NIS2 stopped being a deadline and became an operating requirement.

This is the distinction organisations most often get wrong, and it is not a detail: it changes what kind of supervision you face.

Scope generally begins at the medium-enterprise threshold — broadly from 50 staff, or €10 million in turnover and balance sheet. That calculation is made at group level under the EU's linked-and-partner-enterprise rules, which pulls in a good number of Luxembourg subsidiaries whose local headcount looks far too small to matter.

Category then depends on the sector, not on being bigger. Large entities — broadly from 250 staff, or €50 million turnover with a €43 million balance sheet — are essential only in the highly critical sectors. A large entity in one of the other covered sectors is important, however large it is. And a set of entities is essential regardless of size at all, including qualified trust service providers, TLD name registries and DNS service providers, providers of public electronic communications networks and services, entities designated critical under the parallel CER framework, former NIS1 operators of essential services, and the sole provider of an essential service in a member state.

The practical difference: essential entities face proactive supervision — audits, inspections and scans on the authority's own initiative — while important entities are supervised after the fact, on cause.

These are statutory tests rather than rules of thumb, and both errors are expensive. Where the answer is genuinely marginal — a mixed-sector group, a service that might or might not be an electronic communications service — it is a legal question and belongs with counsel. The ILR publishes the scope criteria and the self-registration route.

A significant incident triggers three filings: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of that 72-hour notification — not one month from the incident. If the incident is still running at that point, a progress report takes its place and the final report follows a month after the incident is handled. The competent authority may also ask for an intermediate status update, and trust service providers and DNS or TLD entities have their own accelerated arrangements. Notifications go through the ILR's SERIMA platform.

Twenty-four hours sounds generous until you count what has to happen inside it: somebody has to notice, somebody has to judge significance, and somebody with authority has to decide to notify a regulator. That chain is what breaks, and it breaks on a Saturday. It is also why we treat the notification decision as a human approval point with a named person and a deputy, rather than a step in a runbook.

We work on the technical and operational side of the obligation: establishing the position, building registers your team can maintain, rehearsing continuity for real, implementing and evidencing controls in your own systems, and giving the incident chain a named owner and a tested route. That work sits mainly in ICT risk and resilience and cybersecurity.

This page is a practitioner summary, not legal advice. We do not advise on your legal position, we do not determine your category for you as a matter of law, and we do not represent you before the ILR, the CSSF or any other authority. Where a question is genuinely legal — and scope questions frequently are — it belongs with a Luxembourg law firm, and we will say so rather than improvise.