Luxembourg's NIS2 law has applied since 10 May 2026, its registration window has closed, and essential entities now face an annual reporting cycle built on ILR templates. The Act of 5 May 2026 on measures to ensure a high level of cybersecurity transposes Directive (EU) 2022/2555 and replaces the earlier NIS1 Act. The Institut Luxembourgeois de Régulation (ILR), through its NISS service, is the default competent authority, with the CSSF reported as competent for financial-sector entities. This guide covers scope and the size-cap, the self-registration duty, the deliverables essential entities submit, incident reporting through SERIMA, management duties, sanctions, and what the measures mean for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Luxembourg entities. The directive itself is covered in the NIS2 Directive Guide; this page covers the Luxembourg layer.
Status checked 14 November 2026: the Act of 5 May 2026 has been in force since 10 May 2026, according to the ILR. The self-registration deadline of 10 July 2026 has passed. ILR Regulation ILR/N26/10 of 26 October 2026 on notification of security measures by essential entities has been adopted. Article references below are as stated by the ILR or by the named secondary sources. Check the ILR NISS pages for later regulations before relying on dates.
Key takeaways
- Registration was due by 10 July 2026: in-scope entities had two months from entry into force to self-register on the ILR portal. An entity that has not registered is still bound by the law, the ILR states.
- Essential entities report every year: a description of measures in place, a risk scenario questionnaire, a multi-year action plan and, if designated, a list of supplier dependencies, using ILR models published on 3 August 2026.
- Incidents go through SERIMA: a preliminary notification within 24 hours, a notification within 72 hours and a final report within one month, on the SERIMA online form.
- Two supervisors, one law: the ILR is the default authority; law firm summaries report that the CSSF is competent by derogation for financial-sector entities, where DORA also applies.
- Machine identities sit inside the measures: access control, MFA, supply chain and incident handling all reach service accounts, tokens and AI agents, and the annual deliverables are where that evidence will be read.
The law and the authorities
The ILR describes the law as the Act of 5 May 2026 on measures to ensure a high level of cybersecurity (the NIS 2 Act). It repeals the NIS1 Act and Articles 42 and 43 of the Law of 17 December 2021 on electronic communications networks and services. Elvinger Hoss reports publication in Mémorial A No. 225 of 2026, which matches the Legilux identifier, and notes a companion Law of 5 May 2026 transposing the Critical Entities Resilience Directive (Mémorial A No. 226). See the EU Critical Entities Resilience Directive Guide.
| Body | Role | Source |
|---|---|---|
| ILR (NISS service) | Default competent authority; runs self-registration, security measure reporting and incident notification | ILR |
| CSSF | Competent by derogation for financial-sector entities | Elvinger Hoss and Simmons & Simmons (secondary) |
| HCPN | Coordinates cybersecurity policy and cyber crisis management | Elvinger Hoss (secondary) |
| CNPD | GDPR regulator; listed by the ILR alongside NIS2 among the legal bases on its incident page | ILR |
State ministries, administrations, services and their public establishments are covered too. A Ministère d'Etat circular of 2 April 2026 told them they fall within the public administration definition as essential entities regardless of size, with the ILR as their competent authority.
Scope: the size-cap and who is in
The ILR scope page applies the directive's Annex I and II sectors (energy, transport, health, drinking and waste water, digital infrastructure, B2B ICT service management, public administration, space, postal, waste, chemicals, food, manufacturing, digital providers and research, with banking and financial market infrastructure under the CSSF). Coverage is automatic: the ILR's head of NISS said at the 6 July 2026 press conference, as reported by Paperjam, that entities meeting the criteria are covered without ILR identification.
| Test | Rule | Source |
|---|---|---|
| Medium-sized | 50 to 249 employees, or EUR 10 million to 50 million turnover, or EUR 10 million to 43 million balance sheet total | ILR scope page |
| Large (essential in Annex I sectors) | At least 250 employees, or turnover above EUR 50 million, or balance sheet above EUR 43 million | ILR press release, 6 July 2026 |
| Group counting | Linked enterprises at 100%, partner enterprises pro rata; partners of partners excluded | ILR scope page |
| In scope regardless of size | For example public electronic communications providers, trust service providers, TLD registries and DNS service providers; also entities identified as critical or a sole supplier | ILR scope page |
| State entities | Essential regardless of size | Ministère d'Etat circular |
- Group data is often miscounted: the ILR said at the press conference, as reported by Paperjam, that group and partner counting is frequently done wrongly. Re-run the size test for each Luxembourg legal entity using the EU SME guide.
- Scale: the ILR estimated that 1,500 to 2,000 entities could be covered, as reported by Paperjam.
- Applicability simulator: the ILR press release points to an online simulator for checking coverage.
Registration
The ILR self-registration page sets the deadline at two months after entry into force, 10 July 2026; Elvinger Hoss places the duty in Article 11(4). Registrations made before the law took effect stay valid if the data remains accurate. The ILR's earlier FAQ, written against draft law 8364, said changes must be notified within two weeks; the current self-registration page says only that data must be kept continuously up to date.
- Missed the deadline: register now and record why it was late. The ILR states that failing to self-register does not exempt an entity from its obligations.
