What the DORA subcontracting RTS asks of your organization when an ICT provider subcontracts
Your organization must make the subcontracting decision before the ICT provider can use a subcontractor for a service that supports a critical or important function. Commission Delegated Regulation (EU) 2025/532, adopted on 24 March 2025 and published in the Official Journal on 2 July 2025, supplements DORA Article 30(5) and sets the conditions you check before you allow it. The risk it targets is a chain of subcontractors you cannot see, assess or stop. A cloud platform may rely on a hosting company, which relies on a network operator, and a failure several links down can disrupt a function you have classified as critical without your ever having reviewed that link. The regulation treats this as a question for the financial entity, not a footnote in the provider's paperwork.
What usually makes this hard is ownership. The provider holds the subcontractor relationship, and its contract with you may be the only document you have. Yet Article 3 requires you to confirm that the provider can select, monitor and identify its subcontractors, that you will receive equivalent access and inspection rights, and that you have assessed location risk, concentration risk and the impact of a subcontractor failure. Article 3 also states that relying on the provider's own assessment does not reduce your responsibility. Before you contract, ask the provider for a written list of the subcontracted services, their locations and the controls it has checked at each link, then decide whether your own review is enough or whether you need to test the most sensitive links directly.
The split of responsibilities should be explicit. Your organization owns the decision, the contract terms and the periodic re-assessment that Article 3 requires as your business environment changes. An implementation partner such as DeployOpen can help you prepare the evidence, document the subcontracting map and configure monitoring of your self-hosted platforms, but it does not approve subcontractors on your behalf or certify the arrangement. Only an independent auditor or assessor issues a report on your controls. Confirm with your legal and compliance teams how the provider's subcontracting clauses map to Article 4 and Articles 5 and 6 before you negotiate, since the notice period for material changes and your termination rights depend on wording that is easy to miss.
Which subcontracting arrangements and systems the RTS reaches
The RTS applies only once an ICT service is tied to a critical or important function, so scoping starts with the function classification and then follows the contract and provider chain beneath it. Each card below marks a decision point where a subcontractor can fall inside or outside the regulation, and where the owning team should confirm the answer against its own register and policy.
Classify the supported function first
The RTS only reaches ICT services that support a critical or important function. Start with the function classification recorded in the entity's own register and policy, then trace each ICT service back to the function it supports. Risk and the business function should agree on that link before procurement checks any subcontractor. Where classification is unclear, confirm the decision in writing rather than assuming the service is out of scope.
Map contracts and provider chains
Identify every contract that carries a critical or important service, then list the providers beneath the direct supplier. Procurement usually holds the contracts, but the chain often sits in provider disclosures, sub-processor lists and architecture diagrams. Record each layer so that a subcontractor added three levels down is still visible to the entity when it is assessed.
Cloud hosting and infrastructure layers
Cloud hosting, colocation and managed networks often bring in subcontractors for facilities, hardware, backup or regional support. Ask the direct provider which of these layers can change the location, control or operator of data supporting a critical function. These are the points where location risk and concentration risk, which the RTS asks the entity to assess, are most likely to shift without a contract update.
Managed operations and support desks
Managed monitoring, patching and service desks frequently use offshore teams, follow-the-sun rotas or specialist firms. Each of these can gain access to systems supporting a critical function. Confirm whether the provider's support model depends on a third party, who can access production data from that party, and whether the entity's audit and inspection rights reach those teams.
Intra-group providers and shared services
Intra-group providers are still ICT third-party providers when they supply ICT services to the entity, and they can hold their own subcontractors. A group hosting team or shared security operations centre may therefore pull external firms into scope without the entity's knowledge. Confirm the group arrangement in writing and treat its subcontractors with the same scrutiny as any external chain.
Decision owners and sign-off
Scope decisions need named owners. Risk typically owns the classification and the location and concentration assessments, procurement owns the contract and notice terms, the business function confirms which processes depend on the service, and the ICT function confirms technical access and data flows. Record who approved each scope decision and when it was last reviewed, because the RTS expects periodic reassessment as the environment changes.
