Question ID: DORA 195 - 3209
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: ICT third-party risk management (DORA)
Article: 28
Status: Rejected
Date of submission: 13 Dec 2024
Question
Software is bought as it is from an external provider. The contract specifies no further development, maintenance or support. However, the service provider publishes updates, which can optionally be downloaded by users. Would this constellation represent a DORA ICT-service?
EIOPA answer
This question has been rejected because the matter it refers to has been answered in Q&A 030.