How to comply with article 52 of DORA?

Question

I need to bring my Luxembourg organisation into compliance with article 52 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 52 creates a dual repressive regime often overlooked by Luxembourg financial entities. When a Member State chooses the criminal route for certain DORA breaches, the entity faces not only the CSSF measures (Chapter VII) but also prosecution before criminal justice authorities. The trap: believing that answering the CSSF closes the matter, when the same facts (failure to report a major ICT incident, false statements, obstruction) can feed a criminal investigation, with information sharing organised between prosecutors, the CSSF and the ESAs (EBA, ESMA, EIOPA). The cooperation set out in paragraph 2 means information given to one authority flows to the others.What turns an ICT incident into criminal exposureArticle 52 does not define the criminal offences itself: it refers to national law and the existing financial enforcement framework. In practice, the tipping points toward criminal liability are identifiable:False or misleading statements to the CSSF when reporting a major ICT incident (Art. 19 DORA).Obstruction of the CSSF investigation and inspection powers (Art. 50).Concealment or destruction of evidence relating to an incident or a resilience test (TLPT / TIBER-LU).ICT third-party risk management failures of an intentional or fraudulent nature (Art. 28 to 30).Breaches intersecting with money laundering or market abuse, where Luxembourg financial criminal law already applies.The defensive key: precisely tracing who knew what and when, because the intentional element is built on the chronology of internal decisions and missed escalations.How Luxgap automates this riskOur Luxgap Forensic Timeline Vault makes impossible the approximate reconstruction of facts that exposes your directors to criminal liability: it continuously freezes a timestamped, tamper-proof chronology of every decision linked to an ICT incident. The tool ingests events from Microsoft Sentinel, Defender, your ServiceNow tickets, your Teams escalation logs and your DORA incident register to reconstruct the operational truth, not the version rewritten after the fact.Captures in real time every alert, escalation and decision from Sentinel, Defender and CrowdStrike, and seals them cryptographically (chained hash) to guarantee integrity.Rebuilds the full timeline of a major ICT incident, from the first signal to the CSSF notification (Art. 19), with regulatory deadlines computed automatically.Detects breaks in the escalation chain and abnormal silence windows that characterise potential concealment.Generates a timestamped, signed forensic PDF file, admissible both before the CSSF and the prosecutor, demonstrating the good faith and diligence of governance.Segregates access by role and logs every consultation to preserve the evidential value of the file in any criminal proceedings.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on yo...

Criminal penalties

They trust us

Before we chat