- Keep it current: assign an owner for the registration record and tie updates to corporate changes such as mergers, new services or headcount crossing a threshold.
- Elsewhere in the EU: groups must register separately in each Member State. Compare portals in the NIS2 Transposition Tracker.
Security measures and the annual deliverables
Deloitte places the risk-management measures in Article 12 and management duties in Article 13 of the Luxembourg law. The ILR security measures page cites Commission Implementing Regulation (EU) 2024/2690 and the NIS Cooperation Group reference document as the basis. See the NIS2 Implementing Regulation 2024/2690 Guide.
Essential entities are supervised ex ante and ex post and must submit deliverables annually. Important entities are supervised ex post only and do not submit routinely unless there is evidence of non-compliance.
| Deliverable (ILR model, 3 August 2026) | Who | What it contains |
|---|---|---|
| Description of measures in place | Essential entities | The cybersecurity measures implemented |
| Analysis of main cyber risk scenarios | Essential entities | A multiple-choice questionnaire; the ILR states it does not replace the entity's own Article 12 risk analysis, which the ILR may request |
| Multi-year action plan | Essential entities | Planned improvements |
| List of dependencies | Essential entities in categories the ILR designates by risk | Direct suppliers and service providers, submitted annually once notified |
- Legal basis for the cycle: Regulation ILR/N26/10 of 26 October 2026 covers notification of security measures by essential entities, following a consultation announced on 7 July 2026.
- First exercise: the first reporting exercise for essential entities is expected in March 2027, according to Paperjam's report of the ILR press conference. Confirm the date in ILR/N26/10.
- Risk tool: Deloitte reports that the law lets the competent authority require a risk evaluation framework or tool, such as SERIMA.
- Frameworks: the ILR FAQ said its measures would align with standards such as ISO/IEC 27001 and CyberFundamentals. An existing ISMS is the fastest source of evidence; see the ISO 27001 to NIS2 and DORA Mapping Guide.
Incident reporting through SERIMA
Under Article 14(3) of the Act, as the ILR incident page explains, an incident is significant if it causes or could cause severe operational disruption or financial loss for the entity, or affects others with considerable material or non-material damage. Notifications go to the ILR on the SERIMA online form. The ILR also published Operational Guidance for Incident Handling on 28 September 2026.
| Stage | Deadline | Main content added at this stage |
|---|---|---|
| Preliminary notification | Without undue delay, no later than 24 hours after becoming aware | Essential or important, description, significance criteria, sectors, cross-border impact, whether malicious, whether CSIRT support is needed |
| Incident notification | Within 72 hours of becoming aware | Observed and expected severity and impact; whether indicators of compromise are available |
| Interim information | On request | As requested |
| Final report | No later than one month after the incident notification | Root cause category, mitigation measures, any exploited vulnerability |
| Progress report | If the incident is still open at one month; extension of up to one month possible | Status of handling |
- The clock runs out of hours: the ILR FAQ says the 24 hours run from detection, including outside working hours. Make SERIMA access part of the on-call runbook.
- Personal data: a breach of personal data also goes to the CNPD under GDPR Article 33.
- Financial entities: DORA reporting generally takes precedence, according to Simmons & Simmons. See the DORA and NIS2 Overlap Mapping Guide and the Cyber Incident Reporting Requirements Map.
Management bodies
The ILR press release says management bodies must inform themselves, train, approve the risk-management measures and oversee them. Deloitte and Simmons & Simmons report that management bodies may be held directly liable for non-compliance. The ILR director put it at the press conference, as reported by Paperjam, as responsibility now reaching management bodies. See the NIS2 Management Liability Executive Briefing.
- Board minute: record approval of the measures and of the annual deliverables before submission.
- Training record: keep attendance and content for each board member.
- Oversight: give the board a quarterly view of the multi-year action plan against target dates.
Supervision and sanctions
The ILR press release states that sanctions range from a warning to fines of up to EUR 10 million or 2% of worldwide turnover. Law firm summaries give the full two-tier structure.
| Measure | Essential entities | Important entities | Source |
|---|---|---|---|
| Maximum fine | Higher of EUR 10 million or 2% of worldwide annual turnover | Higher of EUR 7 million or 1.4% of worldwide annual turnover | ILR press release (essential tier); Elvinger Hoss and Simmons & Simmons (both tiers) |
| Supervision | Ex ante and ex post | Ex post, after incidents or evidence of non-compliance | ILR |
| Powers | Inspections, information requests, security audits, remediation orders, binding instructions, temporary operational restrictions | Elvinger Hoss (secondary) | |
The ILR already enforces notification duties. Decisions ILR/N26/8 and ILR/N26/9 of 9 September 2026 sanctioned two companies for failing to provide information and failing to notify an incident under earlier ILR regulations. Read the law on Legilux before quoting fine maxima to a board.
