--- title: "Article 40 — Ongoing oversight" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 40 — Ongoing oversight" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 40 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. When conducting oversight activities, in particular general investigations or inspections, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) shall be assisted by a joint examination team established for each [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider). 2. The joint examination team referred to in paragraph 1 shall be composed of staff members from: **(a)** the ESAs; **(b)** the relevant competent authorities supervising the financial entities to which the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) provides [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services); **(c)** the national competent authority referred to in [Article 32(4), point (e)](32.md), on a voluntary basis; **(d)** one national competent authority from the Member State where the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) is established, on a voluntary basis. Members of the joint examination team shall have expertise in ICT matters and in operational risk. The joint examination team shall work under the coordination of a designated [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) staff member (the ‘[Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) coordinator’). 3. Within 3 months of the completion of an investigation or inspection, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer), after consulting the Oversight Forum, shall adopt recommendations to be addressed to the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) pursuant to the powers referred to in [Article 35](35.md). 4. The recommendations referred to in paragraph 3 shall be immediately communicated to the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) and to the competent authorities of the financial entities to which it provides [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services). For the purposes of fulfilling the oversight activities, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) may take into consideration any relevant third-party certifications and ICT third-party internal or external audit reports made available by the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider). *** [Chapter V — Managing of ICT third-party risk](../chapters/v.md) › Section II — Oversight Framework of critical ICT third-party service providers · [← Article 39](39.md) · [Article 41 →](41.md)