Regulatory Alerts2024-10-24
Added · Updated
Commission Delegated Regulation (EU) 2025/295 on regulatory technical standards for oversight of critical ICT third-party service providers
The European Commission adopts regulatory technical standards supplementing Regulation (EU) 2022/2554 to harmonize conditions for overseeing critical ICT third-party service providers. The regulation mandates specific information disclosures for voluntary designation applications, including market share estimates and corporate structures, and requires critical providers to submit remediation plans and progress reports to the Lead Overseer. It further establishes detailed reporting obligations regarding subcontracting, governance, security, and data location, while defining protocols for information sharing between Lead Overseers and competent authorities.
Topics
Share