The Network and Information Security 2 Act reshapes the role of Board members and governance professionals, who now face heightened accountability, personal liability and mandatory training. How does it affect the profession?
On 10 May 2026, the Network and Information Security 2 (NIS2) Act came into force in Luxembourg law. The new legislation transposes the eponymous European directive aimed at ensuring a high level of cybersecurity at the European level. It strengthens companies’ cybersecurity requirements by imposing strict risk management measures and reporting obligations in this area. The text also introduces two categories: Essential Entities (medium-sized 250+ or €50M+ turnover), active in 11 critical sectors (energy, transport, banking, financial markets, health, water, digital infrastructure, public administration, space, ICT service providers, critical B2B). All are subject to strict pre-incident supervision.
And the Important Entities (50+ employees or turnover €10M+), active in seven additional sectors (postal services, waste management, manufacturing, research, food, chemicals, digital suppliers); they are supervised mainly in the event of an incident.
Under NIS2, both must notify any early warnings within 24 hours, a fuller incident notification is due within 72 hours, and a final report within a month. NIS2 follows four major objectives: resilience (by imposing high security standards on vital sectors); cooperation (by creating a network for the exchange of information between Member States, via the CSIRT network); transparency (by obliging companies to report early-stage or major incidents) and the harmonisation of cyber practices.
What are the penalties for non-compliance? For Essential Entities, the maximum administrative fines may be up to €10 million or 2% of total global annual turnover, whichever is greater. For Important Entities, fines will amount to up to €7 million or 1,4% of annual worldwide turnover.
Board members and governance professionals, who promote and guarantee the company’s governance and sustainability, must ensure that their organisation complies with these new requirements. In its Article 20, NIS2 provides that “Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities (…) oversee its implementation and can be held liable for infringements by the entities.”
Furthermore, “The Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.”
Cybersecurity is no longer just the business of technical teams – it is becoming a direct responsibility of senior management.
Cybersecurity is no longer just the business of technical teams. It is becoming a direct responsibility of senior management: «It involves an active and demonstrable commitment of managers. This strengthens the management bodies in their role as key players in cybersecurity within the organisation,» explains the Institut Luxembourgeois de Régulation (ILR). The independent authority is in charge of regulating electronic communications networks and services, the transport and distribution of electricity and gas, the postal services, the rail network, and airport charges.
“The instructions are quite precise on what management bodies, i.e. a supervisory board, a board of directors, or a management board must put in place, what they must monitor, on the very precise reporting to be received and communicated, on the taking of the necessary corrective measures…,” says Philipp von Restorff, the CEO of the Luxembourg Institute of Governance (ILA), the professional association for corporate directors, board members and governance professionals. However, he insists that they are not asked to become cybersecurity experts. They must be able to identify risks, to ask the right questions, and to be sure that the management’s approach is coherent. “These are therefore additional obligations,” he sees. “And the main challenge for a director is to be able to prove that all requirements have been implemented, in accordance with the law, to ensure that all risks are well minimised.”
Compliance doesn’t come cheap. According to a European IT budget benchmark from ITBudgetCalculator.com, EU companies now spend an average of 4,2% of revenue on IT in 2026, with GDPR, DORA, NIS2 and the AI Act each driving their own line items. Transposing NIS2 specifically, the benchmark estimates, can cost an entity anywhere from €200.000 to €5 million depending on its size and starting point.
But the real expense isn’t the one-time rollout, it’s the permanent obligation to stay compliant. «The cost driver is not the initial transposition, but the ongoing duty to comply,» the report notes. That recurring cost covers risk management, incident reporting, business continuity and supply chain security, and translates into concrete budget lines: an in-house information security officer or an external ISO/CISO mandate, outside consulting, training for management and staff, supply chain security reviews, and, hardest of all to price, the evidence and documentation needed to prove compliance on demand.
For Philipp von Restorff, the directive marks a significant turning point in the governance of these entities: “We are moving from a compliance or IT issue to a subject that now directly concerns administrators.” Are they prepared? “NIS2 is similar to the DORA framework that strengthens the cybersecurity and digital resilience of the EU financial sector regulated entities,” he answers. “Both legislations impose a framework to be put in place, obligations, responsibilities and reporting.” Under DORA, funds and banks report to the Commission de Surveillance du Secteur Financier (CSSF) and (re)insurance companies to the Commissariat aux Assurances (CAA).
“Board members and governance professionals who are already confronted with DORA through their missions or their functions as administrators, have obviously a head start; NIS2 will be less of a burden,” he adds. “But for the directors of entities that were not involved in DORA, the change will be significant.”
For Philipp von Restorff, NIS2 will not significantly affect the profession of director. “This is an additional responsibility to many other responsibilities,” he notes. “More generally speaking, a director must be constantly updated and trained, in order to be able to carry out his mandate properly, to follow the many regulations put in place, economic problems, geopolitical constraints, etc.”
However, could the directive have a deterrent effect on the profession? “This is a question that everyone must ask for themselves. This is certainly an additional obligation. The job of an administrator is both very complex and rich,” he answers. “NIS2 certainly adds an additional layer of constraints, but directorship is also a profession that one consciously chooses by knowing the responsibilities in which one is committed.”
This article was published in the 11th edition of Forbes Luxembourg.
Read more articles:
ClearSpace And Eutelsat To Advance Phoenix GEO Life-extension Services From Luxembourg
