NIS2 · National implementation
NIS2 in Luxembourg
Luxembourg transposed NIS2 through the loi du 5 mai 2026 relative à la cybersécurité, replacing bill 8364's long parliamentary run.
- National law
- Loi du 5 mai 2026 relative à la cybersécurité
- Cybersecurity Act
- Status
- In force
- In force
- 2026
- Authority
- ILR (CSSF for financial entities)
Supervision
The ILR (Institut Luxembourgeois de Régulation) is the competent authority for most sectors, with CIRCL and the ILR's structures as CSIRTs; registration runs through the ILR's SERIMA platform. Financial entities sit with the CSSF under DORA's lex specialis — a large share of Luxembourg's economy.
What is specific to Luxembourg
The financial-centre reality dominates: many Luxembourg entities are DORA-first, and the NIS2 law matters mainly for the non-financial remainder (digital infrastructure, ICT B2B, transport, health). Cross-checking which regime governs which entity of a group is the characteristic Luxembourg exercise.
Official sources
Primary references: the national statute book at legilux.public.lu and the national cybersecurity authority at www.ilr.lu.
NIS2 in Luxembourg: frequently asked questions
Last reviewed:
Related reading
Definitions