NIS2: ILR sets security measures reporting deadline to March 2027

The recent ILR Regulation N26/10 of 26 October 2026 sets out security-measures reporting requirements for essential entities under Luxembourg’s NIS2 framework. Annual submissions cover a description of cybersecurity measures in place, an analysis of key cyber-risk scenarios and a multi-year action plan. Certain categories of entities may also be required by the ILR to submit a list of supplier and service-provider dependencies.

The next submission deadline, applicable across all NIS 2 sectors (essential entities), is 15 March 2027 pursuant to this new ILR Regulation N26/10. Companies previously subject to ILR Regulations N22/8 (for electronic communications networks or publicly available electronic communications services) or N22/7 (for operators of essential services under NIS1) had to notify their security measures in 2026 under these former regimes.