The classic trap
Recital 22 establishes NIS 2 as a baseline, with sector-specific acts (DORA for finance, the upcoming cloud implementing act, ENISA telecom rules) stacking on top. The trap the ILR sanctions in practice: entities that apply only NIS 2 when a stricter sectoral act covers them (banks under DORA, telecom operators under the EECC, cloud providers under the upcoming European regime). Conversely, some financial entities believe DORA exempts them from NIS 2, when in fact they remain in scope for activities not covered by DORA (IT subsidiaries, holdings, group services).
The articulation test: which regime applies to which activity?
- Lex specialis: a stricter sectoral act (DORA, EECC) prevails over NIS 2 for equivalent obligations, but NIS 2 remains applicable for anything the sectoral act does not cover.
- Scope by activity, not by entity: a Luxembourg banking holding may have part of its activities under DORA (banking) and another under NIS 2 (IT subsidiary, internal datacenter, e-archiving).
- Cumulative notifications: a single incident may simultaneously trigger ILR (NIS 2), CSSF (DORA), CNPD (GDPR) and BCL (payment systems) notifications. Deadlines and formats differ.
- Mapping applicable regimes service by service, not at entity level, is the only way to demonstrate compliance to the ILR during an inspection.
- Double sanction risk avoided by ne bis in idem, but authorities coordinate and the heaviest sanction applies.
How Luxgap automates this risk
Our Luxgap Regulatory Stack Mapper eliminates the blind spot of recital 22: it automatically maps, activity by activity and system by system, which European and Luxembourg regimes apply to your organization. The tool ingests your application repository (ServiceNow CMDB, Azure inventory, Odoo register, HR org chart), classifies each asset according to NIS 2 annexes, DORA scope, EECC and GDPR, and produces an articulation matrix opposable to the ILR, CSSF and CNPD.
- Automatically detects activities covered by multiple regimes (NIS 2 + DORA, NIS 2 + EECC, NIS 2 + GDPR) by cross-referencing your application mapping with the annexes of European texts.
- Classifies each system according to the strictest applicable regime and identifies cumulative obligations (notification, governance, subcontracting, resilience testing).
- Generates a multi-authority notification plan for each incident scenario, with ILR (24h), CSSF DORA (4h), CNPD (72h) deadlines and expected formats prepared.
- Alerts in real time when a new European implementing act or ENISA guide modifies the articulation of regimes on your perimeter.
- Produces a timestamped PDF report demonstrating that your framework accounts for applicable lex specialis, opposable during an ILR or CSSF inspection.
Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a personalized quote and our teams will prepare a demonstration on your actual mapping, with a free 48h white audit to identify regimes you apply twice or forget.
