Question ID: 3486 - DORA285
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: ICT third-party risk management (DORA), Oversight framework of CTPPs (DORA), Register of Information (DORA)
Article: 3(21)
Status: Rejected
Date of submission: 16 Dec 2025
Question
Could you please clarify whether contracts with mobile network operators that include IP based communication, mobile data services or software enabled call management functionalities should be considered contracts for third party ICT services under DORA?
Background of the question
In the context of Regulation (EU) 2022/2554 on digital operational resilience, we seek EIOPA’s clarification on the treatment of services provided by mobile network operators to financial entities. Mobile operators commonly provide a combination of services, including traditional voice telephony, mobile data transmission, SIP connections, IP telephony, call management platforms and other digitally enabled communication services. While DORA clarifies that analogue telecommunications are not considered ICT services, it remains unclear how mixed or bundled telecommunications services should be assessed in practice.