On Friday morning, Luxembourg took a small step towards a direction its defence strategy had been pushing for several months. Behind it lie not just rifles, ammunition or an assembly line, but satellites, software, algorithms, autonomous systems and, perhaps, the future factories of a country that has long been more at home with asset finance than with the manufacture of weapons.
The move seems logical. Since the Grand Duchy is stepping up its military efforts, it makes sense for some of that expenditure to be channelled into its economy. 
So much for the front door. The problem lies inside the house.
The text purports to regulate the military industry of the future, but often seems to be looking to the past. It calls for doors capable of withstanding a break-in for five minutes, reinforced glazing, lockable shutters and serial numbers. These precautions make sense for a stock of components or ammunition. They say little about the protection of source code, a digital model, a cloud environment or technology embedded in a satellite.
The project does not set out any cyber security requirements specific to these activities: no encryption, no source code protection, no vulnerability management, and no incident reporting. Other regimes may apply, notably NIS2, the protection of classified information or the contractual obligations of military contracts. However, these measures do not, on their own, constitute the specific cyber component that is missing from this draft.
This blind spot is all the more surprising given that Luxembourg has no ambition to compete with the major European defence industries. Its official strategy specifically targets space, cyber security, data, automated systems and cross-cutting technologies. Its comparative advantage probably does not lie in artillery shells. It lies in what guides, connects, encrypts, monitors or automates.
The draft, however, sets out regulations in which the physical object remains the primary focus. Even its traceability comes up against this contradiction. Assigning a serial number to a mechanical part seems natural. Tracking an algorithm, a software library or military know-how requires a far more nuanced approach. The text refers to ‘any appropriate means’. This is a practical formula. It is not yet a technology security policy.
The exemption granted to public research institutions raises another question. Why exempt these organisations from the status of manufacturer when private companies, spin-offs or industrial partners might be subject to it? Public research is not meant to be viewed with suspicion. Yet it handles the same sensitive technologies. The fact that an organisation is publicly funded is not, in itself, sufficient to determine the applicable rules on traceability and cybersecurity.
It will be argued, quite rightly, that legislation should not confine every technology to overly specific requirements. A flexible framework stands the test of time better than a technical catalogue. The government must also swiftly establish the legal certainty it intends to offer businesses and enable existing projects to move beyond a regulatory framework designed for civilian weapons, trade and exports.
Flexibility does not, however, justify all grey areas. The minister’s silence would be deemed approval once the statutory deadline has expired, including for activities under scrutiny on grounds of espionage, interference or proliferation. Tacit authorisation is appropriate for many economic ventures. When applied to military manufacturing, it is like a lock that opens when the guard is slow to return.
Factual errors reinforce the impression that the text was submitted before it had undergone its final check. One provision refers to an Article 20 that does not exist. Another wavers between ‘manufacture’ and ‘production’. The definition of ‘manufacturer’ includes ‘sale’, whereas the scheme authorises ‘manufacture’. Nothing is irreparable: the Council of State and the Chamber of Deputies have precisely the tools required to rectify these shortcomings.
The crux of the matter lies elsewhere. Luxembourg recognises that a defence policy no longer consists merely of purchasing equipment from abroad and recording the expenditure. It wants to manufacture equipment, attract businesses and retain some of the technology within its borders. This choice deserves a legal framework that matches its ambition. In seeking to secure the factory gates, one must first know where the factory is now located.
