Question ID: 3506 - DORA287
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: ICT third-party risk management (DORA)
Article: 28(3)
Status: Rejected
Date of submission: 04 Feb 2026
Question
Art. 28 states that "Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important." How should the change be communicated? By submitting a new Register of Information fully completed for all contracts? Or by submitting the Register including only the rows and templates affected by the change? Alternatively, are there other communication methods to be used instead of the Register?
EIOPA answer
This question has been rejected because it is out of the scope of the Q&A process.