{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-02-11","gaps":[],"covered":["ESMA Q&A 2103 — Q&A — EUC, EULA and Shadow IT [Answer Published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it","title":"ESMA Q&A 2103 — Q&A — EUC, EULA and Shadow IT [Answer Published]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it","status":"answer published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 11 February 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2103","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"21bf920c0229cef7","change_date":null,"nearest_versions":["2024-02-11"],"first_text_date":null,"correction_applies":false,"versions":["2024-02-11"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it/versions/2024-02-11","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it/versions/2024-02-11/rev/21bf920c0229cef7","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it/relations","source_line":"Answer by ESMA, published in its Q&A tool · not legislation · published 11 Feb 2024 [Answer Published]","attribution":{"prepared_by":"ESMA","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2024-02-11","question_submitted_on":"2024-02-11","locators":{"published_on":"ESMA Q&A Excel export ESMA_QA_2103, column 'Esma responses', date line","question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2103, column 'Date of submission'"}},"adoption":null}},"provenance":{"official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2103","check":{"result":"matched","checked_at":"2026-10-26","against":"the ESMA publication"},"repo_path":"spaces/dora/level-3/q-and-a/esma/esma-qa-2103-euc-eula-and-shadow-it.md","body_sha256":"d99f5fe48f5e329267325630cd1372e90b4fd8b15967b4edf2592d5c2d696270"},"units":[],"markdown":"---\ntitle: \"ESMA Q&A 2103 — Q&A — EUC, EULA and Shadow IT [Answer Published]\"\nshortTitle: \"ESMA Q&A 2103 — Q&A — EUC, EULA and Shadow IT [Answer Published]\"\nanswer_id: ESMA_QA_2103\ntopic: \"ICT risk management\"\nstatus: \"Answer Published\"\ntype: qa\ninstrument_type: qa\nauthority: ESMA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"DORA\"\ndate: 11 February 2024\nsource_link: https://www.esma.europa.eu/publications-data/questions-answers/2103\nlifecycle: \"Answer Published\"\ntext_version: \"ESMA Q&A register, 11 February 2024\"\nsource_url: \"https://www.esma.europa.eu/publications-data/questions-answers/2103\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the ESMA publication\"\nsource:\n  prepared_by: \"ESMA\"\n  published_by: \"ESMA\"\n  published_in: \"ESMA Q&A tool\"\n  evidence:\n    prepared_by: \"ESMA Answer\"\n    locator: \"ESMA Q&A entry ESMA_QA_2103: field 'ESMA Answer', no 'Answer provided by' line\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2024-02-11\"\n  question_submitted_on: \"2024-02-11\"\n  locators:\n    published_on: \"ESMA Q&A Excel export ESMA_QA_2103, column 'Esma responses', date line\"\n    question_submitted_on: \"ESMA Q&A Excel export ESMA_QA_2103, column 'Date of submission'\"\nlifecycle_label: \"Answer Published\"\n---\n\n**Answer by ESMA, published in its Q&A tool · not legislation · published 11 Feb 2024 [Answer Published]**\n\n*Answer Published · ESMA Q&A register, 11 February 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2103)*\n\n| | |\n|---|---|\n| **Full title** | ESMA Q&A 2103 — Q&A — EUC, EULA and Shadow IT \\[Answer Published\\] |\n| **Prepared by** | ESMA |\n| **Published by** | ESMA, in the ESMA Q&A tool |\n| **Reference** | ESMA_QA_2103 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 11 February 2024; question submitted 11 February 2024 |\n| **Legal basis** | DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the ESMA publication |\n\n**EUC, EULA and Shadow IT**\n\n### Question\n\nFor complying with the regulatory provisions envisaged by the DORA Regulation, Financial Entities should consider End User Computing (EUC) tools, End User License Agreements (EULA), and the conditions of Shadow IT.\n\nWould it be possible to obtain the regulatory references for these areas?\n\n***\n\n### Answer\n\nAccording to the broad definition of ICT asset under [Article 3(7)](../../../articles/3.md) of DORA, EUC tools are considered ICT assets since they are software or hardware used in the network and information systems of the financial entity. The same apply for the software governed by the EULA and the ICT systems developed and managed by users outside the ICT function (shadow IT). Therefore, all management, security, and risk assessment provisions of DORA related to ICT assets should apply to EUC tools, software governed by EULAs and Shadow IT. This includes identifying, documenting, and managing these assets to mitigate any associated risks.\n\nIn addition, According to Article 11, Paragraph (2), point (c) of the Commission Delegated Regulation (CDR) (EU) 2024/1774 (RTS on RMF), a financial entity should identify the security measures to ensure that only authorised software is installed in ICT systems and endpoint devices. This means that all ICT systems implemented need to be authorised; the financial entity should implement all necessary technical and organizational measures to this effect.\n\nAlso, Article 16, Paragraph (9) of the RTS on RMF emphasizes that procedures related to ICT systems' acquisition, development, and maintenance must also apply to ICT systems developed or managed by users outside the official ICT function, using a risk-based approach. Under DORA, all ICT assets must be identified, documented, and managed to ensure they meet the entity's ICT risk management requirements. This means financial entities must ensure that their ICT risk management and control processes cover the ICT systems developed and managed by users outside the ICT function and EUC practices, ensuring all software and hardware is implemented in an authorised way and is securely integrated and operated within the organization's ICT infrastructure The risks that such a practice can pose should be also appropriately identified and managed, as per the [Article 6](../../../articles/6.md) and [Article 8](../../../articles/8.md) Paragraph (2) of DORA respectively.\n\nRegarding the EULA, if an EULA is a contractual agreement between a third-party service provider, as defined by [Article 3(19)](../../../articles/3.md) of DORA and the financial entity, and the software governed by this EULA is installed on an ICT asset of the financial entity or used to support business functions of the financial entity, then all provisions of Regulation (EU) 2022/2554 regarding ICT risk management, including third-party risk management, apply. This scenario includes the use of authorised software governed by the EULA even if the terms of the EULA are accepted by the employee of the financial entity on behalf of the financial entity.\n\nWe understand there could be cases where the EULAs is not subject to specific third-party risk management provisions as above. Nevertheless, they would be anyway subject to the ICT risk management requirements, because the software provided under these agreements is often customised and maintained internally by the financial entity or involves minimal interaction with external service providers. The emphasis is on managing ICT risks directly related to the software's use and all the relevant DORA provisions should apply.\n\n***\n\n**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2103)\n"}