NISDESK · LU
NIS2 Compliance in Luxembourg
Luxembourg's financial centre means many banking and financial-market entities have NIS2 obligations alongside DORA requirements; CIRCL coordinates incident response.
Are you in scope?
NIS2 covers medium and large organisations in 18 sectors. Fines reach €10M or 2% of global turnover. Check your scope, obligations and a readiness score for free.
National authority & CSIRT
In Luxembourg, NIS2 supervision is handled by Institut Luxembourgeois de Régulation (ILR) / CIRCL. The national CSIRT is CIRCL (Computer Incident Response Center Luxembourg). Significant incidents must be reported within 24 h (early warning), 72 h (notification) and one month (final report) per NIS2 Article 23.
NIS2 sectors in Luxembourg
Each sector has specific obligations. Explore them for Luxembourg:
Frequently asked questions
Which sectors are covered by NIS2 in Luxembourg?
NIS2 covers 18 sectors: Annex I (highly critical — energy, transport, banking, financial markets, health, water, digital infrastructure, ICT service management, public administration, space) and Annex II (other critical — postal services, waste management, chemicals, food, manufacturing, digital providers, research). Transposed via the Law of 17 February 2025; ILR acts as competent authority and CIRCL handles incident coordination.
Who supervises NIS2 compliance in Luxembourg?
In Luxembourg, the primary competent authority is Institut Luxembourgeois de Régulation (ILR) / CIRCL. The national CSIRT is CIRCL (Computer Incident Response Center Luxembourg), which handles significant incident notifications and cybersecurity coordination.
What are the NIS2 incident reporting deadlines in Luxembourg?
Organisations must submit an early warning to CIRCL (Computer Incident Response Center Luxembourg) within 24 hours of a significant incident, a formal notification within 72 hours, and a final report within one month — per NIS2 Article 23.
What are the NIS2 fines in Luxembourg?
Essential entities face fines up to €10 million or 2% of global annual turnover. Important entities face up to €7 million or 1.4% of global annual turnover. Exact enforcement varies by national transposition.
For decision-support purposes only. Exact scope depends on national transposition — use our free scope checker for a personalised assessment.