The classic trap
Recital 8 creates a treacherous grey zone: many Luxembourg public administrations assume they fall outside NIS 2 because they touch, directly or indirectly, on public security or sovereign functions. The ILR takes a strict view: only entities predominantly active in national security, defence or law enforcement are excluded. A municipality, a cross-cutting ministry, a sectoral regulator or any administration with regulatory competences stays fully in scope, and the essential or important entity qualification follows the core activity, not the institutional label.
The 'predominantly vs marginally' test: 4 questions to document
- What is the actual share of activities tied to national security, defence, law enforcement (prevention, investigation, detection, prosecution of criminal offences) in the entity's statutory mandate? Below 50%, recital 8 does not apply.
- Does the entity hold regulatory competences (control, sanction, authorisation)? If so, it is explicitly kept in scope, even when it operates alongside law enforcement.
- Is the entity jointly established with a third country through an international agreement (binational consortium, intergovernmental body)? If so, it is excluded, and the legal basis of that exclusion must be preserved.
- For systems located in a Luxembourg diplomatic mission outside the EU: are they physically on the mission premises AND operated for users in the third country? Both conditions must be documented, otherwise the system falls back into NIS 2 scope.
The practical stake: produce a qualification memo opposable to the ILR that proves, with evidence, why a given entity or system sits outside scope. An unmotivated self-exclusion is the first reflex sanctioned during an inspection.
How Luxgap automates this risk
Our Luxgap Scope Qualifier eliminates the NIS 2 qualification blind spot by turning the subjective recital 8 analysis into a documented, timestamped decision opposable to the ILR. The tool ingests your organisational decree, statutes, mission texts and application landscape (Active Directory, Azure AD, CMDB inventory, eBRC or LuxConnect contracts) then runs a dedicated LLM agent that weighs each activity against the 'predominantly / marginally' grid of recital 8.
- Computes a NIS 2 attachment score per entity and per system, with breakdown by activity (national security, defence, law enforcement, regulatory competences, other missions).
- Detects automatically systems located in diplomatic missions or operated for users outside the EU, and verifies both exclusion conditions set by recital 8.
- Identifies international agreements grounding a joint establishment with a third country and archives the legal basis of the exclusion in a timestamped vault.
- Generates a cryptographically sealed PDF qualification memo, opposable to the ILR during inspection, detailing every arbitration and citing the applicable recital 8 clause.
- Alerts in real time on Teams or email whenever a statutory or organisational change shifts the qualification perimeter.
Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual org chart, with a free 48-hour scoping audit to materialise your NIS 2 exposure before any engagement.