{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-42",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-42)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-25",
    "fingerprint": "ewai:eu:933768",
    "proof": "sha256:8ac1ede7c45777383944b22ffe29bcc448282333113b8c47ff4159d85ef88798",
    "jurisdiction": "eu"
  },
  "brand_source": "Source: NovaCopilot",
  "object_type": "article_agent",
  "schema_version": "1.0.0",
  "id": "agent:eu:dora:art-42",
  "act": "dora-2022-2554",
  "article": "42",
  "text_sha256": "71b4830c97ed6b2a7a8e0ac0eaee8f50fe50010acfc7d17f0c237e600304cb9d",
  "obligations": [],
  "agent": "agent:eu:dora",
  "name": "NovaCopilot DORA Agent, Article 42",
  "title": {
    "en": "Follow-up by competent authorities",
    "sv": "Behöriga myndigheters uppföljning",
    "de": "Folgemaßnahmen zuständiger Behörden"
  },
  "text": {
    "lang": "en",
    "paragraphs": [
      "1. Within 60 calendar days of the receipt of the recommendations issued by the Lead Overseer pursuant to Article 35(1), point (d), critical ICT third-party service providers shall either notify the Lead Overseer of their intention to follow the recommendations or provide a reasoned explanation for not following such recommendations. The Lead Overseer shall immediately transmit this information to the competent authorities of the financial entities concerned.",
      "2. The Lead Overseer shall publicly disclose where a critical ICT third-party service provider fails to notify the Lead Overseer in accordance with paragraph 1 or where the explanation provided by the critical ICT third-party service provider is not deemed sufficient. The information published shall …",
      "The Lead Overseer shall notify the ICT third-party service provider of that public disclosure.",
      "3. Competent authorities shall inform the relevant financial entities of the risks identified in the recommendations addressed to critical ICT third-party service providers in accordance with Article 35(1), point (d).",
      "When managing ICT third-party risk, financial entities shall take into account the risks referred to in the first subparagraph.",
      "4. Where a competent authority deems that a financial entity fails to take into account or to sufficiently address within its management of ICT third-party risk the specific risks identified in the recommendations, it shall notify the financial entity of the possibility of a decision being taken, within 60 calendar days of the receipt of such notification, pursuant to paragraph 6, in the absence of appropriate contractual arrangements aiming to address such risks.",
      "5. Upon receiving the reports referred to in Article 35(1), point (c), and prior to taking a decision as referred to in paragraph 6 of this Article, competent authorities may, on a voluntary basis, consult the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider.",
      "6. Competent authorities may, as a measure of last resort, following the notification and, if appropriate, the consultation as set out in paragraph 4 and 5 of this Article, in accordance with Article 50, take a decision requiring financial entities to temporarily suspend, either in part or completel …",
      "7. Where a critical ICT third-party service provider refuses to endorse recommendations, based on a divergent approach from the one advised by the Lead Overseer, and such a divergent approach may adversely impact a large number of financial entities, or a significant part of the financial sector, an …",
      "8. Upon receiving the reports referred to in Article 35(1), point (c), competent authorities, when taking a decision as referred to in paragraph 6 of this Article, shall take into account the type and magnitude of risk that is not addressed by the critical ICT third-party service provider, as well as the seriousness of the non-compliance, having regard to the following criteria:",
      "(a)",
      "the gravity and the duration of the non-compliance;",
      "(b)",
      "whether the non-compliance has revealed serious weaknesses in the critical ICT third-party service provider’s procedures, management systems, risk management and internal controls;"
    ],
    "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022R2554",
    "read_at": "2026-08-18"
  },
  "sha256": "638edee4dd98f40f38865ff00bb591cf9c63f258f11807a7a0fed0f034bd0a74",
  "duties": [],
  "applies_to_role": {
    "status": "not_in_register",
    "roles": []
  },
  "applies_to_industry": {
    "status": "derived",
    "industries": [
      "banking",
      "insurance"
    ]
  },
  "cross_industry_chains": {
    "status": "not_in_register",
    "chains": []
  },
  "revenue_exposure": {
    "status": "not_in_register",
    "reason": "member_state_penalties",
    "sanction_article": "50",
    "source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
    "via": "article 50"
  },
  "links": {
    "article_page": "https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-42",
    "regulation_agent": "https://legal.exploreworldai.com/api/public/v1/article-agents?reg=dora",
    "changes": "https://legal.exploreworldai.com/api/public/v1/intelligence-graph/change?reg=dora"
  },
  "llm_used": false,
  "hash": "sha256:8ac1ede7c45777383944b22ffe29bcc448282333113b8c47ff4159d85ef88798",
  "version": "legal-2026-10-25",
  "expires": "2026-10-26T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-25+legal-2026-10-25+2026-10-25T12:13:04",
    "content_hash": "sha256:8ac1ede7c45777383944b22ffe29bcc448282333113b8c47ff4159d85ef88798",
    "revalidate_after": "2026-10-25T14:32:00.382Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/article-agent?id=agent%3Aeu%3Adora%3Aart-42",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Källregister. Endast information, inte juridisk rådgivning och ingen bedömning av ett enskilt ärende.",
    "kinds": {
      "official_text": "Officiell källtext, ordagrann och ej tolkad",
      "summary": "Sammanfattning, ej juristgranskad. Läs alltid källtexten",
      "classification": "Automatisk märkning ur källans egen text, ej juristgranskad"
    },
    "rule": "Endast fält märkta official_text är lagens egen lydelse. Allt annat pekar på den.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "_sweep_notice": {
    "mode": "citation",
    "reason": "corpus sweep without measurable return",
    "vendor": "Anthropic",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/article-agent",
    "full_text": "https://legal.exploreworldai.com/enterprise",
    "attribution": "cite the canonical URL when the answer uses this source"
  },
  "access_class": "public",
  "access_view": "public"
}