How the Article 3 risk assessment must be done before the contract is signed
The Article 3(1) decision comes before the contract, not after it. Under Delegated Regulation (EU) 2025/532, the financial entity must decide, before it contracts for an ICT service supporting a critical or important function, whether the provider may subcontract any part of that service. That decision is only defensible if the entity has confirmed several things first: that the provider can select, monitor and identify its subcontractors; that the entity will get equivalent access and inspection rights over those subcontractors; and that the provider's own assessment covers location risk, concentration risk and the impact of a subcontractor failure on the service. In practice, the risk owner should be able to point to a written record for each of these points, dated before signature. If the provider cannot answer one of them, the gap belongs in the decision, not in a later exception.
The provider's assessment is an input the entity must test, not a substitute for its own judgment. Article 3(3) is explicit that relying on the provider's assessment of its subcontractors does not reduce the entity's responsibility. A practical check is to ask the provider for the actual list of subcontractors in the chain, the countries where data and support are delivered, and the other customers that depend on the same subcontractor. Where several providers share one underlying subcontractor, the concentration question has to be answered at that layer as well. Confirm with the provider how it will tell you when its subcontractor map changes, because the contract and the risk assessment are only as current as that notification.
The assessment is also a standing duty. Article 3(2) requires the entity to repeat the relevant parts of the risk assessment periodically and whenever its business environment changes, such as a new location for a subcontractor, a merger in the provider's supply chain, or a new critical function placed on the same service. Assign an owner for this review and tie it to the events that should trigger it, so the record kept at signature stays accurate for the life of the contract. The output of each review feeds directly into the approval or objection decision on material changes, so the same register and evidence should support both.
How an assessor tests subcontracting decisions and contract terms
This table compares each subcontracting element of Delegated Regulation (EU) 2025/532 with how a competent authority tests it, the evidence it requests and the findings that recur in weak files. Read it as a checklist of what a reviewer samples, since DORA provides no certification scheme and the outcome is a supervisory review rather than an attestation.
| Test element | Evidence requested and what a reviewer samples | Common findings in weak files |
|---|---|---|
| Pre-contract subcontracting decision (Article 3(1)) | Documented decision on whether the provider may subcontract, with the conditions confirmed before signature. Reviewers sample contracts for ICT services supporting critical or important functions. | Decision taken after signature, or recorded as a general yes with no conditions tested. |
| Provider capability to select, monitor and identify subcontractors | Evidence of the provider's selection criteria, monitoring reports and subcontractor register. Reviewers ask how the entity would learn of a new subcontractor. | Entity accepts the provider's statement without seeing any monitoring output. |
| Equivalent access and inspection rights | Clauses granting the entity access and inspection rights over subcontractors, and records of any exercise. Reviewers check whether rights reach the subcontractor chain. | Audit rights stop at the direct provider with no flow-down to subcontractors. |
| Location and concentration risk assessment | Written assessment of where subcontracted services run and how many critical services depend on the same subcontractor. Reviewers compare it against the register of information. | Location recorded as the provider's head office, with no data center or concentration analysis. |
| Impact of subcontractor failure and periodic reassessment (Article 3(2) and (3)) | Dated reassessments triggered by changes in the business environment, with a reasoned conclusion. Reviewers look for a reassessment after a material change. | One-time assessment never repeated, or reliance on the provider's own assessment without the entity's review. |
| Contract identification of services and conditions (Article 4(1)) | Contract schedule naming which services may be subcontracted and the conditions attached. Reviewers check that the schedule matches the decision record. | Generic wording such as 'subcontracting permitted' with no services or conditions named. |
| Pass-down of contingency, security and audit requirements | Flow-down clauses in subcontractor agreements or provider commitments to pass these requirements on. Reviewers request copies of at least one subcontractor term set. | Requirements stated for the provider only, with no evidence they reach subcontractors. |
| Notification and approval or objection during the notice period (Articles 4 and 5) | Notice periods for material changes, the entity's approval or objection record, and proof that changes waited for approval or the end of the period. Reviewers sample a change log against notices. | Changes implemented before notice ended, or no record of who approved or objected. |
| Termination trigger (Article 6) | Termination rights covering changes implemented despite objection, changes before the notice period ends, and unauthorized subcontracting of a critical service. Reviewers confirm the rights exist and are exercisable. | Termination right missing, or limited to breach with no link to subcontracting changes. |
How to implement the subcontracting controls, step by step
This sequence turns the subcontracting requirements of Delegated Regulation (EU) 2025/532 into a working control set, from knowing which services are in scope to ending a provider relationship when the rules are breached.
