I need to bring my Luxembourg organisation into compliance with recital 27 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 27 establishes NIS 2 as the horizontal baseline for EU cybersecurity. The practical trap: assuming a later sector-specific act (DORA for finance, future energy or health acts) replaces NIS 2 when it actually articulates with it. The Luxembourg ILR verifies that essential and important entities comply with NIS 2 in addition to their sector obligations, unless an explicit lex specialis clause applies (Article 4 NIS 2). Confusion between the two regimes typically leaves a governance gap that inspectors spot immediately.How to read NIS 2 vs sector-specific actsNIS 2 provides the definitions (essential entity, important entity, significant incident) binding on future acts unless expressly derogated.NIS 2 provides the supervisory framework (ILR inspections, targeted audits, information requests) that remains applicable even when a sector act adds its own controls.NIS 2 provides the sanctions regime (up to EUR 10 million or 2% of global turnover for essential entities) that applies unless the sector act provides an at-least-equivalent regime (case of DORA for financial entities).For a Luxembourg bank: DORA prevails on ICT risk management and incidents, but NIS 2 still governs definitions and cross-border cooperation via the CSIRT.For a hospital or municipality: no sector act derogates, NIS 2 applies in full via the law of 28 July 2023.How Luxgap automates this riskOur Luxgap Regulatory Mesh Mapper removes the grey zone between NIS 2, DORA, GDPR and sector-specific acts by mapping in real time which obligation applies to which legal entity of your group. The tool cross-references your Kbis registry, NACE codes, CSSF/ILR licences and Azure/AWS cloud contracts to produce a legally opposable cybersecurity obligations matrix, without asking the CISO to fill a single Excel sheet.Automatically detects each entity of your group and qualifies it as essential, important or out-of-scope NIS 2 according to Annexes I and II and the thresholds of the law of 28 July 2023.Resolves lex specialis conflicts between NIS 2 and sector acts (DORA for finance, upcoming energy texts) based on Article 4 NIS 2 and ENISA guidelines.Sends Teams or Slack alerts as soon as a new sector EU act is published in the OJEU and impacts your obligations matrix.Generates a cryptographically signed entity qualification report, opposable to the ILR during inspection or classification requests.Tracks the evolution of sector thresholds (turnover, headcount, criticality) and re-qualifies entities quarterly.Available as part of a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free 48h white audit to qualify your entities before any engagement.

Recital 27 NIS 2 — Recital 27 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 27

Directive on the security of network and information systems · UE 2022/2555

(27)	Future sector-specific Union legal acts should take due account of the definitions and the supervisory and enforcement framework laid down in this Directive.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) transposes NIS 2 and designates the ILR as competent national authority for qualifying essential and important entities, inspections, incident notifications and administrative sanctions. The articulation with DORA is explicit: for financial entities supervised by the CSSF, DORA prevails on ICT risk but the Luxembourg NIS 2 law still applies for cross-cutting definitions and CSIRT cooperation.

Luxgap practice: for any Luxembourg multi-entity group (holding plus operational subsidiaries), we map entity by entity the ILR vs CSSF obligations matrix before any notification, avoiding duplicate filings and qualification blind spots.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 27 establishes NIS 2 as the horizontal baseline for EU cybersecurity. The practical trap: assuming a later sector-specific act (DORA for finance, future energy or health acts) replaces NIS 2 when it actually articulates with it. The Luxembourg ILR verifies that essential and important entities comply with NIS 2 in addition to their sector obligations, unless an explicit lex specialis clause applies (Article 4 NIS 2). Confusion between the two regimes typically leaves a governance gap that inspectors spot immediately.

How to read NIS 2 vs sector-specific acts

NIS 2 provides the definitions (essential entity, important entity, significant incident) binding on future acts unless expressly derogated.
NIS 2 provides the supervisory framework (ILR inspections, targeted audits, information requests) that remains applicable even when a sector act adds its own controls.
NIS 2 provides the sanctions regime (up to EUR 10 million or 2% of global turnover for essential entities) that applies unless the sector act provides an at-least-equivalent regime (case of DORA for financial entities).
For a Luxembourg bank: DORA prevails on ICT risk management and incidents, but NIS 2 still governs definitions and cross-border cooperation via the CSIRT.
For a hospital or municipality: no sector act derogates, NIS 2 applies in full via the law of 28 July 2023.

How Luxgap automates this risk

Our Luxgap Regulatory Mesh Mapper removes the grey zone between NIS 2, DORA, GDPR and sector-specific acts by mapping in real time which obligation applies to which legal entity of your group. The tool cross-references your Kbis registry, NACE codes, CSSF/ILR licences and Azure/AWS cloud contracts to produce a legally opposable cybersecurity obligations matrix, without asking the CISO to fill a single Excel sheet.

Automatically detects each entity of your group and qualifies it as essential, important or out-of-scope NIS 2 according to Annexes I and II and the thresholds of the law of 28 July 2023.
Resolves lex specialis conflicts between NIS 2 and sector acts (DORA for finance, upcoming energy texts) based on Article 4 NIS 2 and ENISA guidelines.
Sends Teams or Slack alerts as soon as a new sector EU act is published in the OJEU and impacts your obligations matrix.
Generates a cryptographically signed entity qualification report, opposable to the ILR during inspection or classification requests.
Tracks the evolution of sector thresholds (turnover, headcount, criticality) and re-qualifies entities quarterly.

Available as part of a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free 48h white audit to qualify your entities before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 27

They trust us

Before we chat