Cybersecurity law & regulation in Luxembourg (2026)

Legal framework

Law of 5 May 2026 on measures to ensure a high level of cybersecurity (transposing EU Directive 2022/2555, 'NIS2'); supervised by the Institut Luxembourgeois de Régulation (ILR), with the CSSF as competent authority for the financial sector and the Haut-Commissariat à la Protection nationale (HCPN) as strategic coordinator and single point of contact.

NIS2 & cybersecurity law in Luxembourg

In Luxembourg, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Luxembourg implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Luxembourg

1. 01Comprehensive NIS2 law in force

   The Law of 5 May 2026 'concerning measures to ensure a high level of cybersecurity' transposed Directive (EU) 2022/2555 (NIS2), was published in the Journal officiel on 6 May 2026 and entered into force on 10 May 2026, repealing the earlier NIS1 act. It originated as Bill 8364, after Luxembourg missed the 17 October 2024 EU deadline (Commission reasoned opinion of 7 May 2025).

   ilr.lu ilr.lu digital-strategy.ec.europa.eu

2. 02Competent authorities

   The ILR (Institut Luxembourgeois de Régulation) is the operational supervisory authority for the majority of NIS2 sectors (energy, transport, water, digital services, etc.), the CSSF supervises banking and financial market infrastructure, and the HCPN handles national strategy, crisis management and acts as single point of contact for cross-border cooperation.

   ilr.lu ilr.lu

3. 03Self-classification and registration

   Entities must self-assess whether they qualify as 'essential' or 'important' entities (authorities no longer designate them individually) and register via the ILR's self-registration portal, which opened in April 2026; ILR inspections are expected from January 2027.

   ilr.lu ilr.lu

4. 04Incident-reporting / breach-notification duties

   For significant incidents NIS2 imposes a phased duty: an early warning to the competent authority within 24 hours, a formal incident notification within 72 hours, and a final report within one month. The two designated national CSIRTs are GOVCERT.LU (state bodies, public establishments and critical entities) and CIRCL (all other entities).

   govcert.lu circl.lu ilr.lu

5. 05Financial sector overlay (DORA)

   Financial entities are governed by the directly applicable EU DORA Regulation (2022/2554), in application since 17 January 2025, with the CSSF and the Commissariat aux Assurances as competent authorities; major ICT-related incidents and significant cyber threats are reported to the CSSF via dedicated eDesk procedures.

   cssf.lu cssf.lu

6. 06Governance duties and sanctions

   Management bodies must approve and oversee cybersecurity risk-management measures and undergo mandatory training. Administrative fines reach up to EUR 10 million or 2% of worldwide annual turnover for essential entities and up to EUR 7 million or 1.4% for important entities.

   ilr.lu digital-strategy.ec.europa.eu

NIS2 in Luxembourg: FAQ

Timeline of decisions

1. 10 May 2026Law · official
   NIS2 transposition law enters into force

   The Law of 5 May 2026 on measures to ensure a high level of cybersecurity transposed EU Directive 2022/2555 (NIS2), expanding obligations (risk management, 24-hour incident reporting, management-body liability) from ~1,000 to an estimated 6,000-8,000 entities. ILR is the lead competent authority; fines reach €10M or 2% of worldwide turnover for essential entities.

   ILR (Institut Luxembourgeois de Régulation)

2. 5 May 2026Law · official
   NIS2 Transposition Act Enacted, Cybersecurity Obligations Extended to 6,000-8,000 Entities

   The Act of 5 May 2026 (published in Journal officiel 6 May 2026, in force 10 May 2026) transposed EU Directive 2022/2555 (NIS2), repealing the 2019 NIS1 law. It imposes mandatory risk management, 24-/72-hour incident notification, and tiered supervision across 18 critical sectors; ILR is lead authority for most sectors, CSSF for financial infrastructure.

   Legilux — Journal officiel du Grand-Duché de Luxembourg

3. 1 Apr 2026Guidance · official
   ILR opens single NIS2 self-registration portal

   Ahead of the law's entry into force, ILR launched the single self-registration portal for essential and important entities, with on-site inspections planned from January 2027. It operationalizes Luxembourg's NIS2 supervision framework.

