Article 58, Review Clause, Digital Operational Resilience Act (DORA)

Overview

1. By 17 January 2028, the Commission shall, after consulting the ESAs and the ESRB, as appropriate, carry out a review and submit a report to the European Parliament and the Council, accompanied, where appropriate, by a legislative proposal. The review shall include at least the following:

(a) the criteria for the designation of critical ICT third-party service providers in accordance with Article 31(2);

(b) the voluntary nature of the notification of significant cyber threats referred to in Article 19;

(c) the regime referred to in Article 31(12) and the powers of the Lead Overseer provided for in Article 35(1), point (d), point (iv), first indent, with a view to evaluating the effectiveness of those provisions with regard to ensuring effective oversight of critical ICT third-party service providers established in a third country, and the necessity to establish a subsidiary in the Union.

For the purposes of the first subparagraph of this point, the review shall include an analysis of the regime referred to in Article 31(12), including in terms of access for Union financial entities to services from third countries and availability of such services on the Union market and it shall take into account further developments in the markets for the services covered by this Regulation, the practical experience of financial entities and financial supervisors with regard to the application and, respectively, supervision of that regime, and any relevant regulatory and supervisory developments taking place at international level.

(d) the appropriateness of including in the scope of this Regulation financial entities referred to in Article 2(3), point (e), making use of automated sales systems, in light of future market developments on the use of such systems;

(e) the functioning and effectiveness of the JON in supporting the consistency of the oversight and the efficiency of the exchange of information within the Oversight Framework.

2. In the context of the review of Directive (EU) 2015/2366, the Commission shall assess the need for increased cyber resilience of payment systems and payment-processing activities and the appropriateness of extending the scope of this Regulation to operators of payment systems and entities involved in payment-processing activities. In light of this assessment, the Commission shall submit, as part of the review of Directive (EU) 2015/2366, a report to the European Parliament and the Council no later than 17 July 2023.

Based on that review report, and after consulting ESAs, ECB and the ESRB, the Commission may submit, where appropriate and as part of the legislative proposal that it may adopt pursuant to Article 108, second paragraph, of Directive (EU) 2015/2366, a proposal to ensure that all operators of payment systems and entities involved in payment-processing activities are subject to an appropriate oversight, while taking into account existing oversight by the central bank.

3. By 17 January 2026, the Commission shall, after consulting the ESAs and the Committee of European Auditing Oversight Bodies, carry out a review and submit a report to the European Parliament and the Council, accompanied, where appropriate, by a legislative proposal, on the appropriateness of strengthened requirements for statutory auditors and audit firms as regards digital operational resilience, by means of the inclusion of statutory auditors and audit firms into the scope of this Regulation or by means of amendments to Directive 2006/43/EC of the European Parliament and of the Council.

Summary Of Article 58

Article 58 of the Digital Operational Resilience Act (DORA) mandates periodic reviews to assess the regulation’s effectiveness and recommend necessary changes. The first review, due by 17 January 2026, will focus on evaluating whether statutory auditors and audit firms should be included within DORA’s scope for strengthened digital operational resilience or if amendments to Directive 2006/43/EC are required.

By 17 January 2028, the Commission will review several elements of DORA, including the criteria for designating critical ICT third-party service providers, the voluntary nature of cyber threat notifications, and the oversight regime for third-country service providers. It will assess whether third-country service providers should be required to set up a subsidiary in the EU and evaluate the role of the Joint Oversight Network (JON) in ensuring effective oversight and consistent information exchange.

Additionally, the Commission will assess the scope of DORA in relation to automated sales systems used by financial entities and its potential expansion. As part of the review of Directive (EU) 2015/2366, the Commission will also examine the need to enhance cyber resilience in payment systems and processing activities, proposing appropriate legislative actions where necessary.