NIS2 for Luxembourg SMEs: who is in scope, what to do now
Laurent Tousch12 min readDEFREN
Learn more about AI implementation in Luxembourg, and if you also deploy AI tools, see how to run NIS2 and the EU AI Act as one compliance programme.
Since the ILR presented the new law in July, the question I hear from Luxembourg SME owners is no longer "what is NIS2?" but "does it apply to us, and if not, why is a customer sending me a 60-question security questionnaire?" Both questions have short answers, and the work that follows is mostly organisational: knowing what you have, who owns it, and being able to prove it.
A word on who is writing. 20 More is an AI automation studio, not a security firm. We do not run security operations or penetration tests. What we do build is the compliance plumbing around them: evidence collection, supplier questionnaires, policy and asset registers. This guide is the plain version I give clients before they talk to their IT provider or lawyer. It is practical information, not legal advice.
Does NIS2 apply to my company?
Three questions decide it. Answer them in order.
| Question | If yes | If no |
|---|---|---|
| 1. Is your main activity in a sector of Annex I (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public administration, space) or Annex II (postal and courier, waste management, chemicals, food production and distribution, manufacturing of medical devices, electronics, electrical equipment, machinery, vehicles and other transport equipment, digital providers, research)? (Directive, Annexes I and II) | Go to question 2 | Out of scope, unless question 3 applies |
| 2. Are you at least medium-sized: 50 or more staff, or annual turnover and balance sheet both above €10 million? (Recommendation 2003/361/EC, Annex Art. 2) | In scope | Out of scope, unless question 3 applies |
| 3. Are you in a size-independent category: provider of public electronic communications networks or services, trust service provider, TLD registry or DNS service provider, domain name registration service, public administration entity, sole provider of an essential service, or an entity designated as critical? (Directive, Art. 2(2) to 2(4)) | In scope whatever your size | Out of scope |
Three details that trip people up:
- Group size counts. The SME definition adds the staff and financial figures of partner and linked enterprises (Recommendation 2003/361/EC, Annex Art. 3 and 6). A 30-person Luxembourg subsidiary of a large group is usually not "small".
- Essential or important. Annex I entities above the medium-sized ceilings (250 or more staff, or turnover above €50 million and balance sheet above €43 million) are generally essential; other in-scope entities are generally important (Directive, Art. 3(1) and 3(2)). The duties are the same; supervision and maximum fines differ.
- IT service providers are in scope. Managed service providers and managed security service providers sit in Annex I under "ICT service management (business-to-business)". A 60-person Luxembourg IT services firm is very likely an in-scope entity itself.
The ILR runs an online NIS 2 simulator to check applicability (ILR simulator). It is indicative, not a legal ruling, but it is the fastest first check.
What if we are a bank, fund or other financial entity?
For financial entities covered by DORA, DORA is the sector-specific act that takes precedence over NIS2 for ICT risk management and incident reporting (Regulation (EU) 2022/2554, Art. 1(2); NIS2, Art. 4). In Luxembourg the CSSF is the NIS2 competent authority for the banking and financial market infrastructure sectors, and for digital infrastructure and ICT service management activities it supervises (ILR NIS2 FAQ). If CSSF cyber requirements are your question, our DORA and EU AI Act guide for Luxembourg finance is the better starting point.
What does the Luxembourg NIS2 law require?
The law of 5 May 2026 on measures for a high level of cybersecurity was published on 6 May 2026 and entered into force on 10 May 2026, replacing the 2019 NIS1 law; the ILR is the competent authority, including for supervision and enforcement (ILR, legal framework; ILR, entry into force). It was bill no. 8364 in the Chamber of Deputies (Chamber committee report).
1. Register with the ILR. Self-registration was due within two months of entry into force, so by 10 July 2026, and changes must be notified within two weeks. Not registering does not exempt you from the law (ILR self-registration). If you are in scope and missed it, register now.
2. Apply the ten risk-management measures of Article 21(2), proportionate to your size, exposure and the cost of the measure (Art. 21(1), Directive):
| Art. 21(2) | Measure |
|---|---|
| (a) | Risk analysis and information system security policies |
| (b) | Incident handling |
| (c) | Business continuity: backup management, disaster recovery, crisis management |
| (d) | Supply chain security, including your relationships with direct suppliers |
| (e) | Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure |
| (f) | Policies and procedures to assess whether the measures work |
| (g) | Basic cyber hygiene and cybersecurity training |
| (h) | Cryptography and, where appropriate, encryption |
| (i) | Human resources security, access control and asset management |
| (j) | Multi-factor or continuous authentication, secured voice, video and text communications, secured emergency communications |
3. Report significant incidents on a fixed clock (Art. 23(4), Directive):
- early warning within 24 hours of becoming aware;
- incident notification within 72 hours, with an initial assessment;
- final report within one month of the notification.