Inventory critical or important ICT services and provider chains
The organization owns this step. List every ICT service that supports a critical or important function, then record the direct provider and, as far as the provider will disclose, each subcontractor beneath it, including the location where each one processes or stores data. Assign an accountable owner for each service and confirm the inventory with the business function it supports. The step is done when every in-scope service has a named owner, a documented provider chain and a date of last review. An implementation partner can design the inventory template, load existing contract and register data, and flag gaps for the owner to close.
Set the pre-contract subcontracting decision standard
The organization owns the decision and must make it before the contract is signed. Adopt a written standard that asks, for each provider, whether subcontracting is allowed and under what conditions, covering the provider's ability to select, monitor and identify subcontractors, equivalent access and inspection rights for the organization, and the provider's own assessment of location risk, concentration risk and the impact of a subcontractor failure. Record the decision, the evidence reviewed and the approver. The step is done when every new in-scope arrangement has a signed decision record that a reviewer can trace to these conditions. An implementation partner can draft the standard and the decision record form, and can help assemble the evidence for the assessment.
Add the Article 4 contract terms to templates and renewals
Legal and procurement own the contract, with the security and third-party risk teams setting the technical requirements. Update the standard ICT services template so that it names which services may be subcontracted and on what conditions, and states that the provider remains responsible for subcontracted services. Include clauses that require the provider to monitor subcontracted services, pass down contingency, security and audit requirements, and notify material changes. Apply the same terms at renewal of existing contracts that support critical or important functions. The step is done when a clause-by-clause check of the template and a list of renewed contracts are on file. Ask counsel to confirm the final wording, since the clauses must fit the governing law of each contract.
Define the material change notice log and review
The organization owns the process and assigns a named owner for the notice log. Create a single register where every notice of a proposed material change to subcontracting is logged on receipt, with the date, the service affected, the proposed subcontractor, the change and the notice period end date. Route each entry to the risk owner for assessment against the Article 3 conditions, and record whether the organization approves or objects before that period ends. Agree in the contract what a reasonable notice period is for each service, and confirm it is documented. The step is done when a test notice has passed through the log, the assessment and a decision without missing the deadline. An implementation partner can configure the log in an open-source governance tool or a spreadsheet and set up alerts, subject to the organization's own tooling choices.
Define the termination path under Article 6
Legal and the business owner decide, with the risk owner providing the technical facts. Write a termination procedure that states the triggers in the regulation: the provider implements a material change despite an objection, implements it before the notice period ends, or subcontracts a critical service that the contract does not explicitly permit. For each trigger, specify who decides, what evidence is needed, how the provider is notified, and how exit is carried out, including the exit plan for the service. Confirm that the contract gives the organization the right to terminate on these grounds. The step is done when the procedure is approved and each in-scope contract has been checked for the termination right. Ask counsel to confirm the contractual wording before relying on it.
Schedule periodic reassessment of subcontracting risk
The organization owns the schedule and assigns a reviewer for each in-scope service. Under the regulation, parts of the Article 3 risk assessment must be repeated periodically as the business environment changes, and the organization cannot rely only on the provider's own assessment of its subcontractors. Set a review cycle, document the triggers that force an earlier review, such as a new subcontractor, a change of location or a concentration concern, and record each reassessment against the inventory from the first step. The step is done when a reassessment calendar is in place and the first cycle is complete for every critical or important service. An implementation partner can build the calendar, the reassessment checklist and the evidence trail, and can run the first cycle as a fixed-scope piece of work.
