DORA: Final RTS On ICT Subcontracting Published

DORA

Following extensive consultations, a rejection, and amendments, the European Commission has finally published the long-awaited Regulatory Technical Standards ("RTS") on ICT subcontracting under the Digital Operational Resilience Act ("DORA"). This final adoption marks a significant milestone in the winding journey towards regulatory clarity for financial entities and their respective ICT third-party service providers.

As previously discussed in our earlier articles, the original draft RTS encountered substantial scrutiny, particularly regarding provisions on monitoring ICT subcontracting chains, ultimately leading to their rejection by the Commission (previously explored here). Subsequently, the European Supervisory Authorities issued an opinion endorsing amendments proposed by the Commission, confirming alignment with the original DORA mandate (further discussed here).