LuxembourgLoi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an entité essentielle or entité importante under Article 11, which reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and you are named in Annexe II point 6 as an online-marketplace provider, an online-search-engine provider or a social-networking-services-platform provider, or where you are a public-administration entity under Annexe I point 10; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
- Notify the competent authority, without undue delay, of any incident with a significant impact on the provision of your services: treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to you, or considerable material, physical or moral damage to another person.NIST CSF 2.0RS.CO-02
- Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious acts or could have cross-border effect.NIST CSF 2.0RS.CO-02
- Follow with a fuller incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.NIST CSF 2.0RS.CO-02
- Submit an intermediate report if a computer security incident response team (CSIRT) or the competent authority requests one, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report within one month of the handling of the incident (Article 14, paragraph 4).NIST CSF 2.0RS.CO-03
- Where appropriate, notify the recipients of your services, without undue delay, of a significant incident likely to affect the services they receive from you, and of any measures or corrections they can apply in response to a significant cyber threat.NIST CSF 2.0RS.CO-02
- If you are a trust-service provider, notify a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour incident notification; the early warning, the intermediate report and the final report still apply.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Institut luxembourgeois de régulation (ILR) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 26's penalty regime for an Article 14 violation is an administrative fine (amende administrative), enforced through an administrative appeal (recours en réformation) to the tribunal administratif; the Act creates no criminal offence for a failure to report.
Penalty structure
The same Article 26(4) and 26(5) tiers that govern an Article 12 violation govern a violation of Article 14, paragraphs 1 to 4: EUR 10,000,000 or 2 percent of worldwide turnover for an essential entity, and EUR 7,000,000 or 1.4 percent of turnover for an important entity, whichever amount is higher in each case. Article 26(7) separately lets the competent authority attach a daily astreinte (penalty payment) to compel an end to a violation, capped at EUR 1,250 per day of the breach and EUR 25,000 in total.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Institut luxembourgeois de régulation (ILR), the general competent authority for cybersecurity under this law; the Commission de surveillance du secteur financier (CSSF) is the competent authority instead for the banking sector and the financial-market-infrastructure sector, and for the digital-infrastructure and ICT-service-management sectors as far as CSSF's own supervision reaches.
Settledness
- As of
- Guidance link
- https://www.ilr.lu/cadre-legal/loi-nis2/
- Guidance body
- Institut luxembourgeois de régulation (ILR)
What this law does
Article 14 requires an entité essentielle or entité importante to notify the competent authority, without undue delay, of any incident with a significant impact on the provision of its services (an incident important), and, where appropriate, to notify the recipients of its services of a significant incident likely to affect the supply of those services.
An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss to the entity, or has affected or is capable of affecting other natural or legal persons through considerable material, physical or moral damage.
The notification runs on a graduated clock: an early warning within 24 hours of becoming aware of the incident, a fuller notification within 72 hours giving an initial assessment of its severity and impact and any indicators of compromise, an intermediate report on request, and a final report within one month of the 72-hour notification (or a progress report followed by a final report if the incident is still ongoing at that point), transposing NIS2 Article 23.
A trust-service provider, by derogation from the 72-hour notification, notifies a significant incident affecting its trust services within 24 hours of becoming aware of it. The mere act of notifying an incident does not itself increase the notifying entity's liability, and the competent authority forwards the notification to the relevant computer security incident response team (CSIRT) and the single point of contact upon receiving it.
Article 1(8) disapplies the relevant provisions of this Law, including supervision and enforcement under Chapter 6, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify significant incidents with at least equivalent effect.
Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .