National Annex — Luxembourg
Status as of October 2026: In force. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.
| Review | Status |
|---|---|
| Confidence | Maintainer reviewed |
| Checked line by line against the legal text | No |
| Reviewed by a lawyer | No |
| Last reviewed | October 2026 |
| Reviewed by | Frederik B. Krogsgaard, maintainer |
| Second reviewer | Wanted, see CONTRIBUTING |
| Next review due | April 2027 |
NIS2 implementation
| Field | Value |
|---|---|
| Implementing law | Law of 5 May 2026 on measures for a high common level of cybersecurity, Mémorial A No. 225 of 2026, in force 10 May 2026, replacing the 2019 NIS law |
| Competent authority | ILR (Institut Luxembourgeois de Régulation) for most sectors; CSSF for the financial sector; HCPN for cyber-crisis management |
| National CSIRT / reporting | CIRCL and GOVCERT.LU |
| Official starting point | https://www.ilr.lu |
Country notes for your CDC
Entities in scope had two months from entry into force, until 10 July 2026, to register with their competent authority; check that yours did. Incident reporting follows the NIS2 pattern of 24 hours, 72 hours and one month. ILR has used its SERIMA platform for registration and incident notification; confirm the current channel with your authority, and with the CSSF if you are a financial entity. The MyGuide and CASES resources help smaller organisations prepare.
Standard checklist for all countries
- GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
- Entity registration completed with the national authority where required
- RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
- Contact established with the national CSIRT before the first incident
- Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
- National guidance and frameworks mapped to your control evidence, per the note above
Selector tag
Tick "Luxembourg" in tools/regulatory-profile.html to include this country's references under the lu-nat tag.
Open CDC Framework, licensed CC BY 4.0.