Skip to main content
In forceNIS2

NIS2 in Luxembourg

Luxembourg adopted its NIS2 law on 5 May 2026 and it entered into force on 10 May 2026. In-scope entities were required to self-register with their competent authority by 10 July 2026.

Transposition law
Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité
In force since
10 May 2026
Competent authority
National Agency for the Security of Information Systems (ANSSI-LU) / ILR
Max fine (Essential)
€10 million or 2% of global annual turnover
Max fine (Important)
€7 million or 1.4% of global annual turnover
Law adopted
5 May 2026

Key Deadlines

Loi du 5 mai 2026 adopted
5 May 2026
Law in force
10 May 2026
Self-registration deadline
10 July 2026

Competent Authority

National Agency for the Security of Information Systems (ANSSI-LU) / ILR
Lead coordinator; ILR regulates specific utility sectors
https://www.anssi.lu ↗

Luxembourg splits supervision: ANSSI-LU coordinates standards, while sector watchdogs like ILR and CSSF run specific compliance programs.

Registration Process

Self-registration with the competent authority was due by 10 July 2026. Entities that identify as in scope after that date should register without delay via their sector authority — ILR for telecom, energy and most utilities, CSSF for the financial sector.

📊 Quick Test

Find out if your company is in scope

Does your organisation fall under Annex I (Essential) or Annex II (Important) entities?

Check NIS2 Scope →

Key Requirements

  • 1Provide registration logs to the designated supervisor
  • 2Implement risk remediation measures according to national guides
  • 3Deploy advanced security logs collection systems

National Additions

★Luxembourg aligns NIS2 closely with existing financial sector regulations (CSSF Circulars)

FAQ: NIS2 in Luxembourg

Who supervises telecommunication companies in Luxembourg?
The Luxembourg Institute of Regulation (ILR) supervises telecom and energy providers under the NIS2 framework.
I missed the 10 July 2026 registration deadline — what now?
Register with your competent authority immediately. Luxembourg's law has been in force since 10 May 2026, so the duty of care, incident reporting and governance obligations already apply to you independently of whether you registered on time. Late registration does not retroactively excuse gaps in those obligations.

Ready to assess your NIS2 compliance?

Use our free tools to check your NIS2 scope and run a gap assessment.

🎯 Scope Checker📊 Gap Assessment

Currency and sources

The legal details on this page were last checked on 25 July 2026.