Evidence that passes a subcontracting review and how to keep it current
A subcontracting review under Delegated Regulation (EU) 2025/532 looks for dated, signed records that tie each decision to a contract clause and a risk assessment. The six artifacts below connect those decisions, and each one needs a named owner and a refresh trigger between formal reviews.
Pre-contract subcontracting assessment
Keep one signed assessment per arrangement that supports critical or important functions, recording the decision on whether the provider may subcontract under Article 3(1). It should cover the provider's ability to select, monitor and identify subcontractors, equivalent access and inspection rights, and the provider's own assessment of location risk, concentration risk and the impact of a subcontractor failure. Check that the entity's own reasoning is written down, since Article 3(3) says reliance on the provider's assessment does not reduce the entity's responsibility. Refresh the parts of the assessment that change with the business environment, as Article 3(2) requires.
Contract clauses mapped to Article 4(1)
Maintain a clause map that shows where each Article 4(1) element sits in the contract: the services that may be subcontracted, the conditions attached, the provider's continued responsibility, monitoring duties, passed-down contingency, security and audit requirements, and notice of material changes. Each row should cite the clause number and the current contract version. Re-run the map whenever a schedule, data processing addendum or service description is amended, because a missing clause is hard to remedy mid-term.
Subcontractor register with locations
Require the provider to keep a register listing each subcontractor used for the supported service, the service provided, the country or countries of processing and storage, and the date each entry was added or removed. The entity should compare the register against its location risk and concentration risk analysis. Ask the provider to confirm the register at each reassessment and after any notified change, and to explain how it identifies subcontractors further down the chain.
Change-notice log with approve or object decisions
Record every notice of a material subcontracting change in a log with the date received, the end of the reasonable notice period set under Article 5, the approve or object decision, the rationale, and the date the decision was communicated. A change implemented before approval or before the period expires is a termination trigger under Article 6, so the log should also show when the provider implemented each change. Review open notices at fixed intervals so no notice period lapses without a decision.
Termination decision record
Document every termination assessment, including cases where the entity decided not to terminate. The record should name the Article 6 ground considered, such as a material change implemented despite objection, a change made before the notice period ended, or a critical service subcontracted without explicit contractual permission. Include the exit steps taken, the date of the decision and the approver. Keep the exit plan linked to the record so the team can show what it would have done.
Periodic reassessment records
Keep a dated record of each periodic reassessment of the subcontracting risk assessment, showing which parts were repeated, what changed in the business environment and what the outcome was. Set a review trigger for events such as a new subcontractor location, a change in concentration, a significant incident at a subcontractor or a change in the entity's own risk appetite. Confirm with your own governance team how often reassessments must run, because the internal cadence is set by your policy and not by the Regulation.
What meeting the subcontracting RTS costs in money and effort
This table compares the main cost components of meeting Delegated Regulation (EU) 2025/532, who is paid for each, whether it is one-time or recurring, and what moves it up or down. No prices or durations are stated because they depend on how many arrangements and providers fall within scope, so use the drivers to build a written quote.
