Agent · dora-2022-2554-28

DORA artikel 28: General principles

Structural tree: the article's own paragraphs, verbatim.

CELEX 32022R2554 · 2026-08-18 · Weight 86 · minimal-risk

ExtendedOperational weight but lower priority. Metered by volume, not per call, once metering is switched on.

DORAOfficial source

Inputs

• in_scopeThe article applies to the situationboolean
• punktParagraph of the articleenum (1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14)

Rule tree

1. If: alla(in_scope = true, punkt = 1)

   Paragraph 1 applies

   1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles:

   Paragraph 1

2. If: alla(in_scope = true, punkt = 2)

   Paragraph 2 applies

   (a)

   Paragraph 2

3. If: alla(in_scope = true, punkt = 3)

   Paragraph 3 applies

   financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;

   Paragraph 3

4. If: alla(in_scope = true, punkt = 4)

   Paragraph 4 applies

   (b)

   Paragraph 4

5. If: alla(in_scope = true, punkt = 5)

   Paragraph 5 applies

   financial entities’ management of ICT third-party risk shall be implemented in light of the principle of proportionality, taking into account:

   Paragraph 5

6. If: alla(in_scope = true, punkt = 6)

   Paragraph 6 applies

   (i)

   Paragraph 6

7. If: alla(in_scope = true, punkt = 7)

   Paragraph 7 applies

   the nature, scale, complexity and importance of ICT-related dependencies,

   Paragraph 7

8. If: alla(in_scope = true, punkt = 8)

   Paragraph 8 applies

   (ii)

   Paragraph 8

9. If: alla(in_scope = true, punkt = 9)

   Paragraph 9 applies

   the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at group level.

   Paragraph 9

10. If: alla(in_scope = true, punkt = 10)

    Paragraph 10 applies

    2. As part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT third-party risk shall include a policy on the use of ICT serv…

    Paragraph 10

11. If: alla(in_scope = true, punkt = 11)

    Paragraph 11 applies

    3. As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.

    Paragraph 11

12. If: alla(in_scope = true, punkt = 12)

    Paragraph 12 applies

    The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not.

    Paragraph 12

13. If: alla(in_scope = true, punkt = 13)

    Paragraph 13 applies

    Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided.

    Paragraph 13

14. If: alla(in_scope = true, punkt = 14)

    Paragraph 14 applies

    Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity.

    Paragraph 14

If no rule matches: The article is not stated to apply, or no paragraph is selected. The agent abstains rather than guesses.

The article text as read

1. 11. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles:
2. 2(a)
3. 3financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;
4. 4(b)
5. 5financial entities’ management of ICT third-party risk shall be implemented in light of the principle of proportionality, taking into account:
6. 6(i)
7. 7the nature, scale, complexity and importance of ICT-related dependencies,
8. 8(ii)
9. 9the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at group level.
10. 102. As part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis. The management body shall, on the basis of an assessment of the overall risk profile of the financial entity and the scale and complexity of the business services, regularly review the risks identified in respect to contractual arrangements on the use of ICT services supporting critical or important functions.
11. 113. As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.
12. 12The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not.
13. 13Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided.
14. 14Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity.

No legal advice. Deterministisk regeluppslagning. Ingen juridisk rådgivning, inget efterlevnadsbeslut, ingen bedömning av ett enskilt ärende.

Citation: 32022R2554 art. 28, General principles. ExploreWorld Legal, https://legal.exploreworldai.com/agent/dora-2022-2554/artikel-28 (hämtad 2026-08-18, bevis sha256:3f560103b08d1d2a, bygge legal-2026-08-25).