The classic trap
The trap in this introductory amendment is the wrong classification of the outsourcing contract. Since 17 January 2025, the same financial entity must determine, for each arrangement, whether it falls under DORA (ICT dimension) or under CSSF 22/806 (non-ICT outsourcing and entities outside the DORA scope). In practice, the CSSF sanctions entities that keep applying the old 22/806 cloud regime to ICT services now covered by DORA, or that leave ICT contracts without the DORA register of information. The risk is concrete: a misclassified contract means an ICT breach that shifts under the DORA sanctions regime, up to 1% of average daily turnover.
The triage grid every CSSF entity must master
The reworded introduction imposes a mapping exercise that is often neglected. Concretely, each vendor relationship must be placed in the right box:
- ICT service provided to an entity within the DORA scope: DORA regime, mandatory register of information, Article 30 DORA clauses.
- Non-ICT outsourcing (payroll, advisory, facilities): unchanged CSSF 22/806 regime.
- Financial entity outside the DORA scope: 22/806 remains the full basis, ICT included.
- Management companies under Article 125-1 of the UCITS Law: specific case to verify individually.
- EEA cloud and EEA resilience clauses from the old 22/806: removed, now covered by DORA, and no longer to be invoked in new ICT contracts.
The 25/883 must be read together with CSSF 25/882 on the use of third-party ICT services. Neglecting this dual reading leads to inconsistent hybrid contracts.
How Luxgap automates this risk
Our Luxgap Outsourcing Classifier makes it impossible to misroute a contract between 22/806 and DORA, by automatically sorting each outsourcing arrangement into the correct regime as soon as it is created. A specialised AI agent reads your vendor contracts and invoices in Odoo, Sage BOB 50 and M365, identifies the ICT or non-ICT nature of the service, and cross-checks this analysis with your DORA status to determine the applicable framework in seconds.
- Classifies each vendor relationship according to the four cases of CSSF 25/883 (DORA entity, outside DORA, withdrawn, Article 125-1 UCITS management company) from your Odoo contracts and your CSSF authorisation reference.
- Detects ICT contracts still drafted under the old 22/806 EEA cloud clauses and flags those now covered by DORA.
- Generates a pre-filled DORA register of information for ICT services shifting under Article 30 of the regulation, in sync with CSSF 25/882.
- Alerts in real time via Teams whenever a new vendor contract or payment appears and remains unclassified against both frameworks.
- Produces a timestamped PDF report enforceable before the CSSF during an inspection, demonstrating the consistency of your outsourcing mapping between 22/806 and DORA.
Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real contracts, with a free blank audit within 48h to measure your exposure before any commitment.