| Cost component | One-time or recurring | What drives it up or down | How to keep it down |
|---|---|---|---|
| Tooling and licenses | Recurring if commercial, one-time setup otherwise | Commercial GRC licenses scale with users and modules. CISO Assistant is AGPL-3.0-only, so no license fee applies, but setup, hosting and integration effort remain. | Confirm the licence terms with the vendor or project, then budget for hosting, configuration and integration with contract and vendor registers. |
| Internal engineering and risk time | Recurring at each reassessment | Number of subcontracting chains, number of critical or important functions, and how many subcontractors each provider uses. | Start with the critical or important functions and standardize the questionnaire used to confirm provider conditions. |
| Contract remediation with existing providers | One-time per contract, plus change-driven updates | Number of existing agreements that do not yet name permitted subcontracted services, notification duties, or passed-down audit and contingency terms. | Prioritize contracts for critical or important functions and use one clause set across renewals. Ask providers early for their subcontractor lists. |
| Evidence upkeep at each reassessment | Recurring | How often the business environment changes, how many subcontractors a provider adds, and whether location and concentration risk are re-tested. | Set a review calendar tied to notified material changes and keep the evidence in one register linked to each arrangement. |
| External review of contract terms | One-time per engagement, sometimes recurring | Volume and complexity of contracts, number of jurisdictions, and whether counsel or a specialist reviews each template or only exceptions. | Review the standard clause set once and limit external review to nonstandard terms. Ask for the review scope in writing. |
| Auditor sampling | Recurring with each supervisory or independent review | Number of arrangements selected in the sample and depth of evidence requested for each risk assessment and contract. | Keep evidence complete and indexed per arrangement so sampled files can be produced quickly. Confirm the auditor's sampling approach beforehand. |
| Monitoring of subcontracted services | Recurring | Number of subcontracted services, frequency of provider reporting, and whether monitoring relies on provider attestations or direct testing. | Use the provider's reporting schedule where it meets the contract, and reserve direct checks for higher-risk subcontractors. |
Who owns, who prepares and who assesses subcontracting under DORA
Your organization owns every subcontracting decision under Delegated Regulation (EU) 2025/532. Your management body and the functions it delegates to must decide, before a contract is signed, whether the ICT provider may subcontract services that support critical or important functions, and they must accept the residual risk that remains. Responsibility does not move to the provider because the provider has assessed its own subcontractors.
- Pre-contract decision: Record whether subcontracting is permitted, for which services, and on what conditions, and confirm the provider's ability to select, monitor and identify subcontractors.
- Risk acceptance: Own the sign-off on location, concentration and subcontractor-failure risk, and repeat the relevant parts of that assessment when the business environment changes.
- Contract signature: Approve the contract clauses that list permitted subcontracted services, flow down contingency, security and audit requirements, and require notice of material changes.
- Approvals and objections: Run the notice period for material changes, decide whether to approve or object, and keep a dated record of each decision.
- Termination: Hold the termination rights in the contract and exercise them when a change goes ahead despite objection, before the notice period ends, or when a critical service is subcontracted without contractual permission.
Confirm that each of these decisions has a named owner, a documented approver and a retained record that an assessor can sample.
An implementation partner prepares the systems, templates and evidence that your team uses to meet the regulation. Under a fixed-scope engagement, the partner can build the assessment templates, map contract clauses to the requirements of Article 4 and the notice mechanics of Articles 5 and 6, configure the tooling that tracks subcontractors and changes, and document how the process runs. The partner does not make the decisions, sign the contracts or accept the risk.
- Assessment templates: Draft the ex-ante risk assessment and the periodic re-assessment forms that cover location, concentration and failure impact.
- Clause mapping: Compare your existing provider contracts against the required terms and list gaps for your legal team to negotiate.
- Evidence set-up: Define where approvals, objections and notices are stored, and how each record links to the service and provider.
- Tool configuration: Set up a self-hosted compliance tool, such as one that supports framework-based assessments, inside your own infrastructure, and load your requirements into it.
- Fixed-scope support: Agree deliverables, timelines and handover in writing before work begins, and document the outcome for your records.
Ask the partner to state in writing which items it prepares and which items remain with your staff.
The independent auditor or the competent authority tests whether subcontracting controls work as described. An external assessor selects samples of subcontracting decisions, reads contracts, checks that notices and approvals were timely, and issues findings. The authority supervises compliance using its powers under DORA. Neither party designs the controls it tests, and neither should prepare the evidence it will judge.
- Sampling: Select a set of arrangements covering critical or important services and trace each from the pre-contract decision to any material change.
- Contract review: Compare signed terms with the requirements of the RTS and the entity's own policy.
- Evidence testing: Check that records are complete, dated and attributable to the people who held the authority to decide.
- Findings: Report exceptions and observations. Only an independent auditor or certification body issues reports, and DeployOpen does not issue audit reports or attestations.
