Recital 21
Directive on the security of network and information systems · UE 2022/2555
| (21) | The Commission could provide guidance to assist Member States in implementing the provisions of this Directive on scope and evaluating the proportionality of the measures to be taken pursuant to this Directive, in particular as regards entities with complex business models or operating environments, whereby an entity may simultaneously fulfil the criteria assigned to both essential and important entities or may simultaneously carry out activities, some of which fall within and some of which are excluded from the scope of this Directive. |
In Luxembourg, the ILR designates essential and important operators under the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025). In case of mixed qualification or proportionality doubt, the ILR can be petitioned for ad hoc qualification, and takes into account the European Commission guidance referred to in recital 21.
Luxgap practice: before any self-qualification, file a reasoned memorandum with the ILR via the dedicated notification form. This secures your position and avoids retroactive requalification during an incident.
