Art.28 ICT third-party risk: general principles

Financial entities manage ICT third-party risk as part of ICT risk inside the ICT risk management framework, remain fully responsible for their obligations when they use ICT services, and apply proportionality according to the nature and importance of ICT dependencies and the criticality of each service. They keep a register of information on all ICT service arrangements at entity, sub-consolidated and consolidated level, distinguishing those supporting critical or important functions; report at least yearly to the authority on new arrangements, provider categories, contract types and services; provide the full register or sections of it on request; and inform the authority in time of planned arrangements for critical or important functions. Before contracting they assess criticality, supervisory conditions, risks including concentration, due diligence and conflicts of interest; they use only providers meeting appropriate security standards, set risk-based audit frequencies, ensure contracts can be terminated in the listed cases, and keep tested exit strategies for services supporting critical or important functions. The ICT third-party risk strategy with its policy on critical or important functions (Art. 28(2)) is required only of entities other than Article 16(1) entities and microenterprises.

Source: DORA (Regulation (EU) 2022/2554), Art.28. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.