Does Luxembourg's NIS2 law apply to your organisation?

Luxembourg's law of 5 May 2026 has applied since 10 May 2026. The ILR is the competent authority. Use the form for an indication, then check self-registration with the ILR.

Indicative only, not legal advice.

Check your organisation

Your answers stay in this browser. Submitting the form does not send them to a server, and the page does not store them.

Activity

Annex I is sectors of high criticality. Annex II is other critical sectors. If more than one activity fits, run the check again. Confirm the stricter result with the competent authority.

Size

Use annual figures in euro. Headcount is the number of employees (annual work units if you have them). Medium means 50 or more employees, or turnover and balance sheet total both above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Linked and partner enterprises

Add 100 percent of a linked enterprise: a holding or control above 50 percent. Add only your share of a partner enterprise: a holding from 25 to 50 percent. A holding below 25 percent stays out of the total. This is the simple version of Recommendation 2003/361/EC. NIS2 says a public-sector shareholder does not by itself change the size test.

Country

Choose a Member State to see national notes. Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Slovenia and Sweden show national notes. Every other country says that national details are coming soon.

Possible national designation

Optional. Tick a box only if it might apply. The checker cannot see a Member State's list, so the result will tell you to check the designation.

Indicative result only. This is not a legal determination of your NIS2 status and not legal advice. Your status depends on national law and on any identification by your Member State. Confirm it with the competent authority or a qualified adviser.

Try the live demoBook a gap review

Install free from GitHub (self-hosted). Core is the free self-hosted edition.

Last checked: 1 November 2026.

Law of 5 May 2026

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité et portant modification de : 1° la loi modifiée du 14 août 2000 relative au commerce électronique ; 2° la loi modifiée du 23 juillet 2016 portant création d’un Haut-Commissariat à la Protection nationale ; 3° la loi du 17 décembre 2021 sur les réseaux et les services de communications électroniques. It was published in Mémorial A n° 225 on 6 May 2026 and has applied since 10 May 2026. The competent authority is the ILR. Registration with the ILR was due on 10 July 2026.

Who is covered

This checker uses the Directive's medium and large enterprise test (Recommendation 2003/361/EC). Size-independent entities follow Article 2(2). Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Registration with the ILR

The registration deadline was 10 July 2026, two months after entry into force. That date has passed. Self-registration is on the ILR page.

Incident reporting

Confirm the incident-reporting channel with the ILR. The Directive clocks are an early warning within 24 hours, an incident notification within 72 hours, and a final report no later than one month after the incident notification.

How GRCompliance helps

GRCompliance can hold the Article 21 measures, the risk register and the incident clocks on infrastructure you control. It does not file your ILR registration and it does not decide your legal status.

Next steps

Check another country. Read the NIS2 checklist for SMEs and the guide to NIS2 incident reporting deadlines. NIS2 compliance software and the self-hosted install are the product pages. Try the live demo or book a gap review.

Other country pages: Austria, Belgium, Finland, Germany, Ireland, Italy, Netherlands, Poland, Slovenia, Sweden.

FAQ

When did the Luxembourg NIS2 law enter into force?

The law of 5 May 2026 was published in Mémorial A n° 225 on 6 May 2026 and has applied since 10 May 2026.

What was the registration deadline?

10 July 2026, two months after entry into force. That date has passed. Self-registration is on the ILR page.

Who is the competent authority in Luxembourg?

The ILR. Confirm the incident-reporting channel with the ILR.

Which size test does the checker use for Luxembourg?

The Directive's medium and large enterprise test (Recommendation 2003/361/EC). Size-independent entities follow Article 2(2).

Is this checker legal advice?

Indicative only, not legal advice.

Directive text: Directive (EU) 2022/2555 on EUR-Lex. Size test: Commission Recommendation 2003/361/EC. Agency overview: ENISA.

Luxembourg sources: Mémorial A n° 225 of 6 May 2026, ILR, entry into force, ILR self-registration.