LuxembourgLoi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important Entities
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an entité essentielle (essential entity) or entité importante (important entity) under Article 11, which reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and you are named in Annexe II point 6 as an online-marketplace provider, an online-search-engine provider or a social-networking-services-platform provider, or where you are a public-administration entity under Annexe I point 10; the wider sector classes Annexe I and Annexe II also reach (energy, transport, health, digital infrastructure, ICT-service management, banking and financial-market infrastructure among them) are reached too, by declaring that you are an essential or important entity.
- Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or to provide your services, and act to eliminate or reduce the impact of an incident on the recipients of your services and on other services.NIST CSF 2.0ID.RA-06
- Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and crisis management; supply-chain security, including the security of your relationships with direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; evaluating the effectiveness of your own risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; personnel security, access-control policy and asset management; and multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency communication systems as needed.NIST CSF 2.0GV.PO-01
- Notify the measures you take under this duty to the competent authority in the form, format and timeframe it sets by règlement or circulaire.NIST CSF 2.0GV.OC-03
- Have your management body approve these risk-management measures, oversee their implementation, and complete regular training on assessing risk and risk-management practice; expect the body to be held liable for the entity's violation of this duty.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- Where you find you are not complying with these measures, take, without undue delay, all necessary, appropriate and proportionate corrective measures.NIST CSF 2.0ID.RA-06
These lines are LexLint's reading of the law's text. Also read by: Institut luxembourgeois de régulation (ILR) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 26's penalty regime for an Article 12 violation is an administrative fine (amende administrative), enforced through an administrative appeal (recours en réformation) to the tribunal administratif; the Act creates no criminal offence for the violation.
Penalty structure
Article 26(4) sets the maximum administrative fine for an essential entity's violation of Article 12 (or Article 14, paragraphs 1 to 4) at EUR 10,000,000 or 2 percent of the total worldwide annual turnover of the preceding financial year of the undertaking the essential entity belongs to, whichever is higher. Article 26(5) sets the important-entity tier at the same violations at EUR 7,000,000 or 1.4 percent of turnover, whichever is higher. Article 26(7) separately lets the competent authority attach a daily astreinte (penalty payment) to compel an end to a violation, capped at EUR 1,250 per day of the breach and EUR 25,000 in total.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Institut luxembourgeois de régulation (ILR), the general competent authority for cybersecurity under this law; the Commission de surveillance du secteur financier (CSSF) is the competent authority instead for the banking sector and the financial-market-infrastructure sector, and for the digital-infrastructure and ICT-service-management sectors as far as CSSF's own supervision reaches.
Settledness
- As of
- Guidance link
- https://www.ilr.lu/cadre-legal/loi-nis2/
- Guidance body
- Institut luxembourgeois de régulation (ILR)
- Open questions
- Does the Institut luxembourgeois de régulation's règlement or circulaire under Article 12(1) (the risk-analysis framework) or Article 12(3) (the notification of measures taken) narrow or specify how the duty applies to an online-marketplace, online-search-engine or social-networking-services-platform provider specifically?
What this law does
Article 12 requires an entité essentielle (essential entity) or entité importante (important entity) to take technical, operational and organisational measures appropriate and proportionate to the risks threatening the security of the network and information systems it uses for its activities or services, and to eliminate or reduce the impact of incidents on the recipients of its services and on other services.
The measures must follow an all-hazards approach and cover at least ten categories: risk-analysis and information-system-security policy, incident handling, business continuity including backup and crisis management, supply-chain security, security in the acquisition, development and maintenance of systems including vulnerability handling and disclosure, evaluating the measures' own effectiveness, basic cyber-hygiene and training, cryptography and encryption policy, human-resources security, access control and asset management, and multi-factor or continuous authentication and secure communications, transposing NIS2 Article 21.
Annexe II point 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-services-platform provider among the digital providers this duty reaches expressly. Annexe I point 10 separately reaches public-administration entities, as defined by Article 2. Article 13 requires the entity's management body to approve these measures and oversee their implementation, and states that the body may be held liable for the entity's violation of Article 12.
Article 1(8) disapplies the relevant provisions of this Law, including supervision and enforcement under Chapter 6, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify significant incidents with at least equivalent effect.
Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .