NIS2 registration with the ILR: who must register, what to submit and what happens next

Entities in scope of Luxembourg’s NIS2 law must register themselves with the competent authority, which for most sectors is the ILR, using its online self-registration form. The legal deadline was 10 July 2026, two months after the law entered into force. If you are in scope and have not registered, do it now. The ILR then confirms whether you are an essential or an important entity, and you keep the data up to date.

This guide covers who must register, the deadline, what the form asks for, the steps, what happens afterwards, the separate rules for digital providers, and a checklist.

	NIS2 registration in Luxembourg
Legal basis	Article 11(4) of the Law of 5 May 2026; Article 17 for digital providers
Deadline	10 July 2026 (two months after entry into force on 10 May 2026)
Where	The ILR self-registration form on guichet.ilr.lu, in French or English
What	Name; address and contacts, including emails, IP ranges and phone numbers; sector and subsector; EU countries served; size
Afterwards	The ILR reviews the form and confirms essential or important status
Changes	Within two weeks (within three months for the Article 17 dataset)
If you do not register	Warning, reprimand or a fine of up to EUR 250,000 (Article 25)
Questions	[email protected], (+352) 28 228 228

Who has to register with the ILR?

Every entity on the list the competent authorities must keep under Article 11(3): essential entities, important entities, and entities providing domain name registration services. In practice that means medium-sized and large companies in the sectors of Annexes I and II, plus the categories covered regardless of size. The full scope test is in NIS2 in Luxembourg, and the NIS2 scope checker gives a first answer in three clicks.

Two groups often ask whether they need to act:

• Former NIS1 operators of essential services become essential entities automatically. The ILR still recommends self-registration, so it can collect the additional information NIS2 requires.
• Electronic communications operators under the Law of 17 December 2021, already subject to security measures, are registered as essential entities by the ILR unless they self-register.

If your competent authority is the CSSF (banking, financial market infrastructures, and CSSF-supervised digital infrastructure and ICT service management activities), you register with the CSSF, not the ILR. This guide covers the ILR route.

What was the deadline, and what if you missed it?

Article 11(4) gave entities two months from the law’s entry into force. The law applied from 10 May 2026, so the deadline was 10 July 2026. The ILR states that registrations made before the law took effect remain valid as long as the data is current.

A missed deadline does not remove the obligation. Register now. Article 25 lets the competent authority respond to a breach of Article 11(4) with a warning, a reprimand or an administrative fine of up to EUR 250,000, weighed against the circumstances. Registering late is better than being found unregistered.

What information does the registration ask for?

Article 11(4) sets the minimum:

1. the entity’s name;
2. its address and up-to-date contact details, including email addresses, IP ranges and telephone numbers;
3. where relevant, its sector and subsector from Annex I or II;
4. where relevant, the EU Member States in which it provides services in scope;
5. its size and, where relevant, the size of the group it belongs to.

Gather these before you open the form:

• Contacts that will still work in a year. Use role-based addresses and numbers for security contacts rather than one person’s mailbox.
• Your public IP ranges. Ask your hosting, cloud and connectivity providers if you do not hold the list yourself.
• Your Annex sector and subsector. Use the wording of the annex, not your marketing description.
• Headcount and financials, for the entity and, where relevant, the group, since size decides whether you are in scope and whether you are essential or important. The size thresholds are explained in does NIS2 apply to SMEs.

How do you register, step by step?

1. Confirm scope and authority. Check that you are in scope and that the ILR, not the CSSF, is your competent authority.
2. Collect the five items above, for the entity and its group.
3. Open the self-registration form from the ILR’s self-registration page, on guichet.ilr.lu, in French or English.
4. Submit the form. Keep a copy of what you sent and the date.
5. Wait for the ILR’s review. The ILR reviews each form and confirms the entity’s status as essential or important.
6. Keep it current. Report any change within two weeks of it happening.

What happens after you register?

• Your status is confirmed. Essential entities face supervision before and after the fact; important entities are supervised after the fact. The difference is in essential vs important entities.
• You get a SERIMA account. SERIMA is the free cybersecurity platform the ILR developed with Belgium’s IBPT and Luxembourg’s NC3. The ILR sets up accounts for NIS2 entities after registration.
• Incident reporting applies. Significant incidents go to the ILR through the SERIMA notification form within 24 hours, then 72 hours, then one month. The procedure and a template are in NIS2 incident notification in Luxembourg.
• Essential entities report their measures every year. The ILR asks essential entities for a description of the measures in place, an analysis of the main cyber risk scenarios in the form of a multiple-choice questionnaire, and a multi-annual action plan. It may also ask for the list of their dependencies on direct suppliers. Deadlines are set in ILR regulations. The ILR is clear that this questionnaire does not replace the entity’s own risk analysis under Article 12.
• Management approves the measures. Article 13 makes the management body approve and oversee the security measures, and follow training.

Do digital providers register differently?

Yes, they submit a fuller dataset under Article 17. The providers concerned are DNS service providers, top-level domain registries, domain registration services, cloud and data centre providers, content delivery networks, managed service providers, managed security service providers, and online marketplaces, search engines and social networks. They give:

1. the entity’s name;
2. its sector, subsector and type of entity;
3. the address of its main establishment and other legal establishments in the EU, or of its representative;
4. up-to-date contact details, including email addresses and telephone numbers;
5. the Member States where it provides services;
6. its IP ranges.

Changes are due within three months. The single point of contact forwards the data, without the IP ranges, to ENISA for the EU registry. Article 17(1) carries over the directive’s date of 17 January 2025, which had already passed when the law was adopted, so the practical answer is the same: submit now.

The same providers also fall under Commission Implementing Regulation (EU) 2024/2690, which sets detailed security requirements and the criteria for a significant incident. What NIS2 means for managed service providers is in NIS2 for MSPs and MSSPs.

NIS2 registration checklist

• Confirm you are in scope and whether the ILR or the CSSF is your competent authority.
• Collect name, contacts, IP ranges, sector and subsector, countries served, and entity and group size.
• Use role-based security contacts.
• Submit the ILR self-registration form and keep a copy.
• Watch for the ILR’s confirmation of essential or important status, and your SERIMA account.
• Put a two-week change process in place (three months for the Article 17 dataset).
• Brief the management body on what registration starts.

How CloudSoul runs NIS2 compliance after registration is on the NIS2 page.

Sources

• ILR, Self-registration, updated 6 July 2026.
• ILR, Frequently asked questions about NIS2.
• ILR, Security measures, updated 7 August 2026, and SERIMA.
• Law of 5 May 2026 on measures to ensure a high level of cybersecurity, Legilux.

Frequently asked questions