CLAIM-2026-08-28-07

DORA Article 28(3) requires financial entities to maintain and update, at entity level and at sub-consolidated and consolidated levels, a register of information on all contractual arrangements for the use of ICT services provided by ICT third-party service providers, distinguishing those covering critical or important functions.

Why it matters

The register is the artefact a supervisor asks for. An agent roster that grows inside a platform changes what belongs in it without any procurement event.

Sources

• eurlex2022regulatio