{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-12-17","gaps":[],"covered":["ESMA Q&A 2379 — Q&A — Art. 1 ust. 1 DORA - systems supporting the business [Question Rejected] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes","title":"ESMA Q&A 2379 — Q&A — Art. 1 ust. 1 DORA - systems supporting the business [Question Rejected]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes","status":"question rejected","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 17 December 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2379","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"c99ac75cf4bc1622","change_date":null,"nearest_versions":["2024-12-17"],"first_text_date":null,"correction_applies":false,"versions":["2024-12-17"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes/versions/2024-12-17","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes/versions/2024-12-17/rev/c99ac75cf4bc1622","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes/relations","source_line":"Question published in the ESMA Q&A tool · no answer · not legislation [Question Rejected]","attribution":{"prepared_by":"not stated in the document","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_question","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"question_submitted_on":"2024-12-17","locators":{"question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2379, column 'Date of submission'"}},"adoption":null}},"provenance":{"official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2379","check":{"result":"matched","checked_at":"2026-10-26","against":"the ESMA publication"},"repo_path":"spaces/dora/level-3/q-and-a/esma/esma-qa-2379-art-1-ust-1-dora-systems-supporting-the-business-processes.md","body_sha256":"143a45db639119009c54e2f7a57b1c843ffa31727f38241f522780bf1f9094df"},"units":[],"markdown":"---\ntitle: \"ESMA Q&A 2379 — Q&A — Art. 1 ust. 1 DORA - systems supporting the business [Question Rejected]\"\nshortTitle: \"ESMA Q&A 2379 — Q&A — Art. 1 ust. 1 DORA - systems supporting the business [Question Rejected]\"\nanswer_id: ESMA_QA_2379\ntopic: \"Other DORA topics\"\nstatus: \"Question Rejected\"\ntype: qa\ninstrument_type: qa\nauthority: ESMA\nbinding: false\nbinding_character: non_binding\nlegal_status: withdrawn\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"DORA\"\ndate: 17 December 2024\nsource_link: https://www.esma.europa.eu/publications-data/questions-answers/2379\nlifecycle: \"Question Rejected\"\ntext_version: \"ESMA Q&A register, 17 December 2024\"\nsource_url: \"https://www.esma.europa.eu/publications-data/questions-answers/2379\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the ESMA publication\"\nsource:\n  prepared_by: \"not stated in the document\"\n  published_by: \"ESMA\"\n  published_in: \"ESMA Q&A tool\"\n  evidence:\n    prepared_by: \"ESMA_QA_2379\"\n    locator: \"ESMA Q&A entry ESMA_QA_2379: no answer; no author named\"\ndocument_type: \"qa_question\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  question_submitted_on: \"2024-12-17\"\n  locators:\n    question_submitted_on: \"ESMA Q&A Excel export ESMA_QA_2379, column 'Date of submission'\"\nlifecycle_label: \"Question Rejected\"\n---\n\n**Question published in the ESMA Q&A tool · no answer · not legislation [Question Rejected]**\n\n*Question Rejected · ESMA Q&A register, 17 December 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2379)*\n\n| | |\n|---|---|\n| **Full title** | ESMA Q&A 2379 — Q&A — Art. 1 ust. 1 DORA - systems supporting the business \\[Question Rejected\\] |\n| **Prepared by** | Not stated in the document |\n| **Published by** | ESMA, in the ESMA Q&A tool |\n| **Reference** | ESMA_QA_2379 |\n| **Document type** | Q&A |\n| **Legal nature** | No answer · not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Question submitted 17 December 2024 |\n| **Legal basis** | DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the ESMA publication |\n\n**Art. 1 ust. 1 DORA - systems supporting the business processes of financial entities**\n\n### Question\n\nFinancial entities select ICT service providers based on risk assessment, taking into account the business continuity plan and a number of national and sectoral regulations regarding cybersecurity. In addition to standard contractual relationships with entrepreneurs, there are also solutions that financial entities use:\n\na) on the basis of a license, e.g. open source. The license provisions are not negotiated, and the service is not individually parameterized for the investment company. The investment company has no influence on the shape of the service and the license provisions. The licenses contain provisions regarding automatic update of the tool, but do not contain provisions regarding, e.g. support or SLA, e.g. Adobe Acrobat Reader;\n\nb) web applications, e.g. Lex/Legalis systems (review of legal acts), which employees access via a browser, the agreement does not involve installing the application on the employee's computer, but only providing a specified number of licenses for use by the company, or a web system for registering correspondence in the case of ordering a courier;\n\nc) providers of employee benefits, e.g. medical care. They are not directly related to the company's business, employees use the application on private devices and log in with a private email address, while registration is necessary for the medical company to create an account for the employee;\n\nIs it possible to apply the principle of proportionality, provided for in the DORA regulations, which will allow for proper identification of risks and the application of proportionate mitigants in the case of the above-mentioned services? In the opinion of the financial entity, the application of all the obligations indicated in the DORA regulations, in particular those concerning contractual provisions and reporting obligations, is disproportionate to the risk generated by the above solutions. The financial entity does not deny the need for each case of evaluation of the solution and review of its correct functioning, the number of entities in relation to which these obligations would have to be performed may affect the quality of the duties performed.\n\nAre the services supporting a critical or important function all the services used as part of performing this function, including those that are quickly and relatively cheaply replaceable (e.g. Adobe Acrobat Reader, 7ZIP, e-mail encryption program)?\n\n***\n\n**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2379)\n"}