{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":null,"checked_against":null},"truncation":{"shown":25,"total":25,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/32","url":"https://www.headlesslaw.com/dora/articles/32","title":"Article 32 — Structure of the Oversight Framework","work_id":"dora","date_state":"past","as_of":"2025-01-17","relations_url":"https://www.headlesslaw.com/dora/articles/32/relations"},"as_of":"2025-01-17","counts":{"uses_term:out":12,"refers_to:out":7,"refers_to:in":5,"guides:in":1},"relations":[{"edge_id":"3f4424aed08cc424914f","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Joint Committee","dst_raw":"eu.dora.definition.joint-committee","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/62","url":"/definitions/dora/joint-committee","title":"Definitions","key":"3(62)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.3"}},{"edge_id":"7f1f00b7a0faa071f30e","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical ICT third-party service providers","dst_raw":"eu.dora.definition.critical-ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/23","url":"/definitions/dora/critical-ict-third-party-service-provider","title":"Definitions","key":"3(23)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.3"}},{"edge_id":"e9e5f977682363ce8a9f","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 56(1)","dst_raw":"eu.dora.article.56","other":{"work_id":"dora","level":"L1","locator":"dora/art/56","url":"/dora/articles/56","title":"Data Protection","key":"56","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.3"}},{"edge_id":"4cd9e03c97ca19ac7662","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 31(1)","dst_raw":"eu.dora.article.31","other":{"work_id":"dora","level":"L1","locator":"dora/art/31","url":"/dora/articles/31","title":"Designation of critical ICT third-party service providers","key":"31","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.1"}},{"edge_id":"6babed635f8de19a3725","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Joint Committee","dst_raw":"eu.dora.definition.joint-committee","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/62","url":"/definitions/dora/joint-committee","title":"Definitions","key":"3(62)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.1"}},{"edge_id":"afbab1e7af499cd0bc3a","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 57(1)","dst_raw":"eu.dora.article.57","other":{"work_id":"dora","level":"L1","locator":"dora/art/57","url":"/dora/articles/57","title":"Exercise of the delegation","key":"57","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.1"}},{"edge_id":"b2b62fec5820839a4e8e","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT third-party risk","dst_raw":"eu.dora.definition.ict-third-party-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/18","url":"/definitions/dora/ict-third-party-risk","title":"Definitions","key":"3(18)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.1"}},{"edge_id":"edb8b66b784768f01de6","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Lead Overseer","dst_raw":"eu.dora.definition.lead-overseer","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/61","url":"/definitions/dora/lead-overseer","title":"Definitions","key":"3(61)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.1"}},{"edge_id":"2182f3e6c05ae41e0abe","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"digital operational resilience","dst_raw":"eu.dora.definition.digital-operational-resilience","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/1","url":"/definitions/dora/digital-operational-resilience","title":"Definitions","key":"3(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.2"}},{"edge_id":"7e8bb2b8f357afd3cb42","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical ICT third-party service providers","dst_raw":"eu.dora.definition.critical-ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/23","url":"/definitions/dora/critical-ict-third-party-service-provider","title":"Definitions","key":"3(23)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.2"}},{"edge_id":"c9b4cf7c3a08521b1039","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"ICT concentration risk","dst_raw":"eu.dora.definition.ict-concentration-risk","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/29","url":"/definitions/dora/ict-concentration-risk","title":"Definitions","key":"3(29)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.2"}},{"edge_id":"09d68810de9eea86472b","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 35(1)","dst_raw":"eu.dora.article.35","other":{"work_id":"dora","level":"L1","locator":"dora/art/35","url":"/dora/articles/35","title":"Powers of the Lead Overseer","key":"35","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.7"}},{"edge_id":"d53ea54aed7107ecb4f2","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical ICT third-party service providers","dst_raw":"eu.dora.definition.critical-ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/23","url":"/definitions/dora/critical-ict-third-party-service-provider","title":"Definitions","key":"3(23)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.7"}},{"edge_id":"eede77ca1e9ce2520681","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 