How to comply with article M.0 of CSSF 25/883?

Question

I need to bring my Luxembourg organisation into compliance with article M.0 of CSSF 25/883 (CSSF 25/883). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe preamble of CSSF 25/883 looks harmless: a date, a list of addressees, an alignment objective. In reality it sets the exact perimeter where the CSSF will hold you accountable. The most frequently sanctioned pitfall in practice is the dual regime: since 17 January 2025, your critical ICT arrangements fall under DORA (a directly applicable regulation), while your non-ICT outsourcing remains under the amended CSSF 22/806. Entities that keep applying the pre-25/883 version of 22/806, in particular the deleted EEA cloud clauses, end up doubly non-compliant: they document against an obsolete framework while omitting their DORA obligations. The CSSF sanctions this perimeter confusion because it reveals a third-party governance setup that was never remapped after 9 April 2025.How to know which case applies to youThe 25/883 restructures the scope into distinct categories. Identifying yours conditions everything that follows in your compliance work:DORA entity (credit institution, PFS, payment institution, fund manager, CCP, CSD): your third-party ICT requirements shift under DORA and CSSF 25/882, while 22/806 only applies to non-ICT outsourcing.UCITS management company under Article 125-1: specific regime, combined reading to verify case by case.Entity outside DORA scope: 22/806 remains fully applicable, without the now-redundant EEA cloud clauses.Entity that withdrew its authorisation: dedicated transitional treatment.The specific cloud contractual clauses (EEA law, EEA resilience) are deleted as they are now covered by DORA: still imposing them on your providers is a signal that you never updated.The DORA information register (Article 28) becomes the central enforceable document, not the 22/806 outsourcing table.How Luxgap automates this riskOur Luxgap Regime Router makes it impossible to apply the wrong framework: it classifies each of your vendor arrangements into the correct regime (DORA, amended 22/806, Article 125-1 UCITS) and instantly flags the obsolete clauses you are still imposing. An LLM agent reads your vendor contracts stored in Odoo, SharePoint M365 or your document vault, cross-references the supported function with your CSSF authorisation status, and decides critical ICT versus classic outsourcing without any lawyer filling in a form.Classifies every vendor relationship into the correct post-9 April 2025 regime (DORA, amended CSSF 22/806, 25/882, Article 125-1) based on your authorisation type and the supported ICT function.Detects deleted EEA cloud clauses still present in your contracts and alerts on each arrangement to renegotiate.Automatically generates the DORA Article 28 information register from your connected contracts and reconciles it with your legacy 22/806 table to surface blind spots.Alerts in real time via Teams or email whenever a new ICT contract is signed without the associated DORA documentation.Produces a timestamped PDF report enforceable before the CSSF during an inspection, proving your mapping...

Preamble, addressees and entry into force (9 April 2025)

They trust us

Before we chat