EU regulatory register · DORA
Article 36Exercise of the powers of the Lead Overseer outside the Union
CELEX 32022R2554 · Read on 2026-08-18
Short answer
1. When oversight objectives cannot be attained by means of interacting with the subsidiary set up for the purpose of Article 31(12), or by exercising oversight activities on premises located in the Union, the Lead Overseer may exercise the powers, referred to in the following provisions, on any premises located in a third-country which is owned, or used …
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-36 · Short answer as data · Official text
DORA, digital operational resilience in short
Financial entities must manage ICT risk, report major ICT incidents, test resilience and govern ICT providers by contract.
- Who is covered by DORA?
- What does Article 30 require in ICT contracts?
- How fast must an ICT incident be reported?
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. When oversight objectives cannot be attained by means of interacting with the subsidiary set up for the purpose of Article 31(12), or by exercising oversight activities on premises located in the Union, the Lead Overseer may exercise the powers, referred to in the following provisions, on any premises located in a third-country which is owned, or used in any way, for the purposes of providing services to Union financial entities, by a critical ICT third-party service provider, in connection with its business operations, functions or services, including any administrative, business or operational offices, premises, lands, buildings or other properties:
(a)
in Article 35(1), point (a); and
(b)
in Article 35(1), point (b), in accordance with Article 38(2), points (a), (b) and (d), and in Article 39(1) and (2), point (a).
The powers referred to in the first subparagraph may be exercised subject to all of the following conditions:
(i)
the conduct of an inspection in a third-country is deemed necessary by the Lead Overseer to allow it to fully and effectively perform its duties under this Regulation;
(ii)
the inspection in a third-country is directly related to the provision of ICT services to financial entities in the Union;
(iii)
the critical ICT third-party service provider concerned consents to the conduct of an inspection in a third-country; and
(iv)
the relevant authority of the third-country concerned has been officially notified by the Lead Overseer and raised no objection thereto.
The article continues in the official text.
Follow-up questions
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit