I need to bring my Luxembourg organisation into compliance with recital 73 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 73 DORA — Recital 73 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 73

Digital Operational Resilience Act · UE 2022/2554

(73)

Contracts for the provision of ICT services supporting critical or important functions should also contain provisions enabling the rights of access, inspection and audit by the financial entity, or an appointed third party, and the right to take copies as crucial instruments in the financial entities’ ongoing monitoring of the ICT third-party service provider’s performance, coupled with the service provider’s full cooperation during inspections. Similarly, the competent authority of the financial entity should have the right, based on notices, to inspect and audit the ICT third-party service provider, subject to the protection of confidential information.

Luxembourg specificity

circulaire CSSF 22/806 du 22 avril 2022 sur les arrangements d'externalisation, lue avec le règlement CSSF 20-04

In Luxembourg, the CSSF is the competent authority that directly exercises the inspection right set out in recital 73 over ICT providers of supervised financial entities. CSSF Circular 22/806 on IT outsourcing, read together with CSSF Regulation 20-04, already requires ICT contracts to contain audit rights extended to the CSSF and its agents, with physical access to the provider's premises and its subcontractors, including those established outside the EU.

Luxgap practice: we map each ICT contract against the dual DORA + Circular 22/806 grid and prepare the compliance addenda ahead of the next SREP cycle or CSSF information request.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

The CSSF regularly sanctions Luxembourg financial entities whose ICT contracts contain only theoretical audit clauses, never exercised in practice and often hollowed out by the provider (90-day notice, on-site audit forbidden, copies refused, scope limited to generic policies). Recital 73 of DORA makes clear that these rights must be real, enforceable and extended to the competent authority itself. In the event of an incident, the absence of documented exercise of audit rights is read as a failure of ongoing monitoring, which aggravates the financial entity's liability across the entire ICT outsourcing chain.

Audit clauses that actually hold up in front of the CSSF

Right of access, inspection and audit exercised directly by the financial entity or by an appointed third party (audit firm, sector-wide pooled audit).
Right to take copies of evidence (logs, configurations, penetration test reports, certificates), not just to read them on site.
Full cooperation of the provider during audits, without abusive retention clauses or deterrent billing of time spent.
CSSF right to inspect on notice, enforceable against the provider and the entire ICT subcontracting chain.
Confidential information protected (NDA, data room, masking of other clients' data) without becoming a pretext to block the audit.
Minimum frequency, ad hoc triggers (major incident, change of control, SLA degradation) and reasonable notice periods explicitly quantified.

How Luxgap automates this risk

Our Luxgap Audit Rights Enforcer turns your dormant audit clauses into an ICT audit programme that is actually executed and enforceable before the CSSF. The tool automatically scans your ICT contracts stored in SharePoint, DocuWare or Odoo via a dedicated LLM agent, extracts the existing audit clauses, benchmarks them against the DORA grid (articles 28 to 30 and recital 73), then drives the schedule of effective exercise of these rights with each critical provider.

Detects in your ICT contracts the absence or weakness of access, inspection, audit and copy clauses, with a robustness score per vendor.
Generates ready-to-sign addenda to align each contract with the DORA standard, tailored by type (hyperscaler cloud, business SaaS, local provider such as eBRC or LuxConnect, cascading subcontractor).
Plans and orchestrates real audits, pooled or individual, with timestamped collection of evidence (Defender, Sentinel, AWS CloudTrail logs, SOC 2 and ISO 27001 reports).
Alerts the CSSF-ready inbox as soon as a critical provider refuses, delays or abusively conditions an audit right set out in the contract.
Produces a cryptographically sealed, timestamped PDF report, enforceable before the CSSF, evidencing the effective and ongoing monitoring required by recital 73.

Available as part of a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real ICT contracts, with a free 48-hour gap analysis to measure the distance between your current audit clauses and the DORA standard before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 73

They trust us

Before we chat