Luxembourg's Insurance Commission aligns outsourcing rules with DORA and repeals cloud outsourcing circulars

Luxembourg's Insurance Commission (CAA) has amended its requirements for outsourcing important or critical operational activities and functions to reflect the Digital Operational Resilience Act (DORA). Circular Letter 26/11 updates Circular Letter 22/16 and its notification form, with the amendments applying from Jan. 1, 2027. It also repeals the separate cloud outsourcing circulars 20/13 and 21/15 with immediate effect, following the withdrawal of the underlying European Insurance and Occupational Pensions Authority guidelines. DORA has already applied to entities within its scope since Jan. 17, 2025. The revised framework adds a notification form section requiring insurers and reinsurers to conduct additional due diligence and ensure additional contractual provisions for information and communication technology (ICT) providers, particularly where services depend on chains of ICT subcontractors. The written confirmation required within two months of signing an outsourcing contract must cover this additional due diligence and may be provided by the compliance officer and/or an authorized manager. The amendments also expressly include agreements with providers in the same group where they affect the Luxembourg entity, and refine disclosures on subcontractors performing important or critical activities or functions. The updated circular must be read alongside DORA and its technical standards on ICT contractual policies and subcontracting. Outsourcing documentation requirements remain alongside DORA reporting obligations, complementing the CAA's existing framework for major ICT incident notifications and registers of information.