If an ICT provider we use is designated critical under DORA, then what changes for us?

Start

A provider we use may be on the European list of critical providers

DORA lets the European Supervisory Authorities designate ICT providers that are critical for financial entities and place them under direct oversight by a Lead Overseer. The oversight is of the provider. Your own duties under DORA stay the same, whether or not your provider is designated. What changes is what you may hear, and what a supervisor may ask of you.

• Then: Are we a financial entity under DORA?

Decision

Are we a financial entity under DORA?

This question is for the customer. If you are the provider, you deal with the Lead Overseer yourself and should take advice. If you are a financial entity, carry on. If you are not sure, settle your scope first.

• Yes: Check every provider in your register against the current list
• No, or not known: Settle what you are first; a provider needs its own advice

Outcome

Settle what you are first; a provider needs its own advice

A financial entity is the audience for this question. A provider that thinks it may be designated, or that supplies financial entities, should start with the flow-down question and take legal advice on the oversight framework. Return here once you know you are the financial entity.

Step

Check every provider in your register against the current list

The authorities publish the list of designated critical ICT providers and update it yearly. Check each provider and subcontractor in the register against it, and write down the date you checked. The first list was published in November 2025. A provider not on the list may still ask to be designated.

• Then: Is any of your providers on the list?

Decision

Is any of your providers on the list?

The list covers only the providers the authorities have designated. Check subcontractors as well as direct providers, since a listed provider can sit behind your direct one.

• Yes, or not known: Confirm the designation with the provider and note the date
• No: None listed: record the check and repeat it at each update

Outcome

None listed: record the check and repeat it at each update

Keep the date and the list version. Repeat the check at each yearly update and when you add a provider. Do not tell a supervisor that your providers are not critical in their own right: the list only says which ones the authorities have designated.

Step

Confirm the designation with the provider and note the date

A designated provider must tell the financial entities it serves of its designation. Ask it in writing, if you have not heard, which of your services are covered, and when oversight starts. Keep the reply with the arrangement.

• Then: Is the provider established outside the Union?

Decision

Is the provider established outside the Union?

A provider established in a third country that is designated critical must set up a subsidiary in the Union within a set period after designation, or financial entities may not go on using it. Ask where it stands. Not known takes the yes branch.

• Yes, or not known: Ask for its plan and date for an EU subsidiary and prepare a fallback
• No: Flag the provider and link every arrangement it supports

Step

Ask for its plan and date for an EU subsidiary and prepare a fallback

Ask the provider when its Union subsidiary will exist and which contracts will move to it. Plan what you would do if it did not meet the period: the exit strategy for the arrangement is where that plan lives. Tell your management body of the dependency.

• Then: Flag the provider and link every arrangement it supports

Step

Flag the provider and link every arrangement it supports

Mark the provider as designated in your register notes or supplier register, with the date of designation. Link it to each arrangement and each function it supports, including those through subcontractors. This is the list a supervisor will ask for.

• Then: Does it support a critical or important function of yours?

Decision

Does it support a critical or important function of yours?

Designation makes oversight of the provider stronger. It does not tell you whether a function of yours is critical. The function list does, and the contract terms and exit plan follow from it.

• Yes, or not known: Check the contract terms, the exit plan and the concentration
• No: Review the provider on its normal cycle

Step

Check the contract terms, the exit plan and the concentration

The extra contract terms for critical or important functions, the exit strategy and the concentration assessment stay your duties. Designation of the provider does not satisfy them. Use the contract review, the exit question and the question on one provider behind many services.

• Then: Has your authority passed on risks from a provider's recommendations?

Step

Review the provider on its normal cycle

Keep the provider in the register with the designation flag. Reassess it with its tier. If it later supports a critical or important function, update your function list and tell your authority, as its route asks.

• Then: Has your authority passed on risks from a provider's recommendations?

Decision

Has your authority passed on risks from a provider's recommendations?

The Lead Overseer can issue recommendations to the provider. Your competent authority passes on to you the risks that those recommendations identify, and you must take those risks into account in managing your third-party risk. Not known: ask your authority.

• Yes: Take the identified risks into account and record what you did
• No, or not known: Keep checking the list and your authority's notices

Step

Keep checking the list and your authority's notices

Ask the provider how it responds to oversight and what it tells customers. Watch for your authority's notices. When one arrives, treat it as a trigger to reassess the arrangement.

• Then: Nothing to change now; the designation is recorded and watched

Outcome

Nothing to change now; the designation is recorded and watched

Keep the check, the confirmation, the flag and the monitoring. Do not say the provider's oversight reduces your own duties, and do not describe the provider as approved by the authorities. Designation is not an endorsement.

Step

Take the identified risks into account and record what you did

Assess your exposure to each risk the authority passed on. Decide whether the contract needs changes, whether a control on your side reduces the risk, or whether the dependency needs a plan to reduce it. Record the decision and the owner.

• Then: Can you show the risks are addressed, in the contract or otherwise?

Decision

Can you show the risks are addressed, in the contract or otherwise?

The authority can ask whether you took the risks into account. If it considers you have not dealt with them, it may notify you that a decision could follow unless appropriate contractual arrangements are in place; you may not have heard that yet. Not known takes the no branch.

• Yes: Risks addressed and recorded; keep watching for the next notice
• No, or not known: Close the gaps and escalate; use any notice period you are given

Outcome

Risks addressed and recorded; keep watching for the next notice

Keep the assessment, the contract changes or controls and the management body's record. Repeat when the next notice or list arrives. Do not state that the recommendations are met by the provider, since you did not receive the outcome from the Lead Overseer.

Step

Close the gaps and escalate; use any notice period you are given

Fix the contract terms or controls that address each risk, and take the gap to the management body at once. If your authority has notified you that a decision may follow, Article 42(4) refers to a decision within 60 calendar days of receipt of that notice, absent appropriate contractual arrangements, so work to 60 days. Make the exit plan real, because as a last resort the authority may require you to suspend or end the use of the service.

• Then: Management body decides: negotiate, reduce reliance or prepare to exit

Outcome

Management body decides: negotiate, reduce reliance or prepare to exit

Put the choice to the management body with the facts, the dates and the cost of each option. If suspension or termination became necessary, the authority must allow time to use your exit plan, which only helps if it exists and has been tested.