{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-28","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-28)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-02","fingerprint":"ewai:eu:ce0366","proof":"sha256:9869ba0a74e179eab5b06520020acb096cca7a9c0a19b9f0173b2d0ee06bb550","jurisdiction":"eu"},"brand_source":"Source: NovaCopilot","object_type":"article_agent","schema_version":"1.0.0","id":"agent:eu:dora:art-28","act":"dora-2022-2554","article":"28","text_sha256":"e9b2347518218392384c60f142d301e5234b6cad2b065d75f1b4ace8ad643791","obligations":["obligation:eu:dora-2022-2554-art-28-financial-entity"],"agent":"agent:eu:dora","name":"NovaCopilot DORA Agent, Article 28","title":{"en":"General principles","sv":"Allmänna principer","de":"Allgemeine Prinzipien"},"text":{"lang":"en","paragraphs":["1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles:","(a)","financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;","(b)","financial entities’ management of ICT third-party risk shall be implemented in light of the principle of proportionality, taking into account:","(i)","the nature, scale, complexity and importance of ICT-related dependencies,","(ii)","the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at group level.","2. As part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred …","3. As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.","The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not.","Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided.","Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity."],"source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022R2554","read_at":"2026-08-18"},"sha256":"2e792f19c3588df6fdfd11f7adbced381e7de6329ae6661d9390df59211da0c8","duties":[{"id":"obligation:eu:dora-2022-2554-art-28-financial-entity","role":"financial-entity","duty":"Manage ICT third-party risk and keep a register of information on all ICT service contracts."}],"applies_to_role":{"status":"verified","roles":["financial-entity"],"entity_types":[{"role":"credit-institution","parent_role":"financial-entity","article":"2(1)(a)"},{"role":"payment-institution","parent_role":"financial-entity","article":"2(1)(b)"},{"role":"account-information-service-provider","parent_role":"financial-entity","article":"2(1)(c)"},{"role":"electronic-money-institution","parent_role":"financial-entity","article":"2(1)(d)"},{"role":"investment-firm","parent_role":"financial-entity","article":"2(1)(e)"},{"role":"crypto-asset-service-provider","parent_role":"financial-entity","article":"2(1)(f)"},{"role":"central-securities-depository","parent_role":"financial-entity","article":"2(1)(g)"},{"role":"central-counterparty","parent_role":"financial-entity","article":"2(1)(h)"},{"role":"trading-venue","parent_role":"financial-entity","article":"2(1)(i)"},{"role":"trade-repository","parent_role":"financial-entity","article":"2(1)(j)"},{"role":"aifm","parent_role":"financial-entity","article":"2(1)(k)"},{"role":"management-company","parent_role":"financial-entity","article":"2(1)(l)"},{"role":"data-reporting-service-provider","parent_role":"financial-entity","article":"2(1)(m)"},{"role":"insurer","parent_role":"financial-entity","article":"2(1)(n)"},{"role":"insurance-intermediary","parent_role":"financial-entity","article":"2(1)(o)"},{"role":"iorp","parent_role":"financial-entity","article":"2(1)(p)"},{"role":"credit-rating-agency","parent_role":"financial-entity","article":"2(1)(q)"},{"role":"critical-benchmark-administrator","parent_role":"financial-entity","article":"2(1)(r)"},{"role":"crowdfunding-service-provider","parent_role":"financial-entity","article":"2(1)(s)"},{"role":"securitisation-repository","parent_role":"financial-entity","article":"2(1)(t)"}]},"applies_to_industry":{"status":"derived","industries":["banking","insurance"]},"cross_industry_chains":{"status":"not_in_register","chains":[]},"revenue_exposure":{"status":"not_in_register","reason":"member_state_penalties","sanction_article":"50","source_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj","via":"article 50"},"links":{"article_page":"https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-28","regulation_agent":"https://legal.exploreworldai.com/api/public/v1/article-agents?reg=dora","changes":"https://legal.exploreworldai.com/api/public/v1/intelligence-graph/change?reg=dora"},"llm_used":false,"hash":"sha256:9869ba0a74e179eab5b06520020acb096cca7a9c0a19b9f0173b2d0ee06bb550","version":"legal-2026-11-02","expires":"2026-11-04T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-02+legal-2026-11-02+2026-11-02T16:22:18","content_hash":"sha256:9869ba0a74e179eab5b06520020acb096cca7a9c0a19b9f0173b2d0ee06bb550","revalidate_after":"2026-11-03T04:19:35.862Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-28","disclaimer":"Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.","content_notice":{"legal_advice":false,"nature":"Källregister. Endast information, inte juridisk rådgivning och ingen bedömning av ett enskilt ärende.","kinds":{"official_text":"Officiell källtext, ordagrann och ej tolkad","summary":"Sammanfattning, ej juristgranskad. Läs alltid källtexten","classification":"Automatisk märkning ur källans egen text, ej juristgranskad"},"rule":"Endast fält märkta official_text är lagens egen lydelse. Allt annat pekar på den.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/article-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T03:19:35.976Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-28","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":2449}}