Managing vendors supporting critical or important functions - from zero to full compliance with DORA
A summary of key practical steps based on the draft technical standard.
Complexity and risk considerations include:
Article 1 distinguishes between third-service providers located within an EU member state and those located in a third country (Art 1(c)). As well as those providers who are authorised and supervised by a competent authority in an EU member state and those that are not (Art 1(f)).
A practical way of approaching this foundational article is to:
Differentiate between third parties that are:
And two key questions to ask in connection with the location:
Managing vendors supporting critical or important functions - from zero to full compliance with DORA
A summary of key practical steps based on the draft technical standard.
Thomas Hyrkiel, Katarzyna Parchimowicz5 min read
Your DORA questions answered – Extraterritoriality and interaction with existing rules
This last of a series of six articles covering a practical session organised by Ashurst focuses on how DORA will interact with existing rules as well as its extraterritorial effects.
Thomas Hyrkiel3 min read
Your DORA questions answered – ICT services in scope
This second of a series of six articles covering a practical session organised by Ashurst focuses on the ICT services in scope of DORA.
Thomas Hyrkiel3 min read
Technology
Managing vendors supporting critical or important functions - from zero to full compliance with DORA
Technology
Your DORA questions answered – Extraterritoriality and interaction with existing rules
Technology
Your DORA questions answered – ICT services in scope
The ECB has given eurozone banks until October 31, 2026, to submit plans on how they will strengthen governance and resilience against growing AI-enabled cyberthreats.
Vasilka Lalevska 3 min read
This article examines the key challenges firms have encountered in their DORA compliance journeys and explores some of the practical solutions.
Nathaniel Lalone | Katten Ciara Watson | Katten 16 min read
Joint ESA report also highlights the role of third parties as incident originators and warns about impending risk from AI.
Thomas Hyrkiel 2 min read
Charles Herbert and James Clark discuss the potential for regulatory alignment across two areas of importance – digital law, and financial services regulation.
As regulators move from trialling AI to active oversight, firms face pressure to build governance structures to withstand scrutiny across multiple jurisdictions.
Vlada Gurvich 37 min listen
Norway’s financial infrastructure remains resilient, but rising cyber threats, third-party dependencies, and operational risks are rapidly changing the landscape.
Vasilka Lalevska 4 min read
Joint Committee report underlines cyber risks, ESG data, and consumer protection as core compliance priorities.
Vasilka Lalevska 1 min read
While the digital omnibuses simplify rules, the Commission's Digital Fitness Check assesses the coherence of the EU digital rulebook.
Vasilka Lalevska 3 min read
Further Reading