This section is intended to provide an overview of the rules and new provisions introduced by the transposition into Luxembourg law of DIRECTIVE (EU) 2022/2555 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (hereinafter the ‘NIS2 Directive’).
The NIS2 Directive was transposed into Luxembourg law by means of the Act of 5 May 2026 on measures to ensure a high level of cybersecurity (hereinafter the ‘NIS 2 Act’). This transposition law came into force on 10 May 2026 and repealed, in particular, the the NIS1 Act, as well as Articles 42 and 43 of the Law of 17 December 2021 on electronic communications networks and services. The main changes introduced are explained below.
Important: The European Commission has published Implementing Regulation EU 2024/2690 of 17 October 2024.
Disclaimer: The ‘questions and answers’ section below is intended to improve the understanding of the provisions of the NIS 2 Act by those concerned. However, it does not constitute a final interpretation of the various terms of the NIS 2 Act and the general explanations provided by the Institute may vary over time.
