I need to bring my Luxembourg organisation into compliance with recital 36 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 36 NIS 2 — Recital 36 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 36

Directive on the security of network and information systems · UE 2022/2555

(36)

Research activities play a key role in the development of new products and processes. Many of those activities are carried out by entities that share, disseminate or exploit the results of their research for commercial purposes. Those entities can therefore be important players in value chains, which makes the security of their network and information systems an integral part of the overall cybersecurity of the internal market. Research organisations should be understood to include entities which focus the essential part of their activities on the conduct of applied research or experimental development, within the meaning of the Organisation for Economic Cooperation and Development’s Frascati Manual 2015: Guidelines for Collecting and Reporting Data on Research and Experimental Development, with a view to exploiting their results for commercial purposes, such as the manufacturing or development of a product or process, the provision of a service, or the marketing thereof.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the ILR is the competent authority designated by the Law of 28 July 2023 on cybersecurity (as amended by the Law of 28 July 2025) to qualify research organisations as essential or important entities. Given the dense Luxembourg ecosystem (LIST, LIH, LISER, Luxinnovation, House of BioHealth, Technoport), the boundary between academic research and commercial exploitation is particularly blurred: an FNR-funded project can shift into NIS 2 scope as soon as a spin-off files an exploitable patent.

Luxgap practice: we advise Luxembourg research centres to produce a documented Frascati qualification per project and proactively notify the ILR rather than wait for an ex officio designation, which triggers a constrained 21-month compliance timeline without a negotiated preparation phase.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 36 extends the NIS 2 scope to research organisations that commercially exploit their work. Many incubators, university spin-offs, private R&D centres and industrial laboratories assume they are out of scope because they are not 'critical infrastructure operators'. Yet the ILR can designate them as important entities if their applied research feeds a European value chain. The trap: believing you are excluded until an industrial partner requires a NIS 2 attestation to continue the collaboration.

Who is covered and on what basis

Applied research or experimental development as defined in the OECD Frascati Manual 2015, where the goal is commercial exploitation of the result (product, process, service).
Excluded in principle: higher education institutions whose essential activity is fundamental research or teaching, unless a national decision states otherwise.
Typically covered: List Luxembourg Institute of Science and Technology, private centres like LIH, biomedical research foundations, deeptech spin-offs, industrial laboratories of pharma or space groups based in the Grand Duchy.
The criterion is not size alone: a 60-person lab developing an algorithm sold to a carmaker enters the value chain.
Ongoing research data (preliminary results, unfiled patents, clinical trial patient data) becomes a critical asset under Article 21.

The self-qualification mistake

The ILR expects a documented analysis of your NIS 2 status. Answering 'we are a research organisation, therefore excluded' without showing that your activity does not meet the Frascati commercial-exploitation criterion is the classic error. Conversely, declaring yourself an important entity without checking the thresholds of Annexes I and II leads to over-compliance and unnecessary cost. Mapping the value chain (who your industrial partners are, who commercially exploits your results) is the key document.

How Luxgap automates this risk

Our Luxgap Research Scope Classifier resolves in under 48 hours the question 'am I in NIS 2 scope?' for Luxembourg research organisations and their spin-offs. The tool cross-references your industrial collaboration contracts (Odoo, DocuSign, SharePoint), your patent filings, your funding flows (Horizon Europe, FNR, private contracts) and your partner mapping to produce a defensible Frascati qualification, rather than an intuitive self-declaration.

Automatically analyses your research contracts to detect commercial exploitation clauses that trigger the Recital 36 scope.
Classifies each project against the Frascati 2015 grid (fundamental, applied, experimental development) via a dedicated OECD-tuned LLM agent.
Maps the downstream value chain: which industrial partners receive your deliverables, in which Annex I and II sectors they operate.
Generates the NIS 2 qualification dossier intended for the ILR, with time-stamped and electronically signed documentary evidence.
Triggers an alert as soon as a new collaboration contract or spin-off changes your status, avoiding 6-month blind spots.
Produces a criticality matrix per research project to prioritise Article 21 measures on the truly strategic assets.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS brick depending on your scope. Request your demonstration and our teams will prepare a Frascati qualification on your real project portfolio, with a free blank audit within 48 hours to materialise your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 36

They trust us

Before we chat