In Luxembourg, notifications go through the ILR's SERIMA incident portal (ILR, SERIMA).
4. Put management on the hook. The management body must approve the measures, oversee their implementation and can be held liable for breaches; its members must follow training (Art. 20, Directive). Outsourcing the technical work does not outsource this.
5. Expect supervision and fines. Essential entities face proactive supervision, important entities supervision after the fact, typically following an incident or a complaint (Art. 32 and 33). Maximum fines are at least €10 million or 2% of worldwide annual turnover for essential entities and €7 million or 1.4% for important entities, whichever is higher (Art. 34(4) and 34(5), Directive). The ILR describes sanctions ranging from a warning up to €10 million or 2% of worldwide turnover (ILR).
Not in scope? Your customers will still ask
This is the part most small Luxembourg companies feel first. Article 21(2)(d) makes supply chain security a duty of every in-scope entity, and Article 21(3) tells them to take into account the vulnerabilities of each direct supplier and the quality of its cybersecurity practices (Directive). Your in-scope customer cannot meet that without asking you.
In practice that arrives as:
- a security questionnaire at onboarding or renewal (MFA, backups, patching, incident process, subcontractors);
- contract clauses: notify the customer of incidents affecting them within a set time, keep certain controls in place, allow an audit or provide evidence;
- a request for a certificate or report (ISO/IEC 27001, an audit report) or, failing that, documents.
The good news: the 12-point checklist below is close to what these questionnaires ask. Build the evidence once and every new questionnaire becomes a copy-and-check exercise instead of a week of emails.
The 12-point NIS2 checklist for a 20 to 200 person company
Whether you are in scope or a supplier to someone who is, this is the list I use. "Good" means proportionate for a company without a dedicated security team.
| # | Measure (Art.) | What good looks like at 20 to 200 people | Evidence to keep |
|---|---|---|---|
| 1 | Ownership and management approval (Art. 20) | A named owner; management approves the measures once a year and attends a short training | Signed board or management minute; training attendance |
| 2 | Asset inventory (21(2)(i)) | One list of devices, cloud services, key systems and data, each with an owner | The register, dated, reviewed quarterly |
| 3 | Risk analysis and policy (21(2)(a)) | A short policy and a one-page risk register: top risks, owner, action | Policy with version and approval date; risk register |
| 4 | MFA and secure communications (21(2)(j)) | MFA on email, remote access, admin accounts and finance tools; no exceptions for directors | Screenshot or export of MFA enforcement |
| 5 | Access and joiners/leavers (21(2)(i)) | Accounts created and removed through a checklist; admin rights limited; quarterly access review | Leaver checklists; access review record |
| 6 | Patching and vulnerabilities (21(2)(e)) | Automatic updates on endpoints; critical patches on servers and firewalls within a set time | Patch report from your management tool |
| 7 | Backups and continuity (21(2)(c)) | Backups of critical data with one copy offline or immutable; a restore test at least twice a year | Restore test log with date and result |
| 8 | Incident plan and reporting (21(2)(b), Art. 23) | One page: who decides, who calls the IT provider, who reports to the ILR within 24 hours, CIRCL contact | The plan; a tabletop exercise note |
| 9 | Detection and monitoring (21(2)(b)) | Endpoint detection on all devices and alerts that reach a person, in-house or outsourced | Tool coverage report; alert handling log |
| 10 | Suppliers (21(2)(d), 21(3)) | A register of IT and critical suppliers with what they access and the security terms in each contract | Supplier register; contract clauses; their answers |
| 11 | Training and cyber hygiene (21(2)(g)) | Short yearly training plus phishing awareness; a call-back rule for any change of bank details | Attendance list; the payment verification rule |
| 12 | Encryption and effectiveness review (21(2)(h), (f)) | Encrypted laptops and phones; a yearly review of this checklist with actions | Encryption report; review minutes |
None of these requires a big budget. Most require someone to own them and a place to keep the proof.
Two free national starting points: Fit4Cybersecurity, an anonymous online self-assessment from NC3 (Luxembourg House of Cybersecurity), which can lead to a free expert diagnostic for companies located in Luxembourg (NC3), and CIRCL, the CERT for the private sector, communes and non-governmental entities in Luxembourg, which you can contact when an incident happens (CIRCL).
