European Sovereignty Monitor

Policy and law

Luxembourg enacts law transposing the EU NIS2 cybersecurity directive

Luxembourg published its Law of 5 May 2026 transposing the EU's NIS2 directive, entering into force on 10 May and binding around 15 sectors to harmonised risk management and incident reporting rules, with fines up to EUR 10 million.

Verified Institut Luxembourgeois de Régulation (ILR) notice, 10 May 2026

What it does not test. Does not establish that any covered entity has actually changed a supplier or reduced reliance on non-European technology as a result.

How this item counts. No movement: no answer to who owns, who operates, whose law governs or who made the parts changes. Weight 0. national NIS2 law in force but no supplier switch shown; single member state. European Sovereignty Index

Previously in Policy and law

Verified ANSSI leads G7 call for urgent shift to post-quantum cryptography Reported EU Commission sends AI Act information requests to over 30 companies Reported EU antitrust officials seek information on Oracle's cloud licensing practices

All Policy and law news →