I need to bring my Luxembourg organisation into compliance with recital 99 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 99 DORA — Recital 99 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 99

Digital Operational Resilience Act · UE 2022/2554

(99)

Regulatory technical standards should ensure the consistent harmonisation of the requirements laid down in this Regulation. In their roles as bodies endowed with highly specialised expertise, the ESAs should develop draft regulatory technical standards which do not involve policy choices, for submission to the Commission. Regulatory technical standards should be developed in the areas of ICT risk management, major ICT-related incident reporting, testing, as well as in relation to key requirements for a sound monitoring of ICT third-party risk. The Commission and the ESAs should ensure that those standards and requirements can be applied by all financial entities in a manner that is proportionate to their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. The Commission should be empowered to adopt those regulatory technical standards by means of delegated acts pursuant to Article 290 TFEU and in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

Luxembourg specificity

CSSF Circular 24/847 on ICT incident reporting and Circulars 22/806 / 17/656 on outsourcing

In Luxembourg, the CSSF is the competent authority supervising DORA and its RTS for credit institutions, PFS, investment firms, UCITS, AIFMs and payment institutions, while the CAA supervises insurance and reinsurance undertakings. The CSSF has published Circular 24/847 on ICT incident reporting, directly aligned with the RTS on classification adopted under recital 99, and has updated its outsourcing framework (Circulars 22/806 and 17/656) to align with the DORA RTS on critical subcontracting.

Luxgap practice: we maintain a living mapping matrix between CSSF/CAA circulars and published DORA RTS, embedded in the Standards Radar, to avoid duplicate reporting and identify national requirements layered on top of EU RTS.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 99 announces a cascade of Regulatory Technical Standards (RTS) adopted by the Commission on proposals from the ESAs (EBA, EIOPA, ESMA). In practice, the CSSF supervises not the raw DORA text but the stack of RTS + ITS + joint guidelines issued by the ESAs. Luxembourg financial entities that only read the base regulation miss roughly 80% of the operational technical obligations (incident classification matrix, register of ICT arrangements, TLPT scenarios, cloud exit policy).

The proportionality principle trap

Recital 99 explicitly requires RTS to be applied proportionately to size and overall risk profile. It is a powerful argument before the CSSF, but it must be earned: each calibration must be documented with objective metrics.

Map the published RTS (JC 2023/83, JC 2023/86, Delegated Regulation 2024/1772 on incident classification, RTS on the information register, RTS on critical subcontracting).
Trace for each requirement the level of application chosen and the proportionality justification.
Continuously monitor ESA updates on ESMA, EBA and EIOPA, as well as the regularly published Q&A.
Update the framework as soon as a new RTS enters into application (typically T+20 days after publication in the OJEU).

How Luxgap automates this risk

Our Luxgap DORA Standards Radar turns DORA regulatory watch into an operational stream injected directly into your compliance framework. The tool monitors in real time the publications of the three ESAs, the OJEU and the CSSF, and a specialised LLM agent reads each new RTS/ITS to extract automatically the technical requirements applicable to your entity, cross-referencing your profile (size, segment, supervisor) to calibrate proportionality.

Continuously monitors EBA, EIOPA, ESMA, CSSF and OJEU pages via API and detects any new DORA publication within 4 hours.
Classifies each RTS, ITS or joint guideline based on its impact on your framework (ICT risk management, incident reporting, TLPT, register of arrangements).
Generates an automated gap analysis between your internal policies (ISMS, business continuity plan, CSSF notification procedure) and the newly published technical requirements.
Computes a documented proportionality score for each requirement, defensible before the CSSF during a prudential review.
Produces a timestamped remediation plan with concrete actions, regulatory deadlines and assigned internal owners.
Alerts compliance and CISO teams via Teams or email whenever an RTS enters into application with less than 30 days notice.

Available as a complement to a Luxgap CISO or DPO mandate or as a standalone SaaS module depending on your scope. Request a demonstration on your real data and our teams run a free 48-hour blank audit to map your exposure to the DORA RTS already published before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 99

They trust us

Before we chat