Earlier this year the European Commission (Commission) announced that it was rejecting the draft Delegated Regulation supplementing the Digital Operational Resilience Act (DORA) with regard to regulatory technical standards (RTS) on subcontracting ICT services supporting critical or important functions.

The basis of the rejection was that the requirements introduced by Article 5 of the draft RTS on the “Conditions for subcontracting relating to the chain of ICT subcontractors providing a service supporting a critical or important function by the financial entity” went beyond the empowerment given to the European Supervisory Authorities (ESAs) by Article 30(5) of DORA as introducing requirements not specifically linked to the conditions for subcontracting. The Commission considered that Article 5 of the draft RTS and the related recital 5 should be removed to ensure compliance with the mandate set out in DORA.

On 7 March 2025, the ESAs issued an Opinion acknowledging the assessment performed by the Commission and confirmed that the amendments proposed ensure that the draft RTS is in line with the mandate set out under DORA. For this reason, the ESAs do not recommend further amendments to the draft RTS in addition to the ones proposed by the Commission.

The ESAs encourage the Commission to finalise the adoption of the draft RTS without further delay.