Article 47Cooperation with structures and authorities established by Directive (EU) 2022/2555
1. To foster cooperation and enable supervisory exchanges between the competent authorities designated under this Regulation and the Cooperation Group established by Article 14 of Directive (EU) 2022/2555, the ESAs and the competent authorities may participate in the activities of the Cooperation Group for matters that concern their supervisory activities in relation to financial entities. The ESAs and the competent authorities may request to be invited to participate in the activities of the Cooperation Group for matters in relation to essential or important entities subject to Directive (EU) 2022/2555 that have also been designated as critical ICT third-party service providers pursuant to Article 31 of this Regulation.
2. Where appropriate, competent authorities may consult and share information with the single points of contact and the CSIRTs designated or established in accordance with Directive (EU) 2022/2555.
3. Where appropriate, competent authorities may request any relevant technical advice and assistance from the competent authorities designated or established in accordance with Directive (EU) 2022/2555 and establish cooperation arrangements to allow effective and fast-response coordination mechanisms to be set up.
4. The arrangements referred to in paragraph 3 of this Article may, inter alia, specify the procedures for the coordination of supervisory and oversight activities in relation to essential or important entities subject to Directive (EU) 2022/2555 that have been designated as critical ICT third-party service providers pursuant to Article 31 of this Regulation, including for the conduct, in accordance with national law, of investigations and on-site inspections, as well as for mechanisms for the exchange of information between the competent authorities under this Regulation and the competent authorities designated or established in accordance with that Directive which includes access to information requested by the latter authorities.
DORA, the European Union regulation on digital operational resilience, Article 47
The seam between DORA and NIS2, at the level of authorities. The ESAs and competent authorities may take part in the NIS2 Cooperation Group on matters concerning their supervision of financial entities, and may ask to be invited when it deals with essential or important entities that have also been designated as critical ICT third-party service providers under this Regulation.
Where appropriate, competent authorities may consult and share information with the NIS2 single points of contact and CSIRTs. They may also request technical advice and assistance from the authorities designated under NIS2 and set up cooperation arrangements for effective, fast-response coordination. Those arrangements may cover coordination of supervision and oversight of such providers, including investigations and on-site inspections under national law and information exchange.
For a financial entity the practical point is that DORA being the sector-specific act (Article 1(2)) concerns the obligations, not the whole set of authorities involved. NIS2 structures can be involved, and Article 19(1) lets Member States require major incident notifications to be provided also to NIS2 CSIRTs or competent authorities, so the reporting route can differ by country.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.