I need to bring my Luxembourg organisation into compliance with recital 29 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapAviation sector entities (airlines, airports, ground service providers, maintenance organisations) often fall into the trap of believing that their compliance with Regulations (EC) 300/2008 and (EU) 2018/1139, under EASA and national civil aviation authority supervision, automatically exempts them from NIS 2. Recital 29 opens a bridge but does not create automatic equivalence: in Luxembourg, the ILR retains its discretionary assessment power. In practice, without a precise mapping of requirements covered by each regime, the entity ends up being audited twice on the same measures, or worse, with coverage gaps on NIS 2-specific requirements (24h incident notification, management body accountability, supply chain).The equivalence matrix: where regimes overlap, where they divergeCompetent authorities may treat aviation compliance as satisfying NIS 2, but only if the mapping is documented clause by clause. Areas of strong overlap:Technical protection measures for critical information systems (encryption, segmentation, access control).Business continuity and disaster recovery plans, already required by EASA Part-IS.Vulnerability and patch management on ground systems.Areas where NIS 2 goes further and requires an additional layer:Personal accountability of management bodies (Article 20 NIS 2), absent from the aviation regime.Significant incident early warning to the ILR within 24h, distinct from EASA Part-IS reporting.Supply chain security for non-aviation IT (M365, HR ERP, CRM).Mandatory registration in the ILR register of essential entities.How Luxgap automates this riskOur Luxgap Regulatory Crosswalk Engine eliminates the double audit burden by automatically building your equivalence matrix between EASA Part-IS, Regulation 2018/1139, Regulation 300/2008 and NIS 2. A specialised LLM agent reads your existing aviation compliance documents (Security Programme, Part-IS ISMS, EASA audits), cross-references them with the 10 categories of measures under Article 21 NIS 2 and precisely identifies covered zones, zones to reinforce and zones to create from scratch.Ingests your aviation security manuals, Part-IS audits and EASA certificates and generates a clause-by-clause correspondence matrix with Article 21 NIS 2.Automatically detects NIS 2 requirements not covered by the aviation regime (Article 20 governance, 24h notification, non-aviation supply chain).Pre-fills the ILR registration dossier with reusable EASA evidence, avoiding 80% documentation duplication.Generates a pre-drafted bilateral ILR-DAC cooperation protocol, aligned with the spirit of recital 29, to limit redundant audits.Real-time alert on any EASA or ILR regulatory change that would modify the equivalence matrix.Produces a timestamped opposable PDF report demonstrating documented cross-regime compliance to both authorities.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams wil...

Recital 29 NIS 2 — Recital 29 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 29

Directive on the security of network and information systems · UE 2022/2555

(29)

In order to avoid gaps between or duplications of cybersecurity obligations imposed on entities in the aviation sector, national authorities under Regulations (EC) No 300/2008 (11) and (EU) 2018/1139 (12) of the European Parliament and of the Council and the competent authorities under this Directive should cooperate in relation to the implementation of cybersecurity risk-management measures and the supervision of compliance with those measures at national level. The compliance of an entity with the security requirements laid down in Regulations (EC) No 300/2008 and (EU) 2018/1139 and in the relevant delegated and implementing acts adopted pursuant to those Regulations could be considered by the competent authorities under this Directive to constitute compliance with the corresponding requirements laid down in this Directive.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the cooperation referred to in recital 29 concretely involves the ILR (NIS 2 competent authority) and the Civil Aviation Directorate (DAC) of the Ministry of Mobility and Public Works (aviation authority). The law of 28 July 2023 on cybersecurity, as amended by the law of 28 July 2025, transposes NIS 2 without creating any automatic exemption for the aviation sector: ILR's qualification of an entity as essential or important remains discretionary, even for actors already certified under EASA Part-IS. LuxAirport, Cargolux and operators based at Findel must therefore register with the ILR, regardless of their aviation status.

Luxgap practice: we establish a documented cooperation protocol between your aviation compliance team and your NIS 2 referent, and formalise with the ILR the Part-IS / Article 21 NIS 2 equivalence matrix to limit parallel audits.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Aviation sector entities (airlines, airports, ground service providers, maintenance organisations) often fall into the trap of believing that their compliance with Regulations (EC) 300/2008 and (EU) 2018/1139, under EASA and national civil aviation authority supervision, automatically exempts them from NIS 2. Recital 29 opens a bridge but does not create automatic equivalence: in Luxembourg, the ILR retains its discretionary assessment power. In practice, without a precise mapping of requirements covered by each regime, the entity ends up being audited twice on the same measures, or worse, with coverage gaps on NIS 2-specific requirements (24h incident notification, management body accountability, supply chain).

The equivalence matrix: where regimes overlap, where they diverge

Competent authorities may treat aviation compliance as satisfying NIS 2, but only if the mapping is documented clause by clause. Areas of strong overlap:

Technical protection measures for critical information systems (encryption, segmentation, access control).
Business continuity and disaster recovery plans, already required by EASA Part-IS.
Vulnerability and patch management on ground systems.

Areas where NIS 2 goes further and requires an additional layer:

Personal accountability of management bodies (Article 20 NIS 2), absent from the aviation regime.
Significant incident early warning to the ILR within 24h, distinct from EASA Part-IS reporting.
Supply chain security for non-aviation IT (M365, HR ERP, CRM).
Mandatory registration in the ILR register of essential entities.

How Luxgap automates this risk

Our Luxgap Regulatory Crosswalk Engine eliminates the double audit burden by automatically building your equivalence matrix between EASA Part-IS, Regulation 2018/1139, Regulation 300/2008 and NIS 2. A specialised LLM agent reads your existing aviation compliance documents (Security Programme, Part-IS ISMS, EASA audits), cross-references them with the 10 categories of measures under Article 21 NIS 2 and precisely identifies covered zones, zones to reinforce and zones to create from scratch.

Ingests your aviation security manuals, Part-IS audits and EASA certificates and generates a clause-by-clause correspondence matrix with Article 21 NIS 2.
Automatically detects NIS 2 requirements not covered by the aviation regime (Article 20 governance, 24h notification, non-aviation supply chain).
Pre-fills the ILR registration dossier with reusable EASA evidence, avoiding 80% documentation duplication.
Generates a pre-drafted bilateral ILR-DAC cooperation protocol, aligned with the spirit of recital 29, to limit redundant audits.
Real-time alert on any EASA or ILR regulatory change that would modify the equivalence matrix.
Produces a timestamped opposable PDF report demonstrating documented cross-regime compliance to both authorities.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your actual Part-IS documents, with a free 48h white audit to materialise overlap zones and coverage gaps before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 29

They trust us

Before we chat