Can a small company afford a SOC?
NIS2 does not require a security operations centre. It requires incident handling and the ability to report a significant incident within 24 hours (Art. 21(2)(b) and 23(4)), proportionate to your size and risk (Art. 21(1), Directive). The real question is: if something happens at 2 a.m. on a Saturday, who notices, and who acts?
| Option | Fits when | Watch out for |
|---|---|---|
| IT provider, business hours with alerts by email or phone | Out of scope, or important entity with low exposure | Nobody watching nights and weekends; check what is automated |
| Managed detection and response (MDR) or managed SOC, 24/7 | In scope, no internal security staff, a mainly cloud and laptop estate | Scope of coverage (endpoints only, or email and cloud logs too); whether they contain a threat or only notify you |
| In-house SOC | Large entities with a security team | 24/7 coverage needs several trained people on rotation; rarely realistic below a few hundred staff |
For most in-scope Luxembourg SMEs, outsourced 24/7 monitoring is the realistic answer. Before you sign, ask the provider: which log sources they watch; what they are allowed to do on their own (isolate a laptop, disable an account); how fast they call you; whether they will help prepare the 24-hour early warning; where the data is processed; and how you exit the contract. Remember the provider is your supplier under Article 21(2)(d), and as a managed security service provider it may be an in-scope NIS2 entity itself. Accountability stays with your management body (Art. 20).
Where does AI fit?
Two places. On the attack side, NIS2 does not mention deepfakes by name, but voice-cloned "CEO calls" and AI-written phishing are exactly what measures (g) training and (j) secured communications are there to counter: a call-back rule for payment changes beats any detection tool. On the defence side, most modern email security and endpoint tools already use machine learning; we cover what that looks like in our guide to AI-based cybersecurity for Luxembourg businesses.
The third place is where 20 More works: the compliance admin. Keeping the asset and supplier registers current, pre-filling customer questionnaires from your evidence folder, chasing restore-test and access-review records every quarter. That is document and workflow automation, the same work our AI automation projects do for finance and HR teams.
Frequently asked questions
Does NIS2 apply to SMEs in Luxembourg?
It applies to medium-sized and larger companies (50 or more staff, or turnover and balance sheet both above €10 million) in the sectors of Annexes I and II of Directive (EU) 2022/2555, and to some categories regardless of size, such as telecom, trust service and DNS providers. Small companies outside those categories are not directly in scope, but they often have to meet similar requirements as suppliers to in-scope customers. The ILR's online simulator gives a first indication.
Who supervises NIS2 in Luxembourg?
The Institut Luxembourgeois de Régulation (ILR) is the competent authority under the law of 5 May 2026, in force since 10 May 2026. The CSSF is the competent authority for the banking and financial market infrastructure sectors, and many financial entities follow DORA instead of NIS2 for ICT risk and incident reporting. In-scope entities had to self-register with the ILR by 10 July 2026 (ILR).
What are the NIS2 reporting deadlines?
Under Article 23(4) of the Directive, an in-scope entity sends an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the notification. In Luxembourg, notifications go through the ILR's SERIMA portal. Prepare the 24-hour step in advance, because that is the one most small companies miss.
What are the NIS2 fines?
Article 34 of the Directive sets maximum administrative fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher. The ILR's measures range from a warning up to those maximums. Management bodies can also be held liable under Article 20.
Is there a NIS2 checklist for SMEs?
The Directive's own checklist is the ten measures of Article 21(2), applied in proportion to your size and risk. The 12-point table in this guide translates them into what a 20 to 200 person company can do and what evidence to keep. NC3's free Fit4Cybersecurity self-assessment is a good way to see where you stand before you start.
If you want help turning this checklist into registers and an evidence folder that maintain themselves, tell us how you handle it today.
Related Posts
NIS2 + EU AI Act: One Compliance Program, Not Two
NIS2 and the EU AI Act share five duty areas — risk, incidents, vendors, training, logging. One programme, not two, mapped to the revised 2027 AI Act dates.
AI Cybersecurity Luxembourg: NIS2-Ready for 2026
Cyber incidents up 43% in Luxembourg. Cut response time 60% with AI threat detection, deepfake fraud defence and NIS2 readiness. SME playbook for 2026.
DORA + EU AI Act: What CSSF Firms Owe, and When
DORA is live; AI Act high-risk rules moved to December 2027 but Article 50 already bites. How CSSF firms sequence both regimes without paying twice.