Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 06 OCTOBER 2023

How Critical Is Critical? – ESAs Publish Technical Advice On Critical Service Provider Designation Under DORA

William Fry LLP
William Fry LLP
Contributor
William Fry LLP

William Fry LLP

William Fry advises leading Irish and international companies, covering both the public and private...

View firm profile
Explore more from William Fry LLP

DORA is due to take effect in January 2025. The effect of DORA on ICT service providers goes to the heart of the third-party risk management objective of DORA.

IrelandFinance and Banking
John O'Connor
John O'Connor
Shane Kelleher
Shane Kelleher
Louise McNabola
Louise McNabola
Author LinkedIn connections

The Digital Operational Resilience Act (DORA) – Information and Communication Technology (ITC) Service Providers

DORA is due to take effect in January 2025. The effect of DORA on ICT service providers goes to the heart of the third-party risk management objective of DORA. We discussed this from the financial entity's point of view in a previous article.

Effect of "Critical" Designation

Under Article 31 of DORA, ICT third-party service providers may be deemed "critical" which brings them within the scope of DORA's new oversight framework. This places one of the European Supervisory Authorities (the EBA, EIOPA and ESMA) (the "ESAs") in the position of 'Lead Overseer' of that service provider, who will oversee the creation and administration of an oversight plan regarding that service provider. A designation of "critical" may be onerous for many service providers so the criterion for designation is paramount.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

CBI Consults On Third-Party Risk

The Central Bank of Ireland has published a consultation paper proposing new guidance on managing third-party risks that extends beyond traditional outsourcing to encompass partnerships, joint ventures, and fintech collaborations. The proposed framework aligns with recent European Banking Authority guidelines and DORA, introducing a lifecycle-based approach with enhanced contractual provisions and broader scope than the 2021 guidance it will replace. Financial entities now face the challenge of identifying
IrelandFinance and Banking
William Fry LLP
William Fry LLP
Article

Final EBA Guidelines On The Sound Management Of Third-party Risk: What Financial Entities Need To Know

The European Banking Authority has published final Guidelines on the sound management of third-party risk regarding non-ICT services, replacing the 2019 Outsourcing Guidelines and introducing a broader regulatory framework. Financial entities will need to navigate expanded scope requirements, enhanced governance standards, and alignment with DORA while managing compliance timelines and contractual obligations.
IrelandFinance and Banking
Arthur Cox
Arthur Cox
Article

Alternative Investment Funds

Ireland offers a sophisticated regulatory framework for Alternative Investment Funds, with structures ranging from ICAVs and Investment Limited Partnerships to Unit Trusts and Common Contractual Funds. The jurisdiction provides flexible options for both retail and institutional investors, with distinct regulatory pathways for RIAIFs, QIAIFs, and ELTIFs, each designed to accommodate different investment strategies and liquidity profiles while maintaining robust investor protections.
IrelandFinance and Banking
K&L Gates
K&L Gates
Article

SFDR 2.0 Trialogue Negotiations: Key Areas Of Focus For Fund Managers

The European Commission's proposed overhaul of the SFDR regime is entering crucial trialogue negotiations, with the Irish Presidency aiming to reach agreement by year-end. While the Council and Parliament have aligned on key issues like professional investor opt-outs, significant divergences remain on exclusion criteria for Transition funds, PAI reporting requirements, and engagement strategy disclosures that will shape the future of sustainable finance regulation.
European UnionFinance and Banking
Dillon Eustace
Dillon Eustace
Article

Ireland’s Data Centre Connections: Back Online

Ireland has lifted its data centre connection moratorium and introduced a demanding new framework requiring developers to provide their own generation capacity, source 80% of electricity from new Irish renewables within six years, and meet strict grid stability requirements. The policy creates significant opportunities for developers who can navigate the complex intersection of grid connection, planning permission, and renewable energy procurement, though a pending legal challenge adds uncertainty to the la
IrelandEnergy and Natural Resources
William Fry LLP
William Fry LLP
Article

Government Legislative Priorities For Autumn 2026

The Government has published its Autumn 2026 Legislation Programme, identifying 32 bills for priority publication and 32 bills for priority drafting. This article explores a selection of measures likely to be of interest to businesses, spanning digital economy, strategic infrastructure, litigation reform, financial regulation, competition law, corporate structures, employment, pensions, and healthcare sectors.
IrelandGovernment, Public Sector
William Fry LLP
William Fry LLP
Article

Data For Sale: Can Insolvent Companies Realise The Value Of Corporate Data?

Spirit Airlines' proposed $10 million sale of a massive de-identified corporate dataset to Google in its Chapter 11 bankruptcy proceedings raises fundamental questions about whether operational business data can be treated as a realisable asset in insolvency. The transaction highlights the legal tension between preserving a dataset's commercial utility and ensuring individuals cannot be identified, particularly when the data maintains referential integrity across multiple systems.
IrelandInsolvency/Bankruptcy/Re-Structuring
William Fry LLP
William Fry LLP
Article

Time Running Out As AI Transparency Guidelines Published

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.
IrelandTechnology
William Fry LLP
William Fry LLP
Article

CBI Consults On Third-Party Risk

The Central Bank of Ireland has published a consultation paper proposing new guidance on managing third-party risks that extends beyond traditional outsourcing to encompass partnerships, joint ventures, and fintech collaborations. The proposed framework aligns with recent European Banking Authority guidelines and DORA, introducing a lifecycle-based approach with enhanced contractual provisions and broader scope than the 2021 guidance it will replace. Financial entities now face the challenge of identifying
IrelandFinance and Banking
William Fry LLP
William Fry LLP