How to comply with article M.4 of CSSF 25/883?

Question

I need to bring my Luxembourg organisation into compliance with article M.4 of CSSF 25/883 (CSSF 25/883). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRemoving cloud-specific clauses from Circular 22/806 is not a relaxation: it is a shift of burden onto DORA. The trap the CSSF sanctions is the financial entity that believes its old cloud contracts remain valid because the EEA requirement vanished from 22/806, when Articles 28 et seq. of DORA now impose a stricter set of mandatory contractual clauses (audit rights, exit strategies, data location, chain subcontracting). In practice, the CSSF reviews the register of ICT contractual arrangements and the effective presence of DORA clauses in every contract with a provider supporting a critical or important function.What actually changes for your cloud contractsThe EEA legal anchor is no longer a 22/806 requirement, but DORA imposes data location and access conditions as a mandatory contractual element.Contractual clauses become identical for all DORA entities, cloud no longer has a favourable or specifically aggravated regime.Each contract supporting a critical or important function must include Article 30 DORA items: service levels, audit and inspection rights, testable exit strategies.The register of contractual arrangements becomes the priority control object, its absence or incompleteness is directly sanctionable.Circular 25/883 must be read alongside CSSF 25/882 on the use of third-party ICT services, which details the operational expectations.Sanctions are not created by 25/883 itself. The 22/806 regime remains applicable for non-DORA entities, and for requirements shifting under DORA, the DORA sanctions apply (up to 1% of average daily turnover per day of infringement for critical providers).How Luxgap automates this riskOur Luxgap DORA Clause Auditor makes the orphan cloud contract impossible: an AI agent reads every ICT supplier contract stored in your DMS (M365 SharePoint, Odoo, eBRC vault) and detects missing Article 30 DORA clauses in seconds, with no form to fill. The tool automatically reconciles your real contracts against your register of contractual arrangements and flags the gaps between the old 22/806 regime and the harmonised DORA requirements.Reads and classifies each cloud contract automatically via a specialised LLM agent, distinguishing critical or important functions within the meaning of DORA.Detects missing mandatory clauses (audit rights, testable exit strategy, data location, chain subcontracting) and proposes remediation text aligned with Article 30 DORA.Reconciles in real time your contracts stored in M365 and Odoo against your ICT register of contractual arrangements and alerts on suppliers absent from the register.Identifies legacy EEA clauses made obsolete under the amended 22/806 and proposes their update to the DORA framework.Produces a timestamped PDF report enforceable before the CSSF, demonstrating full contractual coverage of every provider supporting a critical or important function.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Req...

Amendment 4, removal of cloud-specific contractual clauses

They trust us

Before we chat