I need to bring my Luxembourg organisation into compliance with recital 91 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 91 sheds light on the philosophy behind oversight of critical ICT third-party providers: three principles (ESA coordination through the Joint Oversight Network, alignment with NIS 2, and diligence to avoid disrupting customers outside scope). The trap in practice for Luxembourg financial entities supervised by the CSSF is to believe that the designation of a provider as critical by the ESAs relieves you of responsibility: on the contrary, it adds a layer of scrutiny, and the CSSF still expects you to demonstrate your own grip on third-party risk, even when the provider is already under European oversight.How this recital shapes operational interpretationESA coordination through the JON means that your critical providers (cloud hyperscalers, SWIFT, Bloomberg, etc.) will receive harmonised recommendations: you must track them and assess their impact on existing contracts.The articulation with NIS 2 is meant to prevent a single provider from being audited twice on the same controls: in practice, your provider mapping must indicate the applicable regime (DORA only, NIS 2 only, or both) to anticipate friction.Diligence toward customers outside scope (industrial SMEs, municipalities, hospitals sharing your cloud) implies that oversight measures should not trigger generalised service disruption: monitor your providers' communications on corrective actions requested by overseers.For the CSSF, this recital reinforces that ultimate responsibility remains with the financial entity: European oversight of the provider never replaces your own due diligence under GDPR article 28 and DORA articles 28-30.How Luxgap automates this riskOur Luxgap Oversight Radar turns the European oversight of critical ICT third-party providers into an actionable signal for your CSSF compliance, instead of letting it sleep in JON PDFs that nobody reads. The tool aggregates in real time the publications of the three ESAs (EBA, ESMA, EIOPA), Joint Oversight Network decisions, and ENISA NIS 2 recommendations, then cross-references them with your DORA register of information to pinpoint which supplier contracts are impacted.Continuously monitors ESA designations of critical providers and alerts you as soon as one of your suppliers in the DORA register comes under European oversight.Automatically cross-references JON recommendations with your contracts in Odoo, DocuSign or SharePoint to identify clauses that must be renegotiated within 30 days.Detects DORA / NIS 2 overlap on a single provider and produces a unified obligation matrix ready for your risk committee.Generates a forward-looking dashboard of potential disruptions: if AWS Frankfurt is hit by an ESA measure, the tool simulates the impact on your critical services based on your dependency mapping.Produces a timestamped quarterly report opposable to the CSSF, demonstrating that your third-party ICT governance actively integrates signals from the European Lead Overseer.Available as a complement to a Luxg...

Recital 91 DORA — Recital 91 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 91

Digital Operational Resilience Act · UE 2022/2554

(91)

The exercise of the oversight should be guided by three operational principles seeking to ensure: (a) close coordination among the ESAs in their Lead Overseer roles, through a joint oversight network (JON), (b) consistency with the framework established by Directive (EU) 2022/2555 (through a voluntary consultation of bodies under that Directive to avoid duplication of measures directed at critical ICT third-party service providers), and (c) applying diligence to minimise the potential risk of disruption to services provided by the critical ICT third-party service providers to customers that are entities falling outside the scope of this Regulation.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2024 portant mise en oeuvre du reglement (UE) 2022/2554 (DORA)

In Luxembourg, the CSSF is the competent authority for DORA oversight of financial entities, and the law of 1 August 2024 implementing DORA explicitly designates the CSSF and the CAA as national contact points with the Joint Oversight Network. The Luxembourg financial centre concentrates strong dependency on a few hyperscalers and shared service providers (eBRC, LuxConnect, POST), which makes recital 91 particularly sensitive: an ESA measure on a critical provider can cascade across a significant part of the sector.

Luxgap practice: we map your critical ICT providers against the dual grid of CSSF circular 22/806 (outsourcing) and DORA articles 28-30, and we integrate JON communications into your quarterly IT risk committee to anticipate contract renegotiations before the CSSF asks for them.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 91 sheds light on the philosophy behind oversight of critical ICT third-party providers: three principles (ESA coordination through the Joint Oversight Network, alignment with NIS 2, and diligence to avoid disrupting customers outside scope). The trap in practice for Luxembourg financial entities supervised by the CSSF is to believe that the designation of a provider as critical by the ESAs relieves you of responsibility: on the contrary, it adds a layer of scrutiny, and the CSSF still expects you to demonstrate your own grip on third-party risk, even when the provider is already under European oversight.

How this recital shapes operational interpretation

ESA coordination through the JON means that your critical providers (cloud hyperscalers, SWIFT, Bloomberg, etc.) will receive harmonised recommendations: you must track them and assess their impact on existing contracts.
The articulation with NIS 2 is meant to prevent a single provider from being audited twice on the same controls: in practice, your provider mapping must indicate the applicable regime (DORA only, NIS 2 only, or both) to anticipate friction.
Diligence toward customers outside scope (industrial SMEs, municipalities, hospitals sharing your cloud) implies that oversight measures should not trigger generalised service disruption: monitor your providers' communications on corrective actions requested by overseers.
For the CSSF, this recital reinforces that ultimate responsibility remains with the financial entity: European oversight of the provider never replaces your own due diligence under GDPR article 28 and DORA articles 28-30.

How Luxgap automates this risk

Our Luxgap Oversight Radar turns the European oversight of critical ICT third-party providers into an actionable signal for your CSSF compliance, instead of letting it sleep in JON PDFs that nobody reads. The tool aggregates in real time the publications of the three ESAs (EBA, ESMA, EIOPA), Joint Oversight Network decisions, and ENISA NIS 2 recommendations, then cross-references them with your DORA register of information to pinpoint which supplier contracts are impacted.

Continuously monitors ESA designations of critical providers and alerts you as soon as one of your suppliers in the DORA register comes under European oversight.
Automatically cross-references JON recommendations with your contracts in Odoo, DocuSign or SharePoint to identify clauses that must be renegotiated within 30 days.
Detects DORA / NIS 2 overlap on a single provider and produces a unified obligation matrix ready for your risk committee.
Generates a forward-looking dashboard of potential disruptions: if AWS Frankfurt is hit by an ESA measure, the tool simulates the impact on your critical services based on your dependency mapping.
Produces a timestamped quarterly report opposable to the CSSF, demonstrating that your third-party ICT governance actively integrates signals from the European Lead Overseer.

Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your regulated perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual DORA register, with a free 48h blind audit to measure the exposure of your critical providers before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 91

They trust us

Before we chat