Article 41Harmonisation of conditions enabling the conduct of the oversight activities
1. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to specify:
(a) the information to be provided by an ICT third-party service provider in the application for a voluntary request to be designated as critical under Article 31(11);
(b) the content, structure and format of the information to be submitted, disclosed or reported by the ICT third-party service providers pursuant to Article 35(1), including the template for providing information on subcontracting arrangements;
(c) the criteria for determining the composition of the joint examination team ensuring a balanced participation of staff members from the ESAs and from the relevant competent authorities, their designation, tasks, and working arrangements.
(d) the details of the competent authorities’ assessment of the measures taken by critical ICT third-party service providers based on the recommendations of the Lead Overseer pursuant to Article 42(3).
2. The ESAs shall submit those draft regulatory technical standards to the Commission by 17 July 2024.
Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 1 in accordance with the procedure laid down in Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.
DORA, the European Union regulation on digital operational resilience, Article 41
The technical standards that make oversight workable. The ESAs, through the Joint Committee, develop draft regulatory technical standards specifying the information a provider must supply when applying to be designated critical voluntarily; the content, structure and format of information to be submitted, disclosed or reported by providers under Article 35(1), including the template for subcontracting arrangements; the criteria for determining the composition of the joint examination team, ensuring balanced participation, and their designation, tasks and working arrangements; and the details of competent authorities’ assessment of measures taken by critical providers on the basis of the Lead Overseer’s recommendations.
The standards are adopted as Commission Delegated Regulation (EU) 2025/295 (provider information, templates and assessment) and Commission Delegated Regulation (EU) 2025/420 (joint examination teams); check the current texts for amendments.
The subcontracting template is a reporting format between a critical provider and the Lead Overseer: under Article 35(1) the provider sends its subcontracting information to the Lead Overseer using it. Nothing in this Article directs that information to financial entities.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.