I need to bring my Luxembourg organisation into compliance with recital 22 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 22 NIS 2 — Recital 22 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 22

Directive on the security of network and information systems · UE 2022/2555

(22)

This Directive sets out the baseline for cybersecurity risk-management measures and reporting obligations across the sectors that fall within its scope. In order to avoid the fragmentation of cybersecurity provisions of Union legal acts, where further sector-specific Union legal acts pertaining to cybersecurity risk-management measures and reporting obligations are considered to be necessary to ensure a high level of cybersecurity across the Union, the Commission should assess whether such further provisions could be stipulated in an implementing act under this Directive. Should such an implementing act not be suitable for that purpose, sector-specific Union legal acts could contribute to ensuring a high level of cybersecurity across the Union, while taking full account of the specificities and complexities of the sectors concerned. To that end, this Directive does not preclude the adoption of further sector-specific Union legal acts addressing cybersecurity risk-management measures and reporting obligations that take due account of the need for a comprehensive and consistent cybersecurity framework. This Directive is without prejudice to the existing implementing powers that have been conferred on the Commission in a number of sectors, including transport and energy.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the articulation of regimes is particularly sensitive because many entities combine financial activities (under CSSF and DORA) and support activities (under ILR and NIS 2). The law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, confirms that the ILR is the NIS 2 authority but does not replace the CSSF for the DORA scope nor the ILR-telecom for the EECC. A CSSF-regulated fintech may therefore simultaneously have an ILR file (IT subsidiary) and a CSSF file (banking services).

Luxgap practice: for any dual-hat entity (bank + datacenter, insurer + e-health, telecom + cloud), we formalize a competence matrix signed by the executive committee that designates, for each incident type, the lead authority and secondary authorities to notify, with Luxembourg-specific deadlines.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 22 establishes NIS 2 as a baseline, with sector-specific acts (DORA for finance, the upcoming cloud implementing act, ENISA telecom rules) stacking on top. The trap the ILR sanctions in practice: entities that apply only NIS 2 when a stricter sectoral act covers them (banks under DORA, telecom operators under the EECC, cloud providers under the upcoming European regime). Conversely, some financial entities believe DORA exempts them from NIS 2, when in fact they remain in scope for activities not covered by DORA (IT subsidiaries, holdings, group services).

The articulation test: which regime applies to which activity?

Lex specialis: a stricter sectoral act (DORA, EECC) prevails over NIS 2 for equivalent obligations, but NIS 2 remains applicable for anything the sectoral act does not cover.
Scope by activity, not by entity: a Luxembourg banking holding may have part of its activities under DORA (banking) and another under NIS 2 (IT subsidiary, internal datacenter, e-archiving).
Cumulative notifications: a single incident may simultaneously trigger ILR (NIS 2), CSSF (DORA), CNPD (GDPR) and BCL (payment systems) notifications. Deadlines and formats differ.
Mapping applicable regimes service by service, not at entity level, is the only way to demonstrate compliance to the ILR during an inspection.
Double sanction risk avoided by ne bis in idem, but authorities coordinate and the heaviest sanction applies.

How Luxgap automates this risk

Our Luxgap Regulatory Stack Mapper eliminates the blind spot of recital 22: it automatically maps, activity by activity and system by system, which European and Luxembourg regimes apply to your organization. The tool ingests your application repository (ServiceNow CMDB, Azure inventory, Odoo register, HR org chart), classifies each asset according to NIS 2 annexes, DORA scope, EECC and GDPR, and produces an articulation matrix opposable to the ILR, CSSF and CNPD.

Automatically detects activities covered by multiple regimes (NIS 2 + DORA, NIS 2 + EECC, NIS 2 + GDPR) by cross-referencing your application mapping with the annexes of European texts.
Classifies each system according to the strictest applicable regime and identifies cumulative obligations (notification, governance, subcontracting, resilience testing).
Generates a multi-authority notification plan for each incident scenario, with ILR (24h), CSSF DORA (4h), CNPD (72h) deadlines and expected formats prepared.
Alerts in real time when a new European implementing act or ENISA guide modifies the articulation of regimes on your perimeter.
Produces a timestamped PDF report demonstrating that your framework accounts for applicable lex specialis, opposable during an ILR or CSSF inspection.

Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a personalized quote and our teams will prepare a demonstration on your actual mapping, with a free 48h white audit to identify regimes you apply twice or forget.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 22

They trust us

Before we chat