ESMA · ESMA_QA_2057 Question Rejected

Software companies

Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
Article
On Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers as mandated by Regulation (EU)
Topic
ICT third-party risk management
Submitted
2023-12-20
More Q&As on this regulation →

Question

How can DORA Article 28 be applied on software companies when the financial entity purchases off-the-shelf software licenses? If the off-the-shelf software supports critical or important function, should the DORA Article 28 (8) be applied?
No answer published yet.
View original on European Securities and Markets Authority ↗

This Q&A is published by European Securities and Markets Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Other DORA topics

Answered 2025-11-20

Other DORA topics

Answered 2024-06-28

ICT third-party risk management (DORA)

Answered 2025-11-21

Other DORA topics

Answered 2025-11-20

Other DORA topics

Answered 2025-07-24

More Q&As on this topic

Audit frequency limitations

Answered 2025-09-18

direct agreements between AIF and ICT service provider

Answered 2025-02-26

Application of DORA for outsourced critical services that are not ICT

Answered 2024-02-12

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.