European Sovereignty Monitor

Policy and law

Luxembourg enacts law transposing the EU NIS2 cybersecurity directive

Luxembourg published its Law of 5 May 2026 transposing the EU's NIS2 directive, entering into force on 10 May and binding around 15 sectors to harmonised risk management and incident reporting rules, with fines up to EUR 10 million.

Verified AI-drafted Institut Luxembourgeois de Régulation (ILR) notice, 10 May 2026

What it does not test. Does not establish that any covered entity has actually changed a supplier or reduced reliance on non-European technology as a result.

How this item counts. No movement: no answer to who owns, who operates, whose law governs or who made the parts changes. Weight 0. national NIS2 law in force but no supplier switch shown; single member state. European Sovereignty Index

How this item was made. Drafted by an AI system (Claude (Anthropic)) from the source cited above and published under the editor’s responsibility without a person reading it first. How the record is made

What the tags mean: VerifiedReportedAI-draftedAI-drafted, editor-readHuman-writtenWhat the tags mean

Previously in Policy and law

VerifiedOpinionAI-drafted DIGITALEUROPE's Bonefeld-Dahl: sovereignty rules need high fences only for sensitive fields ReportedOpinionAbroadAI-drafted FFO says Ofcom cannot enforce Online Safety Act fines on US websites VerifiedAI-drafted EU-backed OSOR report finds national open source policy now a sovereignty tool

All Policy and law news →