luxgap Independence Profiler, before the self-registration deadline, to secure the status ahead of any audit.