EC Publishes Draft Delegated Regulation On Subcontracting RTS Under DORA

On March 24 2025, the European Commission (EC) adopted the final draft Delegated Regulation setting out Regulatory Technical Standards (RTS) for subcontracting ICT services supporting critical or important functions under the Digital Operational Resilience Act (DORA). This follows an opinion issued by the European Supervisory Authorities (ESAs), as previously reported in our DP update of March 20 2025, and if the European Parliament or the Council of the EU raise no objections, the draft RTS will come into effect on the 20th day following its publication in the Official Journal of the European Union.

The RTS is a delegated regulation intended to supplement DORA. The provision of ICT services to financial entities often depends on a complex chain of ICT subcontractors and ICT third-party service providers may enter into one or more subcontracting arrangements with other ICT third-party service providers. Indirect reliance on ICT subcontractors may have an impact on