<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/recitals/28","url":"https://www.headlesslaw.com/dora/recitals/28","title":"Recital 28","family":"l1_recital_view","work_id":"dora","view_of":"/dora/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"content_id":"fb7b05b15f3a9680","versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/recitals/28/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/recitals/28/versions/2022-12-27/rev/fb7b05b15f3a9680","versions_url":"https://www.headlesslaw.com/dora/recitals/28/versions","relations_url":"https://www.headlesslaw.com/dora/recitals/28/relations","act_url":"https://www.headlesslaw.com/dora/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"dora","path":"/dora/recitals","name":"DORA","number":"Regulation (EU) 2022/2554","celex":"32022R2554","title_official":null,"document_date":null},"position":{"kind":"recital","key":"28","index":28,"articles":106,"annexes":0},"prev":{"path":"/dora/recitals/27","key":"27","title":"Recital 27"},"next":{"path":"/dora/recitals/29","key":"29","title":"Recital 29"},"act_anchor":""}}} -->
# Recital 28

*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*

The extensive use of ICT services is evidenced by complex contractual arrangements, whereby financial entities often encounter difficulties in negotiating contractual terms that are tailored to the prudential standards or other regulatory requirements to which they are subject, or otherwise in enforcing specific rights, such as access or audit rights, even when the latter are enshrined in their contractual arrangements. Moreover, many of those contractual arrangements do not provide for sufficient safeguards allowing for the fully-fledged monitoring of subcontracting processes, thus depriving the financial entity of its ability to assess the associated risks. In addition, as ICT third-party service providers often provide standardised services to different types of clients, such contractual arrangements do not always cater adequately for the individual or specific needs of financial industry actors.