I need to bring my Luxembourg organisation into compliance with recital 5 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 5 NIS 2 — Recital 5 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 5

Directive on the security of network and information systems · UE 2022/2555

(5)

All those divergences entail a fragmentation of the internal market and can have a prejudicial effect on its functioning, affecting in particular the cross-border provision of services and the level of cyber resilience due to the application of a variety of measures. Ultimately, those divergences could lead to the higher vulnerability of some Member States to cyber threats, with potential spill-over effects across the Union. This Directive aims to remove such wide divergences among Member States, in particular by setting out minimum rules regarding the functioning of a coordinated regulatory framework, by laying down mechanisms for effective cooperation among the responsible authorities in each Member State, by updating the list of sectors and activities subject to cybersecurity obligations and by providing effective remedies and enforcement measures which are key to the effective enforcement of those obligations. Therefore, Directive (EU) 2016/1148 should be repealed and replaced by this Directive.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) transposes the harmonization intent of recital 5 by designating the ILR as single competent authority for essential and important entities, with a one-stop incident notification channel. Any LU subsidiary of a European group must notify the ILR and not the parent's authority, even if the group applies a harmonized baseline.

Luxgap practice: we establish your single point of contact with the ILR and synchronize your group notification procedures to trigger ILR, BSI, ANSSI and CCB in parallel during a cross-border incident, with no break in the 24h and 72h deadlines.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 5 explains why NIS 2 repeals NIS 1: too many national divergences had fragmented the internal market, exposing cross-border groups to inconsistent regimes. In practice, the ILR already sanctions entities that apply a 'country-by-country' minimum baseline instead of a harmonized group framework. The classic trap: a Luxembourg subsidiary of a European group assumes it benefits from the German or French parent regime, while the ILR requires implementation compliant with Luxembourg law on the LU perimeter, with notifications to the ILR and not to BSI or ANSSI.

What this recital concretely changes

Your cybersecurity policies must be designed at group level, then localized by jurisdiction (LU, DE, FR, BE), with a compliance matrix per Member State.
Cross-border incident notifications must be coordinated: ILR in Luxembourg, BSI in Germany, ANSSI in France, within the same 24h and 72h windows.
The CSIRT network and the NIS cooperation group assume you identify your single point of contact per Member State where you are established.
The harmonization of sectors (annexes I and II) closes former grey zones: a managed service provider (MSP) that was not covered by NIS 1 becomes an important entity under NIS 2.
Effective enforcement measures (article 32 onwards) require traceability of compliance decisions opposable to each national authority.

How Luxgap automates this risk

Our Luxgap Multi-Jurisdiction Harmonizer transforms your NIS 2 compliance into a living mapping per Member State, automatically detecting divergences between your group baseline and the local requirements of each authority (ILR in Luxembourg, BSI in Germany, ANSSI in France, CCB in Belgium). The tool ingests your security policies, ISO 27001 frameworks and notification procedures, then confronts them with national transpositions to produce an opposable compliance matrix.

Automatically detects gaps between your group baseline and each national NIS 2 transposition (LU law of 28 July 2023, German BSIG, French defense code).
Maps your entities by annexes I and II according to their state of establishment and identifies the single point of contact required by article 26.
Generates multi-CSIRT notification workflows ready to trigger: ILR for Luxembourg, BSI for Germany, ANSSI for France, with synchronized 24h and 72h deadlines.
Alerts in real time when a national authority publishes new guidance that widens a gap with your group baseline.
Produces a time-stamped PDF report per jurisdiction, opposable during an ILR inspection or a cooperation request between authorities under chapter IV of the directive.
Natively integrates your group sources: Microsoft Sentinel, Azure Policy, ServiceNow GRC, Archer, and ENISA Cyberframe references.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real mapping, with a free blank audit within 48h to measure your exposure to national divergences before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 5

They trust us

Before we chat