Skip to main content
Logo
European Insurance and Occupational Pensions Authority
 

3506 - DORA287

Q&A

Question ID: 3506 - DORA287

Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)

Topic: ICT third-party risk management (DORA)

Article: 28(3)

Status: Rejected

Date of submission: 04 Feb 2026

Question

Art. 28 states that "Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important." How should the change be communicated? By submitting a new Register of Information fully completed for all contracts? Or by submitting the Register including only the rows and templates affected by the change? Alternatively, are there other communication methods to be used instead of the Register?

EIOPA answer

This question has been rejected because it is out of the scope of the Q&A process.