{"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/40","url":"https://www.headlesslaw.com/dora/articles/40","title":"Article 40 — Ongoing oversight","family":"l1_hand","work_id":"dora","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":"2025-01-17","application":{"state":"applicable","next":null,"dates":[{"at":"2025-01-17","note":"Article 64"}]},"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"a9dd2bc1b1ca2349","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/articles/40/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/articles/40/versions/2022-12-27/rev/a9dd2bc1b1ca2349","versions_url":"https://www.headlesslaw.com/dora/articles/40/versions","relations_url":"https://www.headlesslaw.com/dora/articles/40/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","check":{"result":"matched","checked_at":"2026-11-09","against":"EUR-Lex"},"repo_path":null,"body_sha256":"91a51487b4ef1ee26abf5c9a3ed5259fb484ebfc56302482d412d942e10f08e4","markdown_sha256":"3dea0bca8540695135336d21a901b81e6b7895736055b084b7e8752fcf4f08cb"},"units":[{"locator":"dora/art/40","kind":"article","status":"in_force","label":null,"heading":"Ongoing oversight","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"dora/art/40/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"When conducting oversight activities, in particular general investigations or inspections, the Lead Overseer shall be assisted by a joint examination team established for each critical ICT third-party service provider.","marks":[],"revision":1,"text_hash":"953deec7d795cf6cfcf459a23946cb4b46a1bcdd9f969840afb9c1fcc760373e","reason":null},{"locator":"dora/art/40/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"The joint examination team referred to in paragraph 1 shall be composed of staff members from:","marks":[],"revision":1,"text_hash":"24b7919c196887144e6e87f07f20b538b3b884c2bf5e1b6d6d3c69bae820afbc","reason":null},{"locator":"dora/art/40/para/2/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"the ESAs;","marks":[],"revision":1,"text_hash":"1e966fb84f88d789c8acb092d7484581277fa35067066f7663d46d5db5bc565d","reason":null},{"locator":"dora/art/40/para/2/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"the relevant competent authorities supervising the financial entities to which the critical ICT third-party service provider provides ICT services;","marks":[],"revision":1,"text_hash":"64885a5e0a36d399ace9ada7e4caa4911ad37c355d032054aa4899f568c77be0","reason":null},{"locator":"dora/art/40/para/2/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"the national competent authority referred to in Article 32(4), point (e), on a voluntary basis;","marks":[],"revision":1,"text_hash":"6730315d6a42567bbaa28fde6963b95c351f8a4fc89b1715a4186a3c5528b582","reason":null},{"locator":"dora/art/40/para/2/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"one national competent authority from the Member State where the critical ICT third-party service provider is established, on a voluntary basis.","marks":[],"revision":1,"text_hash":"92266e6428d39993b61177e29d13c20b3b25367102429c14bc5cf3fda993f426","reason":null},{"locator":"dora/art/40/para/2/cont/1","kind":"continuation","status":"in_force","label":null,"heading":null,"text":"Members of the joint examination team shall have expertise in ICT matters and in operational risk. The joint examination team shall work under the coordination of a designated Lead Overseer staff member (the ‘Lead Overseer coordinator’).","marks":[],"revision":1,"text_hash":"08673cde002ba75b6749d0654dd3b57953285fc7daad647638701371b6352710","reason":null},{"locator":"dora/art/40/para/3","kind":"paragraph","status":"in_force","label":"3.","heading":null,"text":"Within 3 months of the completion of an investigation or inspection, the Lead Overseer, after consulting the Oversight Forum, shall adopt recommendations to be addressed to the critical ICT third-party service provider pursuant to the powers referred to in Article 35.","marks":[],"revision":1,"text_hash":"5cbb78dcdc4ccf3ca13f84e737492871fa87642baf7ab867f62557e07af7f59d","reason":null},{"locator":"dora/art/40/para/4","kind":"paragraph","status":"in_force","label":"4.","heading":null,"text":"The recommendations referred to in paragraph 3 shall be immediately communicated to the critical ICT third-party service provider and to the competent authorities of the financial entities to which it provides ICT services.","marks":[],"revision":1,"text_hash":"6072c7f11d274e26d26707a14df811fd3affac4056f914b4d336f3b6733f1a42","reason":null},{"locator":"dora/art/40/para/4/cont/1","kind":"continuation","status":"in_force","label":null,"heading":null,"text":"For the purposes of fulfilling the oversight activities, the Lead Overseer may take into consideration any relevant third-party certifications and ICT third-party internal or external audit reports made available by the critical ICT third-party service provider.","marks":[],"revision":1,"text_hash":"9716d57c35ed421bb704488522461006f83fbf29fb904a99d5886304abeb6f02","reason":null}],"markdown":"*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*\n\n1. <a id=\"p-1\"></a>When conducting oversight activities, in particular general investigations or inspections, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) shall be assisted by a joint examination team established for each [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider).\n2. <a id=\"p-2\"></a>The joint examination team referred to in paragraph 1 shall be composed of staff members from:\n\n    <a id=\"p-2-a\"></a>**(a)** the ESAs;\n\n    <a id=\"p-2-b\"></a>**(b)** the relevant competent authorities supervising the financial entities to which the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) provides [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services);\n\n    <a id=\"p-2-c\"></a>**(c)** the national competent authority referred to in [Article 32(4), point (e)](32.md), on a voluntary basis;\n\n    <a id=\"p-2-d\"></a>**(d)** one national competent authority from the Member State where the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) is established, on a voluntary basis.\n\n    Members of the joint examination team shall have expertise in ICT matters and in operational risk. The joint examination team shall work under the coordination of a designated [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) staff member (the ‘[Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) coordinator’).\n3. <a id=\"p-3\"></a>Within 3 months of the completion of an investigation or inspection, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer), after consulting the Oversight Forum, shall adopt recommendations to be addressed to the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) pursuant to the powers referred to in [Article 35](35.md).\n4. <a id=\"p-4\"></a>The recommendations referred to in paragraph 3 shall be immediately communicated to the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) and to the competent authorities of the financial entities to which it provides [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services).\n\n    For the purposes of fulfilling the oversight activities, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) may take into consideration any relevant third-party certifications and ICT third-party internal or external audit reports made available by the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider).\n\n***\n\n[Chapter V — Managing of ICT third-party risk](../chapters/v.md) › Section II — Oversight Framework of critical ICT third-party service providers · [← Article 39](39.md) · [Article 41 →](41.md)\n"}