{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-07-19","gaps":[],"covered":["EBA Q&A 2023_6950 — Q&A — Request for Clarification on Article 28(3) [Rejected question] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu","title":"EBA Q&A 2023_6950 — Q&A — Request for Clarification on Article 28(3) [Rejected question]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu","status":"rejected question","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 19 July 2024","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6950","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"7b4cb1244799207e","change_date":null,"nearest_versions":["2024-07-19"],"first_text_date":null,"correction_applies":false,"versions":["2024-07-19"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu/versions/2024-07-19","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu/versions/2024-07-19/rev/7b4cb1244799207e","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu/relations","source_line":"Question published in the EBA Q&A tool · no answer · not legislation · published 19 Jul 2024 [Rejected question]","attribution":{"prepared_by":"not stated in the document","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_question","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2024-07-19","question_submitted_on":"2023-12-21","locators":{"published_on":"EBA Q&A register entry 2023_6950, field 'Rejected publishing date'","question_submitted_on":"EBA Q&A register entry 2023_6950, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6950","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/dora/level-3/q-and-a/eba/eba-qa-2023-6950-request-for-clarification-on-article-28-3-of-regulation-eu.md","body_sha256":"33f4b613ddae991dbbbbfc6f6fb86d6ee557b4c02afa629998fadd2f2cea7f53"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2023_6950 — Q&A — Request for Clarification on Article 28(3) [Rejected question]\"\nshortTitle: \"EBA Q&A 2023_6950 — Q&A — Request for Clarification on Article 28(3) [Rejected question]\"\nanswer_id: EBA_QA_2023_6950\nstatus: \"Rejected question\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: withdrawn\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"Article 28(3) DORA\"\ndate: 19 July 2024\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6950\nlifecycle: \"Rejected question\"\ntext_version: \"EBA Q&A register, 19 July 2024\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6950\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"not stated in the document\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Consultancy firm\"\n    locator: \"EBA Q&A register entry 2023_6950: no answer; the register names only the 'Type of submitter'\"\ndocument_type: \"qa_question\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2024-07-19\"\n  question_submitted_on: \"2023-12-21\"\n  locators:\n    published_on: \"EBA Q&A register entry 2023_6950, field 'Rejected publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2023_6950, field 'Submission date'\"\nlifecycle_label: \"Rejected question\"\n---\n\n**Question published in the EBA Q&A tool · no answer · not legislation · published 19 Jul 2024 [Rejected question]**\n\n*Rejected question · EBA Q&A register, 19 July 2024 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6950)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2023_6950 — Q&A — Request for Clarification on Article 28(3) \\[Rejected question\\] |\n| **Prepared by** | Not stated in the document |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2023_6950 |\n| **Document type** | Q&A |\n| **Legal nature** | No answer · not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 19 July 2024; question submitted 21 December 2023 |\n| **Legal basis** | [Article 28(3)](https://www.headlesslaw.com/dora/articles/28) DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Request for Clarification on [Article 28(3)](../../../articles/28.md) of Regulation (EU) 2022/2554**\n\n### Question\n\nI am reaching out for clarification regarding a specific provision in the Digital Operational Resilience Act (DORA) – particularly the third paragraph of Article 28.\n\nThe provision in question stipulates: \"As part of their ICT risk management framework, financial entities shall maintain, and keep updated at entity level as well as at sub-consolidated and consolidated levels, a register of information related to all contractual arrangements on the use of ICT services provided by third-party ICT service providers.\"\n\nSimilarly, DORA provides in its article 28(2): \"The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis\".\n\nOverall, how should we understand the phrases “where relevant” and “where applicable” in DORA and its policy products when addressing different levels of entities?\n\nwe seek your confirmation on whether our client is really obligated to maintain both for its specific entity and at the group level:\n\nThe register of information related to all contractual arrangements on the use of ICT services provided by third-party ICT service providers.\n\nThe strategy on ICT third-party risk and (or?) the policy on the use of ICT services supporting critical or important functions.\n\nCould you also confirm that whenever the phrases \"where relevant\" and \"where applicable\" appear in the presence of corporate group, the latter must each time implement the requirement at the level of the entity, at the sub-consolidated level and at the consolidated level?\n\n### Background\n\nAt Thot-IT Solutions, we are currently advising a client on DORA compliance, specifically focusing on “Chapter V - Managing of ICT third-party risk”. Our client is part of a corporate group comprising two regulated entities. Our consultancy services are engaged with one of these entities, but not with the overarching group entity.\n\n***\n\n### Answer\n\nThis question has been rejected because the objective of the Q&A tool is not to answer questions that put into doubt the correctness of the legal framework, seek a modification of the legal framework or would require such a modification in order to address the question.\n\nThe Single Rule Book Q&A tool has been established to provide explanations and non-binding interpretations on questions relating to the practical application or implementation of the provisions of legislative acts referred to in Article 1(2) of the EBA’s founding Regulation, as well as associated delegated and implementing acts, and guidelines and recommendations, adopted under these legislative acts.\n\nFor further information on the purpose of this tool and on how to submit questions, please see “Additional background and guidance for asking questions”.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6950)\n\n## Related Level 1 articles\n\n- [Article 28 — General principles](../../../articles/28.md)\n"}