Where the rules shape the work.

Each sector works to its own rules and deadlines.

Let's talk

Banking

Banks and investment firms, where every change is audited and many deadlines are set by the regulator.

Typical situations

A regulatory date that cannot move: DORA remediation, the move to the EU AML Regulation, instant payments.
A core banking system, data platform or payment chain to change without interrupting service.
A backlog of client files, periodic reviews or transaction alerts to clear, to the standard your regulator expects.

What matters in this sector in Luxembourg

DORA has applied since 17 January 2025. Under the law of 1 July 2024, the CSSF supervises it for banks and investment firms; significant banks report their register to the ECB.
Banks' ICT arrangements follow DORA and Circular CSSF 25/882; other outsourcing follows Circular CSSF 22/806, amended in 2025 and 2026.
Article 41 of the law of 5 April 1993 on the financial sector sets the conditions under which service providers may access data covered by professional secrecy.
The Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027. AMLA, the EU authority in Frankfurt, begins direct supervision of certain high-risk cross-border institutions in 2028.

Expertise we bring to this sector

Insurance

Insurers and brokers, where solvency, conduct and data rules shape every change.

Typical situations

A regulatory programme with a fixed date: the Solvency II review, DORA, recovery and resolution planning.
Policy administration or claims systems to modernise while contracts keep running.
Actuarial, finance and risk teams that need reliable data and reporting, on time.

What matters in this sector in Luxembourg

DORA has applied since 17 January 2025. The Commissariat aux Assurances supervises it for insurers, reinsurers and insurance intermediaries, and collects insurers' register of ICT third-party arrangements.
Article 300 of the law of 7 December 2015 on the insurance sector sets insurance secrecy and the conditions under which service providers may access covered data.
Luxembourg must transpose the Solvency II review, Directive (EU) 2025/2, and the Insurance Recovery and Resolution Directive, (EU) 2025/1, by 29 January 2027, for application from 30 January 2027.

Expertise we bring to this sector

Life Sciences

Pharmaceutical, biotech and medical device companies, where systems are validated and every change is documented.

Typical situations

A system to validate or revalidate, with the documentation an inspection expects.
A regulatory transition to plan for, such as the medical device and in vitro diagnostic rules.
Clinical, quality or manufacturing data to bring together without breaking its audit trail.

What matters in this sector in Luxembourg

In Luxembourg, the Direction de la santé, through its Division de la pharmacie et des médicaments, is the competent authority for medicines, medical devices and in vitro diagnostics.
Medical device manufacturers and authorised representatives established in Luxembourg register with the Direction de la santé. EUDAMED use has been mandatory since 28 May 2026.
Luxembourg's NIS2 law of 5 May 2026 has been in force since 10 May 2026. Pharmaceutical and medical device manufacturers in scope had to register with the ILR by 10 July 2026.

Expertise we bring to this sector

Transport & Logistics

Transport operators, logistics providers and ports, whose schedules and flows the public and supply chains rely on every day.

Typical situations

Scheduling, ticketing or asset systems where an outage is visible to the public the same day.
Warehouse, fleet or freight systems to integrate while goods keep moving.
Electronic freight documents and data exchanges to prepare with partners and authorities.

What matters in this sector in Luxembourg

Luxembourg's NIS2 law of 5 May 2026 has applied since 10 May 2026, with the ILR as competent authority for most sectors; entities had to register by 10 July 2026.
Luxembourg's law of 5 May 2026 on the resilience of critical entities, in force since 10 May 2026, covers transport among other sectors, with the High Commission for National Protection as competent authority.
Luxembourg acceded to the e-CMR protocol on 26 December 2017, which allows electronic consignment notes for international road carriage under the CMR convention.

Expertise we bring to this sector

Public Services

Public administrations and institutions, whose services citizens and businesses rely on every day.

Typical situations

A programme bought through a framework agreement, with the documentation and reporting the procedure requires.
Digital services for citizens or members that must be accessible, secure and available in more than one language.
Case management or benefit systems to modernise while the service stays open.

What matters in this sector in Luxembourg

Luxembourg public buyers procure under the law of 8 April 2018, through the public procurement portal.
Luxembourg's NIS2 law of 5 May 2026 applies to public administration entities whatever their size; GOVCERT.LU is the incident response team for State administrations and public establishments.
Luxembourg's law of 28 May 2019 applies the Web Accessibility Directive to the State, municipalities and public-law bodies; the Information and Press Service oversees compliance.

Expertise we bring to this sector

Retail & Consumer Goods

Retailers, distributors and consumer goods companies, whose stores, warehouses and online channels run every day.

