Is a hosted AI tool “outsourcing” under CSSF Circular 22/806?
For a CSSF-supervised entity the answer is usually yes — with the due diligence, register entry and notification duties that follow. Here is where the line runs, and how to stay on the right side of it.
What the circular covers
Circular CSSF 22/806 on outsourcing arrangements applies to credit institutions, investment firms, PSFs, payment and e-money institutions and fund managers under CSSF supervision. It treats any arrangement where a service provider performs a process, service or activity the entity would otherwise perform itself as outsourcing — and ICT outsourcing, including cloud, as a category with its own conditions.
A hosted generative-AI service that reads your documents and returns analysis fits that definition squarely: a third party is performing a process on your data, on its infrastructure.
What it then requires
Before signing: a risk assessment and due diligence on the provider, including sub-outsourcing chains and data location. During: a written agreement with audit and access rights, an entry in the outsourcing register, business-continuity and exit arrangements. For critical or important functions — which AI applied to client files can easily become — prior notification to the CSSF.
Cloud outsourcing adds the circular’s cloud-specific conditions, including knowing where data is processed and by whom.
Why an appliance changes the analysis
An on-premise appliance is hardware you own or exclusively rent, running open-weight models inside your infrastructure. No service provider performs the processing; no data leaves your perimeter. There is no outsourcing arrangement to assess, register or notify — only an IT asset to manage under your existing ICT-risk framework.
The vendor relationship that remains — installation, updates, support — is a conventional supplier contract, comparable to buying a server with a maintenance plan, and does not by itself involve access to client data.
Engineering guidance, not legal advice. We work alongside your DPO and counsel.
Official sources
See it on your own documents.
Thirty minutes on your use case, against a sample of your kind of files. We come to you.