European Commission Rejects Draft Regulatory Technical Standards on ICT Subcontracting

The European Commission has communicated its rejection of the draft Regulatory Technical Standards (RTS) on subcontracting ICT services supporting critical or important functions supplementing the Digital Operational Resilience Act (DORA).  In its communication, the Commission held that the European Supervisory Authorities (ESAs) exceeded their mandate under Article 30(5) of DORA (which came into effect on 17 January 2025) by introducing requirements not specifically linked to the conditions for subcontracting in Article 5 of the RTS.

The Commission has made it clear that Article 5 and the related recital 5 of the draft RTS must be omitted from the draft RTS to ensure compliance with the DORA mandate. A six-week period to consider the Commission’s proposals and amend the draft RTS has been granted to the ESAs. Should the ESAs fail to submit an amended version of the draft RTS or provide a version which does not align with the Commission’s proposals, the Commission has reserved its right to adopt the RTS with its own amendments or reject the RTS in their entirety.

This decision has created legal uncertainty across the EU, including Malta. In particular, financial entities and ICT service providers that have already implemented the draft RTS in their contractual arrangements have now been placed in a difficult position since amending of the said contracts is likely to be required in the weeks ahead.

Mamo TCV will be closely monitoring the situation. To receive updates on this important development and related news please visit our website and consider subscribing to our newsletter.