Timeline
| Date | Milestone |
|---|---|
| 2 April 2026 | Ministère d'Etat circular to State entities |
| 5 May 2026 | NIS 2 Act adopted |
| 10 May 2026 | Act in force; NIS1 Act repealed |
| 6 July 2026 | ILR press conference on the law |
| 10 July 2026 | Self-registration deadline |
| 3 August 2026 | ILR NIS 2 deliverable models published |
| 28 September 2026 | Operational Guidance for Incident Handling published |
| 26 October 2026 | Regulation ILR/N26/10 on notification of security measures |
| March 2027 (as reported) | First reporting exercise for essential entities |
What it means for AI agents and non-human identities
The description of measures and the multi-year action plan will be read by a supervisor who can ask for evidence. The most privileged accounts in a typical estate are service accounts, CI/CD tokens and integration keys, and the dependency list covers suppliers that often hold API keys or OAuth grants into your systems. The Salesloft Drift incident shows why: OAuth tokens stolen from one chatbot integration were used against many Salesforce tenants (see the Salesloft Drift breach).
| Measure area | NHI and agent control | Evidence for the ILR deliverables |
|---|---|---|
| Access control and asset management | Owner, purpose and least privilege for every service account, key, certificate and agent | NHI inventory, review records including machine identities |
| Multi-factor and strong authentication | MFA for people; workload identity federation or short-lived tokens for machines | Configuration exports, static key exception register |
| Supply chain | Register supplier-held keys, OAuth grants and accounts | Dependency list cross-referenced to credentials |
| Incident handling | Runbook to revoke and rotate machine credentials within the 24-hour window | Exercise record with revocation times |
| Logging and monitoring | Central logs of machine authentication and agent actions | Log source list, retention, sample alerts |
See the NIS2 Supply Chain Security Guide.
Implementing it: a phased approach
- Confirm status: re-run the size-cap and sector test per legal entity, confirm the registration is on file and accurate, and confirm whether the ILR or CSSF supervises you.
- Gap assessment: map current controls to Implementing Regulation 2024/2690 (or the directive's ten Article 21(2) areas for entities it does not cover) and to the ILR deliverable models.
- Build the deliverables: draft the description of measures, answer the scenario questionnaire, and write the multi-year action plan with owners and dates. Keep your own risk analysis alongside.
- Test reporting: run a tabletop with a 24-hour preliminary notification on SERIMA (in a test or dry run), including out-of-hours escalation and the GDPR decision.
- Board approval: present the deliverables and training plan for approval and minute it.
- Submit and maintain: submit in the window set by ILR/N26/10, then review registration data and the action plan quarterly.
Measuring readiness
- Registration record verified within the last quarter: yes or no.
- Percentage of action plan items on schedule.
- Time from detection to preliminary notification in the last exercise (target under 24 hours, with margin).
- Board members with completed training records.
- Share of machine identities with a named owner in the inventory.
- Suppliers on the dependency list with a reviewed access register.
Framework mapping
| Luxembourg obligation | NIS2 Directive | ISO/IEC 27001:2022 | NIST CSF 2.0 |
|---|---|---|---|
| Risk-management measures (Art. 12 as reported) | Article 21 | Clauses 6 and 8; Annex A | GV.RM, PR |
| Management approval, oversight and training (Art. 13 as reported) | Article 20 | Clause 5 | GV.RR |
| Incident reporting (Art. 14) | Article 23 | A.5.24 to A.5.26 | RS.CO |
| Registration (Art. 11(4) as reported) | Article 3(4) | Clause 4 | GV.OC |
| Dependency list | Article 21(2)(d) | A.5.19 to A.5.22 | GV.SC |
Common failure patterns
- Assuming NIS1 status settles it: scope is now automatic under the size-cap; entities not designated under NIS1 may still be in.
- Miscounting group data: the ILR has flagged linked and partner enterprise counting as a frequent error.
- Treating the questionnaire as the risk analysis: the ILR says the scenario analysis does not replace the Article 12 risk analysis.
- SERIMA access held by one person: the 24-hour clock runs outside working hours.
- Leaving machine credentials out of the dependency list: suppliers listed without the keys and OAuth grants they hold give a false picture of exposure.
Practitioner checklist
- Confirm the competent authority (ILR or CSSF) for each Luxembourg entity.
- Verify the self-registration record and assign an owner for updates.
- Re-run the size-cap test with linked and partner enterprise data.
- Download the ILR models and read Regulation ILR/N26/10 for submission dates.
- Keep a full Article 12 risk analysis alongside the scenario questionnaire.
- Give at least two on-call staff SERIMA access and test it.
- Minute board approval and keep training records.
- Include machine identities and supplier-held credentials in the measures and dependency list.
Standards and references
- Legilux: Act of 5 May 2026 on measures to ensure a high level of cybersecurity
- ILR: NIS 2
- ILR: Security measures
- ILR: Incident notification
- ILR: Self-registration
- ILR: Scope and field of application
- EUR-Lex: Commission Implementing Regulation (EU) 2024/2690
- Elvinger Hoss: NIS2 now in force in Luxembourg
Related NHI Mgmt Group resources: NIS2 Transposition Tracker · Belgium NIS2 Implementation Guide · Netherlands NIS2 Implementation Guide · NIS2 Readiness Checklist. This guide summarises Luxembourg's NIS2 Act and ILR guidance as of November 2026 and is not legal advice.