Recital 2
Directive on the security of network and information systems · UE 2022/2555
| (2) | Since the entry into force of Directive (EU) 2016/1148, significant progress has been made in increasing the Union’s level of cyber resilience. The review of that Directive has shown that it has served as a catalyst for the institutional and regulatory approach to cybersecurity in the Union, paving the way for a significant change in mind-set. That Directive has ensured the completion of national frameworks on the security of network and information systems by establishing national strategies on security of network and information systems and establishing national capabilities and by implementing regulatory measures covering essential infrastructures and entities identified by each Member State. Directive (EU) 2016/1148 has also contributed to cooperation at Union level through the establishment of the Cooperation Group and the network of national computer security incident response teams. Notwithstanding those achievements, the review of Directive (EU) 2016/1148 has revealed inherent shortcomings that prevent it from addressing effectively current and emerging cybersecurity challenges. |
In Luxembourg, the law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, transposes NIS 2 and explicitly builds on the NIS 1 achievements (law of 28 May 2019). The ILR remains the competent national authority, receives incident notifications, conducts inspections and imposes administrative sanctions. Entities already designated as OES under NIS 1 are automatically re-assessed by the ILR against the new NIS 2 criteria (size, sector, criticality).
Luxgap practice: do not assume that your Luxembourg NIS 1 status carries over identically. Request written confirmation from the ILR of your qualification (essential or important) and keep the response as accountability evidence, since obligations and sanction caps differ by category.