16","dst_raw":"eu.dora.article.16","other":{"work_id":"dora","level":"L1","locator":"dora/art/16","url":"/dora/articles/16","title":"Simplified ICT risk management framework","key":"16","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.7"}},{"edge_id":"dca41b695b36465e2bab","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Lead Overseer","dst_raw":"eu.dora.definition.lead-overseer","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/61","url":"/definitions/dora/lead-overseer","title":"Definitions","key":"3(61)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.5"}},{"edge_id":"96977ef397055832eff6","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"Joint Committee","dst_raw":"eu.dora.definition.joint-committee","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/62","url":"/definitions/dora/joint-committee","title":"Definitions","key":"3(62)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.9"}},{"edge_id":"ba78058b4850b47a7914","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 46","dst_raw":"eu.dora.article.46","other":{"work_id":"dora","level":"L1","locator":"dora/art/46","url":"/dora/articles/46","title":"Competent authorities","key":"46","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.4.point.b"}},{"edge_id":"6d9057574a9b8ca5e071","scope":"unit","type":"uses_term","direction":"out","resolution":"resolved","basis":"curated_link_pass","method":"extracted_relationships","confidence":"high","src_from":"2022-12-27","src_until":null,"span":"critical ICT third-party service provider","dst_raw":"eu.dora.definition.critical-ict-third-party-service-provider","other":{"work_id":"dora","level":"L1","locator":"dora/art/3/para/23","url":"/definitions/dora/critical-ict-third-party-service-provider","title":"Definitions","key":"3(23)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.4.point.e"}},{"edge_id":"e36e304cb83817bbf3d0","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 46","dst_raw":"eu.dora.article.46","other":{"work_id":"dora","level":"L1","locator":"dora/art/46","url":"/dora/articles/46","title":"Competent authorities","key":"46","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.32","source_block_id":"eu.dora.article.32.paragraph.4.point.d"}},{"edge_id":"064ad93e0234c902232c","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 32(1)","dst_raw":"eu.dora.article.32","other":{"work_id":"dora","level":"L1","locator":"dora/art/31/para/1","url":"/dora/articles/31#p-1","title":"Designation of critical ICT third-party service providers","key":"31(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.31","source_block_id":"eu.dora.article.31.paragraph.1"}},{"edge_id":"27b3dbf91a1ee3148491","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 32(4)","dst_raw":"eu.dora.article.32","other":{"work_id":"dora","level":"L1","locator":"dora/art/43/para/1","url":"/dora/articles/43#p-1","title":"Oversight fees","key":"43(1)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.43","source_block_id":"eu.dora.article.43.paragraph.1"}},{"edge_id":"7bf04a47903e8e09a089","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 32(4)","dst_raw":"eu.dora.article.32","other":{"work_id":"dora","level":"L1","locator":"dora/art/42/para/9","url":"/dora/articles/42#p-9","title":"Follow-up by competent authorities","key":"42(9)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.42","source_block_id":"eu.dora.article.42.paragraph.9"}},{"edge_id":"9d1a7d48225635f53e5d","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 32","dst_raw":"eu.dora.article.32","other":{"work_id":"dora","level":"L1","locator":"dora/art/31/para/10","url":"/dora/articles/31#p-10","title":"Designation of critical ICT third-party service providers","key":"31(10)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.31","source_block_id":"eu.dora.article.31.paragraph.10"}},{"edge_id":"bb16bcb285336ac47108","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2022-12-27","src_until":null,"span":"Article 32(4)","dst_raw":"eu.dora.article.32","other":{"work_id":"dora","level":"L1","locator":"dora/art/40/para/2/pt/c","url":"/dora/articles/40#p-2-c","title":"Ongoing oversight","key":"40(2)(c)","state_on_date":"in_force"},"evidence":{"object":"eu.dora.legal_text.article.40","source_block_id":"eu.dora.article.40.paragraph.2.point.c"}},{"edge_id":"f7d0e7e2343132b15ed2","scope":"unit","type":"guides","direction":"in","resolution":"resolved","basis":"curated_mapping","method":"stated_legal_basis","confidence":"curated","src_from":"2024-07-17","src_until":null,"span":null,"dst_raw":"eu.dora.article.32","other":{"work_id":"spaces/dora/level-3/guidelines/jc-gl-2024-36-oversight-cooperation","level":"L3","locator":"spaces/dora/level-3/guidelines/jc-gl-2024-36-oversight-cooperation/page","url":"/dora/level-3/guidelines/jc-gl-2024-36-oversight-cooperation","title":"Guideline — Oversight cooperation and information exchange [final]","key":"JC/GL/2024/36","state_on_date":"in_force"},"evidence":{"evidence":"legal_basis: Article 32(7) DORA","doc_type":"guideline"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}