In Luxembourg, essential and important entities report significant incidents to the ILR through the SERIMA online form, on three clocks: a preliminary notification within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. An incident is significant if it causes, or can cause, severe operational disruption or financial loss, or considerable damage to others.
This guide covers what counts as significant, where to notify, what each report contains, who else to tell, what the ILR does with it, personal data breaches, voluntary reporting, and a template you can prepare in advance.
| Report | Deadline | What it must contain (Article 14(4)) |
|---|---|---|
| Preliminary notification | Without undue delay, within 24 hours of becoming aware | Where relevant, whether the incident is suspected to be unlawful or malicious, and whether it could have a cross-border impact |
| Incident notification | Within 72 hours of becoming aware | An update of the preliminary notification, an initial assessment of severity and impact, and indicators of compromise where available |
| Intermediate report | On request of the CSIRT or the authority | Relevant updates on the situation |
| Final report | No later than one month after the incident notification | Detailed description, severity and impact; type of threat or root cause; mitigation applied and ongoing; cross-border impact where relevant |
| Progress report | If the incident is still ongoing at the final-report date | A progress report then, and the final report within one month of handling the incident |
Which incidents must you report?
Significant ones. Article 14(3) of the Law of 5 May 2026 defines an incident as significant if:
- it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned; or
- it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.
An incident, under Article 2 of the law, is any event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data, or of the services the entity’s network and information systems offer. The competent authority can set further parameters by regulation or circular.
Digital providers apply more precise thresholds. DNS service providers, top-level domain registries, cloud, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, search engines, social networks and trust service providers fall under Commission Implementing Regulation (EU) 2024/2690. Under its Article 3, an incident is significant if one or more of these apply:
- it causes or can cause direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower;
- it causes or can cause the exfiltration of trade secrets;
- it causes or can cause the death of a person, or considerable damage to a person’s health;
- there was a successful, suspectedly malicious and unauthorised access to network and information systems capable of causing severe operational disruption;
- it is a recurring incident under Article 4: at least twice in six months, the same apparent root cause, and together above the financial-loss threshold.
The regulation adds service-specific criteria for each type of provider. The judgement call in the first hours is covered in what makes an incident significant.
Where do you notify?
- ILR-supervised entities use the SERIMA notification form at serima.lu/notification. The form is publicly accessible without an account. SERIMA is the platform the ILR developed with Belgium’s IBPT and Luxembourg’s NC3.
- CSSF-supervised entities (banking, financial market infrastructures, and CSSF-supervised digital infrastructure and ICT service management activities) notify the CSSF as their competent authority.
- Questions to the ILR: [email protected] or (+352) 28 228 228.
The competent authority forwards every notification to the CSIRT concerned, CIRCL for most private entities or GOVCERT.LU for State bodies and critical entities, and to the single point of contact.
What goes in each report?
Preliminary notification, within 24 hours. This is an alert, not an analysis. The ILR’s page lists what it expects: the type of entity, a description of the incident, which significance criteria are met, whether there is a cross-border impact, and whether a malicious act is suspected. Send it on what you know; say what you do not know yet.
Incident notification, within 72 hours. Update the preliminary notification and give a first assessment: how severe, what impact on services and on recipients, and indicators of compromise if you have them.
Intermediate report, on request. The CSIRT or the authority can ask for updates at any point.
Final report, within one month of the incident notification. A detailed description including severity and impact, the type of threat or root cause that probably triggered the incident, the mitigation measures applied and ongoing, and any cross-border impact. If the incident is still being handled, send a progress report instead and the final report within one month of handling it.
Trust service providers notify significant incidents affecting their trust services within 24 hours, in place of the 72-hour clock.
How the three clocks run in practice is in the NIS2 incident reporting timeline.
Do you have to tell your customers?
Sometimes. Article 14 adds two duties towards the recipients of your services:
- Significant incidents: where relevant, notify recipients without undue delay of significant incidents likely to affect the provision of your services.
- Significant cyber threats: where relevant, tell recipients who are potentially affected what measures or remedies they can take, and, where appropriate, about the threat itself.
Separately, where public awareness is needed, the authority can inform the public of a significant incident, or require you to, after consulting you (Article 14(7)).
What does the ILR do with your notification?
Under Article 14(5), the competent authority responds without undue delay, and where possible within 24 hours of the preliminary notification, with initial feedback. On request, it gives guidance or operational advice on mitigation, in cooperation with the CSIRT, and the CSIRT can provide further technical support. If the incident looks criminal, you also get guidance on reporting it to law enforcement.
