§ DORA · Article 32

DORA Article 32: Obligations, Deadlines & Penalties

Regulation (EU) 2022/2554, Article 32 · All obligations · DORA
At a glance
Article 32 of the DORA imposes 12 obligations on ESAs, Joint Committee, Member State and 1 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations

All obligations under Article 32

Obligation 1
The Joint Committee shall establish the Oversight Forum as a sub-committee to support the work of the Joint Committee and the Lead Overseer in the area of ICT third-party risk. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Joint Committee
Sector scope
financial sectors
Action required
establish
Deadline
Penalty
Obligation 2
The Oversight Forum shall prepare the draft joint positions and the draft common acts of the Joint Committee in the area of ICT third-party risk. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
prepare
Deadline
Penalty
Obligation 3
The Oversight Forum shall regularly discuss relevant developments on ICT risk and vulnerabilities and promote a consistent approach in the monitoring of ICT third-party risk at Union level. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
discuss
Deadline
Penalty
Obligation 4
The Oversight Forum shall, on a yearly basis, undertake a collective assessment of the results and findings of the oversight activities conducted for all critical ICT third-party service providers. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
assess
Deadline
yearly basis
Penalty
Obligation 5
The Oversight Forum shall promote coordination measures to increase the digital operational resilience of financial entities, foster best practices on addressing ICT concentration risk and explore mitigants for cross-sector risk transfers. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
promote
Deadline
Penalty
Obligation 6
The Oversight Forum shall submit comprehensive benchmarks for critical ICT third-party service providers to be adopted by the Joint Committee as joint positions of the ESAs. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Sector scope
financial sectors
Action required
submit
Deadline
Penalty
Obligation 7
Each Member State shall designate the relevant competent authority whose staff member shall be the high-level representative referred in paragraph 4, point (b). Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Member State
Action required
designate
Deadline
Penalty
Obligation 8
Each Member State shall inform the Lead Overseer of the designation of the relevant competent authority. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Member State
Action required
notify
Deadline
Penalty
Obligation 9
The ESAs shall publish on their website the list of high-level representatives from the current staff of the relevant competent authority designated by Member States. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
ESAs
Action required
publish
Deadline
Penalty
Obligation 10
The Oversight Forum shall appoint independent experts from a pool of experts selected following a public and transparent application process. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
Oversight Forum
Action required
appoint
Deadline
Penalty
Obligation 11
The ESAs shall issue guidelines on the cooperation between the ESAs and the competent authorities covering detailed procedures for task allocation and information exchanges. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
ESAs
Action required
issue
Deadline
17 July 2024
Penalty
Obligation 12
The ESAs, through the Joint Committee, shall, on a yearly basis, submit a report on the application of this Section to the European Parliament, the Council and the Commission. Regulation (EU) 2022/2554, Article 32, Article 32
Obligated entity
ESAs
Action required
report
Deadline
yearly basis
Penalty
§ Frequently asked

Questions about Article 32

Who must comply with Article 32 of the DORA? +
ESAs, Joint Committee, Member State, Oversight Forum.
What does Article 32 of the DORA require? +
establish prepare discuss
What is the compliance deadline for DORA Article 32? +
17 July 2024; yearly basis
Need a cross-border briefing on DORA Article 32?
Search Fontvera ↵
All EU obligation pages  ·  All DORA articles