- Recurrence: Expect the periodic re-assessment to be tested as well as the initial decision.
If you engage an external assessor, confirm its independence from the team that built the controls.
Where organizations usually fall short on subcontracting and how to close each gap
Most subcontracting failures under Delegated Regulation (EU) 2025/532 come from process gaps, not missing policy text. The cards below follow the lifecycle from knowing the subcontractor chain, through pre-contract decisions, contract terms and change control, to termination rights, with the evidence each closing action should produce.
No view beyond the first provider
Many entities know their direct ICT provider but not the subcontractors that provider uses for a critical or important function. Article 3 expects the entity to assess the provider's ability to select, monitor and identify subcontractors, so the chain has to be visible before any decision. Close the gap by requiring each provider to list its subcontractors, their locations and the services they perform, and by recording that list against the function it supports. Evidence: a maintained subcontractor register per critical or important function, dated and tied to the contract.
Pre-contract decisions made without risk assessment
Procurement often signs a contract with a provider that subcontracts, then asks risk questions afterward. Article 3(1) requires the entity to decide before contracting whether subcontracting is allowed, and to confirm the provider's own assessment of location risk, concentration risk and the impact of a subcontractor failure. Assign the decision to the function that owns the ICT risk, with procurement as an input rather than the approver. Evidence: a signed pre-contract subcontracting decision record that covers each risk element named in Article 3.
Contract templates missing pass-down terms
Standard procurement templates rarely list which services may be subcontracted or on what conditions. Article 4(1) requires the contract to identify these conditions and to make the provider remain responsible, monitor subcontracted services, and pass down contingency, security and audit requirements. Review the template clause by clause against Article 4(1), and add an exhibit for each critical or important function that names permitted subcontracted services. Evidence: a contract addendum or clause library mapped to Article 4(1), with the executed contracts that carry it.
Change notices handled by email
When a provider announces a new subcontractor or location, the notice often lands in an inbox and is acted on informally. Article 5 gives the entity a reasonable notice period in which it can approve or object, and the provider may implement the change only after approval or after the period ends without objection. Route every material change notice into a ticket with a fixed deadline, a named decision owner and a written outcome. Evidence: a change log showing the notice date, the decision, the approver and the date the period closed.
Approvals given after the notice period
A late approval can leave the entity holding a change it never actually accepted. Article 5 allows the provider to implement changes only after approval or no objection by the end of the notice period, so an approval recorded after that date does not cure an earlier implementation. Set the notice period in the contract, calendar the close date on the day the notice arrives, and require the provider to confirm implementation dates in writing. Evidence: timestamped approval records that sit before the period close date, plus provider confirmations of the implementation date.
Termination rights never tested
Termination rights in a contract are often assumed to work until the moment they are needed. Article 6 allows termination where the provider implements a material change despite objection, implements it before the notice period ends, or subcontracts a critical service the contract does not explicitly permit. Walk through each trigger with legal, the exit plan owner and the business owner, and confirm the notice and transition steps are workable. Evidence: a documented tabletop review of each Article 6 trigger, with the findings and the exit plan updates it produced.
What buyers ask about the subcontracting RTS before hiring help
How much effort does a subcontracting review under the DORA RTS take?
The effort depends on how many ICT services support critical or important functions, how many subcontractors sit beneath each provider, and how much of that information the entity already holds. Each review covers the pre-contract decision under Article 3(1), the contract terms under Article 4(1), and the handling of material changes under Article 5. Entities with a clean register of information and documented provider assessments usually have less to collect. Ask any partner to break its estimate down by service, by provider and by contract, and to state which assumptions it depends on, such as whether provider data is already available.
Can our team run the subcontracting assessment in-house?
Yes, in most cases an entity's own risk, procurement and legal staff can carry out the assessment, provided they understand the conditions in Article 3 and the contract terms in Article 4. The work needs three skill sets: ICT risk assessment, contract drafting, and provider monitoring. Teams often struggle with the periodic repetition required by Article 3(2) and (3), because it needs a standing process rather than a one-off exercise. An outside partner can help with the technical evidence, such as access and inspection arrangements, but the assessment itself stays with the entity.
