The classic trap
Many Luxembourg organisations still reason with the NIS 1 mindset: 'I am a digital service provider, so I get the light regime' or 'I am not an operator of essential services, so nothing applies to me'. That reading is dead. The ILR now reasons by annex sector and by entity size, not by legacy label. The trap: discovering during an ILR inspection that your entity, which never self-registered, actually fell under Annex II from the entry into force of the law of 28 July 2023.
Why recital 6 changes your scope
The European legislator acknowledges that the OES/DSP split had become artificial. The operational consequence is threefold:
- The scope now covers entire sectors: waste management, food, manufacture of medical devices, postal services, research, public administration, managed service providers (MSP/MSSP).
- The essential vs important qualification depends mainly on size (thresholds of 250 employees / EUR 50M turnover for essential, 50 employees / EUR 10M for important) crossed with the Annex I or II sector.
- Self-qualification is mandatory: the ILR will not come knocking, it is up to you to register within the deadlines set by the law of 28 July 2023.
The practical test to run immediately: review each legal entity of the group, cross its NACE code with annexes I and II of NIS 2, then apply the size thresholds. A Luxembourg holding owning a chemical manufacturing activity in Belgium can itself fall into scope via the group rule.
How Luxgap automates this risk
Our Luxgap NIS2 Scope Radar permanently eliminates the grey zone of self-qualification by automatically cross-referencing your legal, HR and financial data with annexes I and II of the directive. The tool queries the Luxembourg Trade and Companies Register, your ERP (Odoo, SAP, Sage BOB 50) and your HRIS (Workday, Sopra HR) to reconstruct the real perimeter of the group and determine, entity by entity, whether it is essential, important or out of scope.
- Detects each entity of the group via an API connection to the RCS and to your accounting systems, with no manual re-entry.
- Classifies each entity according to annexes I and II based on declared NACE codes and actual activity flows observed in the ERP.
- Automatically computes size thresholds (headcount, turnover, balance sheet) by aggregating consolidated data, and applies the NIS 2 group rule.
- Alerts in real time via Teams or Slack when an acquisition, a headcount growth or a new activity code shifts an entity into scope.
- Generates the pre-filled ILR notification file, compliant with the requirements of the law of 28 July 2023, with timestamped supporting annexes.
- Produces a cryptographically sealed PDF report, admissible during an ILR inspection, which demonstrates the diligence of self-qualification.
Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS brick depending on your perimeter. Request a tailored quote and our teams will prepare a free 48h white audit on the real perimeter of your group to materialise your exposure before any commitment.