Typical situations

Stores, warehouses or online shops that must keep running while systems change.
An ERP programme with a fixed horizon, such as moving off SAP ECC before its mainstream maintenance ends.
Supply chain, pricing and product data that has to be integrated, reliable and ready every morning.

What matters in this sector in Luxembourg

Luxembourg's law of 8 March 2023 has applied the accessibility requirements to e-commerce and listed products since 28 June 2025, with OSAPS supervising compliance; microenterprises providing services are exempt.
Since 18 March 2023, all suppliers to Luxembourg public bodies send structured e-invoices; bill 8815, filed on 30 July 2026, would extend the obligation to domestic B2B invoicing from 2028.
Luxembourg's NIS2 law of 5 May 2026 has applied since 10 May 2026, with the ILR as competent authority for most sectors; entities had to register by 10 July 2026.

Expertise we bring to this sector

Aerospace & Defence

Defence organisations and the aerospace and security industry, where security, discretion and long programme horizons shape the work.

Typical situations

Programmes where clearances, discretion and continuity over several years matter.
Logistics, maintenance and information systems to modernise while operations continue.
Cooperation with allied and European partners that requires common standards and teams that work in English.

What matters in this sector in Luxembourg

Defence and security procurement follows Directive 2009/81/EC.
In Luxembourg, classification and security clearances follow the amended law of 15 June 2004; the National Security Authority, a division of the State Intelligence Service, carries out the investigations.
Bill 8651 on the protection of classified documents, filed on 11 November 2025, would modernise this framework in line with EU and NATO standards; it was before parliament in September 2026.

Expertise we bring to this sector

Manufacturing & Industry

Manufacturers and industrial companies, where production, maintenance and IT systems have to work as one.

Typical situations

Plants and production lines that must keep running while IT and operational systems converge.
Products with software inside that must meet new cybersecurity and machinery rules.
An ERP or manufacturing systems programme with a fixed horizon, such as moving off SAP ECC.

What matters in this sector in Luxembourg

Luxembourg's NIS2 law of 5 May 2026 has applied since 10 May 2026, with the ILR as competent authority for most sectors; entities had to register by 10 July 2026.
Since 18 March 2023, all suppliers to Luxembourg public bodies send structured e-invoices; bill 8815, filed on 30 July 2026, would extend the obligation to domestic B2B invoicing from 2028.
SAP ECC mainstream maintenance ends on 31 December 2027, with extended maintenance available until 2030.

Expertise we bring to this sector

Energy & Utilities

Energy producers, network operators and water utilities, whose operations run continuously and depend on reliable data.

Typical situations

Plants and networks that must keep running while IT and operational systems converge.
Metering, market and customer data that has to be reliable and ready on time.
Security and resilience obligations to meet as an essential or critical entity.

What matters in this sector in Luxembourg

Luxembourg's NIS2 law of 5 May 2026 has applied since 10 May 2026, with the ILR as competent authority for most sectors; entities had to register by 10 July 2026.
Luxembourg's law of 5 May 2026 on the resilience of critical entities transposes the CER Directive; the High Commission for National Protection is competent authority outside banking and financial market infrastructure.
Entities identified as critical under that law fall within Luxembourg's NIS2 law whatever their size.

Expertise we bring to this sector

Healthcare

Hospitals, care providers and health insurers, where patient data, security and continuity of care come first.

Typical situations

Clinical or administrative systems to change while care continues around the clock.
Patient data to exchange securely between providers, with consent and access rules respected.
Security obligations to meet across networks, medical devices and suppliers.

What matters in this sector in Luxembourg

Luxembourg's NIS2 law of 5 May 2026, in force since 10 May 2026, covers healthcare providers. The ILR is the competent authority and entities had to register by 10 July 2026.
Agence eSanté runs Luxembourg's national eHealth platform and the shared care record (DSP), under the law of 17 December 2010 and the Grand-Ducal Regulation of 6 December 2019.
Agence eSanté is Luxembourg's National Contact Point for eHealth in MyHealth@EU. Under the EHDS, patient summaries and ePrescriptions must be exchangeable across the EU from 26 March 2029.

Expertise we bring to this sector

The notes on regulation summarise the rules and dates, in force or announced as of September 2026, that shape the work in each sector. They are not legal advice: which obligations apply to your organisation depends on its own situation.

Tell us about your sector.

A dedicated Neurho Single Point of Contact (SPOC) comes back to you with a first reading of your constraints and the expertise to bring together.

Describe your context