   ILR

4. 9 Apr 2025Guidance · official
   CSSF aligns ICT/outsourcing circulars with DORA

   The CSSF published circulars (incl. 25/880, 25/882, 25/883) updating Luxembourg's national ICT-risk and outsourcing framework to dovetail with the directly applicable DORA regime, including registers of ICT third-party arrangements.

   CSSF

5. 17 Jan 2025Law · official
   DORA enters into application in the financial sector

   The EU Digital Operational Resilience Act (Regulation 2022/2554) became directly applicable, placing the CSSF at the centre of Luxembourg's framework for ICT risk management, incident reporting, resilience testing and third-party oversight for financial entities.

   CSSF

6. 20 Dec 2024Law · official
   Cybersecurity Act Implementation Law, ILNAS Designated National Certification Authority

   The Law of 20 December 2024 implemented EU Regulation 2019/881 (the EU Cybersecurity Act) in Luxembourg, designating ILNAS as the National Cybersecurity Certification Authority (NCCA). ILNAS now supervises the issuance of European ICT security certificates, covering ICT products, services, and processes placed on the Luxembourg market.

   ILNAS / Portail Qualité — Gouvernement luxembourgeois

7. 13 Mar 2024Law · official
   NIS2 Transposition Bill 8364 Tabled in Parliament

   The government introduced Bill 8364 to the Chamber of Deputies to transpose EU Directive 2022/2555 (NIS2). The bill signalled a major expansion: from roughly 1,000 entities covered under NIS1 to an estimated 6,000-8,000, including mid-sized manufacturers and all municipalities with more than 50,000 residents.

   Chambre des Députés du Grand-Duché de Luxembourg

8. 13 Mar 2024Law · official
   NIS2 draft law (Projet de loi 8364) deposited

   The government tabled the bill transposing NIS2 in the Chamber of Deputies, beginning the parliamentary process that would replace the 2019 NIS regime; Luxembourg ultimately missed the 17 October 2024 EU deadline.

   Chambre des Députés

9. 12 Feb 2021Guidance · official
   Luxembourg presents its first Cyber Defence Strategy

   Defence Minister François Bausch unveiled the country's inaugural national cyber defence strategy, formalizing the armed forces' role in cyberspace alongside the civilian cybersecurity framework.

   Government of Luxembourg

10. 1 Jan 2021Guidance · official
    National Cybersecurity Strategy IV adopted

    The HCPN published the fourth national cybersecurity strategy (2021-2025), building on prior strategies to strengthen resilience, trust in digital tools, and the national cybersecurity ecosystem.

    HCPN

11. 28 May 2019Law · official
    NIS Directive transposed (Law of 28 May 2019)

    Luxembourg's first dedicated cybersecurity law transposed EU Directive 2016/1148 (NIS1), imposing security and incident-notification duties on operators of essential services and digital service providers, and designating ILR (and CSSF for finance) as competent authorities.

    Légilux (Journal officiel)

12. 1 Jan 2018Guidance · official
    National Cybersecurity Strategy III published

    The third national strategy refreshed Luxembourg's cybersecurity priorities, deepening protection of critical infrastructure and the digital economy ahead of EU NIS implementation.

    HCPN

13. 1 Jan 2015Guidance · official
    ANSSI established under second national strategy

    Luxembourg's second cybersecurity strategy created the National Agency for the Security of Information Systems (ANSSI), housed within the HCPN, to set state information-security policy and support administrations and critical operators.

    NATO CCDCOE

14. 1 Jan 2012Guidance · official
    First National Cybersecurity Strategy and Government CERT

    Luxembourg's inaugural cybersecurity strategy established the Government CERT (GOVCERT.LU) and set the foundational axes, infrastructure protection, legal framework, international cooperation, awareness and security standards, that shape today's governance.

    Government of Luxembourg (Infocrise)

Sources

1. 1.ilr.lu/actualite/entree-en-vigueur-nis2/
2. 2.ilr.lu/cadre-legal/loi-nis2/
3. 3.ilr.lu/en/sectors/niss/nis-2/
4. 4.ilr.lu/en/sectors/niss/nis-2/frequently-asked-questions-about-nis2-faq/
5. 5.digital-strategy.ec.europa.eu/en/policies/nis2-directive-luxembourg
6. 6.govcert.lu/report/
7. 7.circl.lu/
8. 8.cssf.lu/en/2025/01/entry-in-application-of-dora-regulation-on-17-january-2025
9. 9.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/