How long does a subcontracting RTS review take?
The duration depends on the number of in-scope contracts, how quickly providers respond to information requests, and whether contracts need renegotiation to add the Article 4 terms. Timing also depends on the notice periods that providers and the entity agree for material changes under Article 5, since those periods shape how fast approvals can be given. Entities with contracts already up for renewal can align the review with that cycle. Ask for a written schedule that lists dependencies on provider responses and legal review, because those usually set the critical path.
What do we need from our providers and procurement teams?
Procurement and legal teams need to confirm that each contract identifies which services may be subcontracted and on what conditions, and that it obliges the provider to stay responsible, monitor subcontracted services, pass down contingency, security and audit requirements, and notify material changes. From providers, the entity typically needs a list of subcontractors for in-scope services, their locations, information on how the provider selects and monitors them, and evidence of access and inspection rights. Providers that cannot supply this information early may delay the whole review, so ask for it at the start.
Can an implementation partner sign off our subcontracting assessment?
No. The entity owns the decision to allow subcontracting, the risk assessment behind it, and the approval or objection to material changes. Under Article 3(3), relying on the provider's own assessment of its subcontractors does not reduce the entity's responsibility. A partner can prepare the analysis, draft the evidence, and document the process, but it cannot approve a subcontractor or issue any attestation. Where independent assurance is needed, that comes from the entity's auditor or the supervisory process, not from the implementation partner.
What should we confirm in the Official Journal text and our supervisor's guidance?
Confirm the final wording of Delegated Regulation (EU) 2025/532 in the Official Journal, which was published on 2 July 2025, and read it against the Article 3, 4, 5 and 6 requirements you intend to meet. Then check whether your national competent authority or the relevant European Supervisory Authority has issued supervisory guidance, Q&A or expectations on subcontracting, since these can clarify how the conditions apply to your entity type. Record the version of each source you relied on, because supervisors may ask which text your assessment followed. The primary text is available through the EUR-Lex record for Delegated Regulation (EU) 2025/532.
What happens if a provider makes a material subcontracting change we did not approve?
Under Article 6, the entity may terminate where the provider implements a material change despite objection, implements it before the notice period ends, or subcontracts a critical service that the contract does not explicitly permit. Before a dispute arises, check that your contracts define material changes, set the notice period, and state the consequence of an unapproved change. Ask legal counsel to confirm how termination rights interact with your exit plan, since a termination without a tested exit route can create operational risk of its own.
How DeployOpen works on this
DeployOpen helps financial entities and their ICT providers prepare the systems, records and evidence that Delegated Regulation (EU) 2025/532 asks for when ICT services supporting critical or important functions are subcontracted. The organization keeps ownership of its subcontracting decisions and contracts, while DeployOpen plans and implements the self-hosted open-source platforms that hold the supporting records.
How we scope
- We agree in writing which subcontracted ICT services, critical or important functions and contracts fall inside the engagement before work starts.
- We map the Article 3 pre-contract conditions to named systems, owners and records in your environment.
- Engagements are fixed-scope, so deliverables and timelines are confirmed in writing before any work begins.
How we build
- We configure a self-hosted register of subcontracting decisions and risk assessments inside your own infrastructure.
- We set up review cycles for the periodic reassessment of location, concentration and subcontractor failure risk.
- We build notice-period tracking so material subcontracting changes are logged, approved or objected to within the Article 5 window.
How we hand over
- We document the subcontracting procedure, approval workflow and contract clause checklist for your compliance and legal teams.
- We deliver an evidence index mapping each Article 3, 4, 5 and 6 requirement to the records that show it.
- We train the named owners on running the workflow, so the records stay current after handover.
How we support
- Ongoing support, upgrades and periodic reviews of the subcontracting records are available as a retainer.
- We can re-run the evidence review when a provider proposes a material change or a new subcontractor.
- Interpretation of the regulation and contract advice remain with your legal counsel and the independent assessor you choose.
