DORA, förordning (EU) 2022/2554 · gäller från 2025-01-17
Tredjepartsrisk och IKT-avtal, DORA art. 28–30
Företaget behåller hela ansvaret när IKT-tjänster köps in. Det ska ha en strategi för tredjepartsrisk, ett register över alla IKT-avtal, granska leverantören före avtal, bedöma koncentrationsrisk och ha avtal med obligatoriska villkor.
Krav
Art. 28(1)(a) Full responsibility remains with the financial entity
financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;
Art. 28(2) Strategy on ICT third-party risk reviewed by the management body (summary)
Financial entities other than microenterprises adopt and regularly review a strategy on ICT third-party risk, including a policy on ICT services supporting critical or important functions; the management body regularly reviews the risks of those arrangements.
Sammanfattning, inte ordagrann text.
Art. 28(3) Register of information on all ICT contracts
As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.
Art. 28(3), third subparagraph Yearly report to the competent authority
Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided.
Art. 28(4) Pre-contract assessment and due diligence (summary)
Before contracting, assess whether the service supports a critical or important function, whether supervisory conditions are met, all relevant risks including concentration risk, due diligence on the provider and conflicts of interest.
Sammanfattning, inte ordagrann text.
Art. 29(1) ICT concentration risk: substitutability and multiple contracts (summary)
For critical or important functions, consider whether the provider is not easily substitutable or whether there are multiple contracts with the same or closely connected providers, and weigh alternative solutions.
Sammanfattning, inte ordagrann text.
Art. 30(1) Rights and obligations in one written contract
The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing.
Art. 30(2) Minimum contract terms (summary)
Every ICT contract includes: service description and subcontracting conditions; service and data locations with advance notice of changes; data protection; data access, recovery and return; service levels; incident assistance; cooperation with authorities; termination rights; participation in security training.
Sammanfattning, inte ordagrann text.
Art. 30(3) Additional terms for critical or important functions (summary)
Contracts for critical or important functions also include precise service level targets, notice and reporting duties, business contingency plans, participation in threat-led penetration testing, unrestricted access, inspection and audit rights, and exit strategies with a mandatory transition period.
Sammanfattning, inte ordagrann text.
Frister
Registret över IKT-avtal rapporteras till myndigheten minst en gång per år. Planerade avtal om kritiska eller viktiga funktioner meddelas i god tid (art. 28.3).
Sanktioner
Art. 50(3)–(4): varje medlemsstat fastställer administrativa sanktioner och åtgärder. Det finns inget gemensamt EU-belopp.
Art. 35(6)–(8): kritiska IKT-leverantörer kan få vite på upp till 1 procent av genomsnittlig daglig global omsättning, i högst sex månader.
No DORA sanction decision with an official public source is in the register yet (DORA applies from 2025-01-17); status not_in_register.
Vem omfattas
Finansiella företag enligt art. 2.1 a–t (20 typer), bland annat banker, betalinstitut, försäkringsbolag, fondbolag, värdepappersbolag och kryptotjänstleverantörer. Spelbolag omfattas inte om de inte också har ett sådant tillstånd.
- Agent:
- agent:eu:dora:agent-dora-art-28-30
- Källa:
- EUR-Lex, läst 2026-10-10
- Noder:
- /graf/dora
Kontrollkopplingar och kopplingar till GDPR, SEC och CCPA finns i NovaCopilot med partnernyckel. Source: NovaCopilot.