Notifying does not increase your liability: Article 14(1) says so in terms. Where an incident affects two or more Member States, the single point of contact informs them and ENISA, while protecting your security and commercial interests and the confidentiality of what you sent.
What if personal data is involved?
A NIS2 notification does not replace a GDPR one. If the incident is also a personal data breach, the GDPR requires you to notify the CNPD, where feasible within 72 hours of becoming aware of it. Run both from the same incident record so the facts match. The overlap is covered in NIS2 and GDPR.
Can you report voluntarily?
Yes. Article 20 allows two kinds of voluntary notification:
- essential and important entities can notify incidents, cyber threats and near misses that do not meet the significance test;
- any other entity, in scope or not, can notify the ILR of significant incidents, cyber threats and near misses.
The authority handles them under the same procedure, but may give mandatory notifications priority. A voluntary notification does not impose additional obligations on the entity that makes it. SERIMA accepts voluntary reports.
NIS2 incident notification template
Prepare these answers in advance so the 24-hour notification is a matter of filling in facts. The fields follow what the law and the ILR ask for; the SERIMA form remains the official channel.
PRELIMINARY NOTIFICATION (within 24 hours of becoming aware)
- Entity name, type of entity, sector
- Contact for this incident (name, role, phone, email)
- Competent authority: ILR / CSSF
- Date and time the entity became aware of the incident
- Short description: what happened, which services and systems
- Significance criterion met:
[ ] severe operational disruption or financial loss for the entity
[ ] considerable material or non-material damage to others
[ ] Implementing Regulation 2024/2690 criterion (digital providers): ______
- Suspected unlawful or malicious act: yes / no / unknown
- Possible cross-border impact: yes / no / unknown
- Recipients informed: yes / no / not yet
INCIDENT NOTIFICATION (within 72 hours of becoming aware)
- Updates to the preliminary notification
- Initial assessment of severity
- Impact: services affected, recipients affected, duration so far, financial loss estimate
- Indicators of compromise, if available
- Containment and mitigation actions taken so far
INTERMEDIATE REPORT (on request)
- Relevant updates since the last report
FINAL REPORT (within one month of the incident notification)
- Detailed description of the incident, including severity and impact
- Type of threat or root cause that probably triggered it
- Mitigation measures applied and ongoing
- Cross-border impact, if any
- If still ongoing: progress report now, final report within one month of handlingIncident notification checklist
- Write down who decides whether an incident is significant, and who submits the notification.
- Bookmark the SERIMA form and keep the ILR contact details in your incident plan.
- Pre-fill the template’s entity details and contacts.
- Define the two significance criteria in terms of your own services, plus the 2024/2690 thresholds if you are a digital provider.
- Decide how you inform customers when an incident is likely to affect them.
- Link your NIS2 and GDPR notification steps so both run from one incident record.
- Rehearse the 24-hour clock at least once a year.
Incident handling is one of the ten measures in Article 21. The Luxembourg framework as a whole is in NIS2 in Luxembourg, and how CloudSoul runs the programme is on the NIS2 page.
Sources
- Law of 5 May 2026 on measures to ensure a high level of cybersecurity, Articles 2, 14 and 20, Legilux.
- ILR, Incident notification, updated 6 July 2026, and SERIMA.
- Commission Implementing Regulation (EU) 2024/2690, Articles 3 and 4, EUR-Lex.
Frequently asked questions
How do you report a NIS2 incident in Luxembourg?
Entities supervised by the ILR submit their notifications through the SERIMA online form at serima.lu/notification. The ILR forwards each notification to the competent CSIRT and to the single point of contact. Entities supervised by the CSSF notify the CSSF.
What are the NIS2 incident reporting deadlines in Luxembourg?
A preliminary notification without undue delay and within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after the incident notification. Trust service providers notify within 24 hours.
What is a significant incident under the Luxembourg NIS2 law?
One that has caused or can cause severe operational disruption of the services or financial loss for the entity, or that has affected or can affect other people by causing considerable material or non-material damage. Digital providers covered by Implementing Regulation (EU) 2024/2690 also apply its specific thresholds.
Does notifying an incident increase your liability?
No. Article 14(1) of the law states that the mere fact of notifying an incident does not increase the liability of the entity that notifies it.
Can a company outside NIS2 report an incident to the ILR?
Yes. Article 20 lets any entity, in scope or not, voluntarily notify the ILR of significant incidents, cyber threats and near misses. A voluntary notification does not impose additional obligations on the entity that makes it.
