The classic trap
This recital signals a major shift: the EU-level centralisation of ICT incident reporting. In practice, many Luxembourg financial entities underestimate that their current notification architecture (CSSF Circular 24/847, operational incident form, ECB SSM notification, CNPD alert if personal data) will have to evolve toward a single EU Hub. Entities that build a rigid workflow today, coupled to a single CSSF endpoint, will have to redesign everything once the hub goes live, with a risk of inconsistent double-reporting between CSSF and the EU hub during the transition phase.
What this recital changes for your reporting architecture
- Your notification process must be recipient-agnostic: able to push to CSSF today, to the EU Hub tomorrow, with no rebuild.
- The pivot format must follow the DORA RTS on incident classification and reporting (Delegated Regulation 2024/1772) to be directly compatible with an automated European upload.
- Cross-channel consistency is critical: a major incident also triggering a CNPD notification (Art. 33 GDPR) and a CSSF notification must carry the same identifier, same timestamps, same qualified facts.
- During the transitional phase, the real risk is declarative contradiction between what you declare to CSSF at H+24 and what surfaces in the future hub at H+72.
How Luxgap automates this risk
Our Luxgap Incident Reporting Orchestrator turns your multichannel notification obligation into a single, recipient-agnostic flow, already aligned with the DORA RTS and ready for the future EU Hub. The tool plugs a specialised LLM agent into your SIEM (Sentinel, Splunk, Wazuh), your ServiceNow tickets and your Teams exchanges to automatically qualify each incident against the DORA grid (client impact, data loss, duration, criticality of affected services) and produce the right filing, at the right time, to the right authority.
- Automatically qualifies each ICT incident against the seven criteria of Delegated Regulation 2024/1772 and produces the reasoned decision to notify or not, electronically signed.
- Generates the three DORA reports (initial 24h, intermediate 72h, final 1 month) pre-filled from technical data already present in Sentinel, Defender or CrowdStrike.
- Synchronises a unique pivot identifier across the CSSF notification (Circular 24/847), the Article 33 GDPR CNPD notification if applicable, and the future EU Hub upload.
- Detects contradictions between channels (diverging timeline, inconsistent client scope) before sending and blocks submission until consistency is validated.
- Produces a timestamped incident file, cryptographically sealed, admissible during an on-site CSSF inspection or a document request from the designated ESA.
- Switches automatically to the EU Hub upon go-live, with no rebuild of your internal workflow.
Available as part of a Luxgap CISO or DPO mandate or as a standalone SaaS module depending on your scope. Request a demonstration and our teams prepare a free 48-hour blind audit, simulating a major ICT incident on your real perimeter and measuring your current qualification and notification lead time, before any engagement.
