DORA · ICT third parties · Ongoing management
DORA third-party management: managing changes at ICT service providers
A new subcontractor can change a bank's dependencies even though its direct contractual partner stays the same. How a change notification becomes a traceable assessment, decision and follow-up check.
For outsourcing and ICT third-party management, procurement, information security and business units of German banks.
The task at a glance
What needs to be done when an ICT service provider changes?
The bank must understand what is changing, which services and functions are affected, and whether the changed service can be provided within the applicable requirements and its risk tolerance. To do so, it needs reliable information in good time, a documented assessment and a decision by the responsible person. Implementation and its consequences are then followed up. For material changes to subcontracting arrangements within the relevant scope of application, Art. 5 of Delegated Regulation (EU) 2025/532 specifies the procedure. [3]
This T-NEX practical guide walks through a fictional change of hosting provider. It shows the evidence required, a completed decision and the handovers between the functions involved. It then becomes possible to examine which tasks an existing application or the T-NEX Banking Platform is meant to support in the specific process.
01 · Context
The service received determines the review
ICT third-party management covers the risks arising from the receipt of ICT services. DORA links the selection of a provider with contractual requirements, monitoring and exit arrangements. The financial entity remains responsible. A signed contract and a maintained register entry are therefore important components, but not complete evidence of functioning management. [1, Art. 28–30]
This article looks at a credit institution within the regular DORA framework and an ongoing ICT service which, in the example, supports a critical or important function. Other types of institution, exemptions and simplified requirements must be classified separately. Our DORA overview.
| Term | What it refers to | Question in the working case |
|---|---|---|
| Critical or important function | Impact of an impairment of the function on the financial entity | Which function does the ICT service received support, and how was it assessed? |
| Material change | A specific change and its significance in the relevant contractual and risk context | What changes compared with the assessed baseline? |
| Critical ICT third-party service provider | Separate European designation for the oversight framework under DORA | The designation does not replace the bank's own assessment of the service received. |
Legal basis: Art. 3 no. 22, Art. 28–31 DORA and Art. 5 EU 2025/532. [1] [3]
Outsourcing under the outsourcing law applicable in each case and the ICT service under DORA must also each be assessed independently. Anyone who already holds a MaRisk classification should not carry it over into a DORA classification without checking it. We examine the current version of MaRisk and its relationship to § 25b KWG in more depth in the article MaRisk AT 9 and DORA in service provider management. [4] [5]
A change notification must first be read for its substance. Is only the company name changing? Is an actual service provider being replaced? Are a different data location, new access routes or a changed emergency procedure involved? A short subject line can conceal several matters. Only mapping the notification to the service shows which review is required.
02 · Sample case
Two providers, soon the same hosting dependency
Fictional working case CHG-2026-014. The participants, documents, data and results are constructed. It is neither a T-NEX customer case nor a product test that was carried out.
The bank BANK-01 uses the service SVC-A for its digital credit file and a document workflow. The contractual partner is TP-A. So far, the subcontractor TP-B has operated the hosting component. TP-A announces that it will move this component to TP-C. At the same time, the bank obtains a deadline and status report, SVC-D, from TP-D. This second service already uses TP-C.
In the sample case, SVC-A supports function F-01, credit processing. Its classification as critical or important is a reasoned case assumption: a prolonged outage would significantly impair the timely processing of material transactions. No general classification of every digital file or every document workflow follows from this.
A new shared dependency. In the diagram, providers A and D correspond to the direct service providers TP-A and TP-D; hosts B and C stand for TP-B and TP-C. After the planned change, both service paths lead to TP-C. Fictional sample case, not a real provider architecture.
Before the change there were two distinct hosting dependencies. Afterwards both service paths lead to TP-C. Two separate contracts do not mean technical independence here. This remains relevant even if TP-A and TP-D each state that their own service is adequately secured. The bank must assess the connection from its overall perspective.
| Item | Value in the fictional case | Why it is needed |
|---|---|---|
| Case | CHG-2026-014 | A common reference for assessment, decision and measures |
| Contract | CTR-A-01, version 3 | The relevant subcontracting clause must be reviewed in the correct contract version. |
| Notification | 1 September 2026 | Record receipt and announced content in a traceable way |
| Contractual deadline | In the case expressly until 21 September 2026; 20 calendar days are assumed. | Only a case assumption, not a statutory DORA deadline in days |
| Planned implementation | 24 September 2026 | Assessment, response and preparations must be possible before the relevant date. |
| Initial status on 4 September | Evidence outstanding, no documented consent | A case with an incomplete assessment must not appear to be complete. |
In a real case, the specific calculation of the deadline must be checked against the agreement and the applicable rules. For the working aid, the end of the deadline is expressly fixed. This prevents a technical calculation from silently replacing a legal interpretation.
Consequence in the sample case: The shared dependency on TP-C expressly belongs in the assessment. It cannot be answered through two separate supplier files.
03 · Information basis
A notification becomes a verifiable change
The service provider's notification opens the case. It is not yet the complete information basis for it. First, it is clarified which service was provided so far and which is to be provided in future. A statement such as “We are optimising our infrastructure” is not sufficient for this. What is needed are the components concerned, the new service provider, the timing and the effects on the agreed services.
The assessment of subcontracting and the required contract contents arise, within the scope of application considered here, in particular from Art. 3 and 4 of Delegated Regulation (EU) 2025/532. The following review questions translate this task into a working aid; they do not reproduce a complete statutory catalogue of obligations. [3]
| Review question | Suitable information | Not sufficient |
|---|---|---|
| What does TP-C take over? | Description of the hosting service with mapping to SVC-A and to the subcontracting chain | The name of the new company without reference to the service |
| Where are services provided and data processed? | Service and data locations, changes compared with the baseline, relevant access routes | The registered office of TP-C alone |
| Which controls apply to the new environment? | Scope, period, results and limits of relevant audit reports or certificates | A certificate logo or a report for the previous hosting environment |
| How do performance and recovery remain secured? | Performance targets, emergency and recovery arrangements, suitable test evidence | A general availability commitment with no reference to the planned operation |
| What shared dependency arises? | Connection to SVC-D and other affected services, effects of an outage of TP-C | The separate assessment of TP-A and TP-D as the sole perspective |
| Do control and exit remain possible? | Contractual rights, information channels, transition arrangements and alternatives that can actually be used | A reference to a solution to be negotiated later |
Evidence needs a version, scope and assessment
A meaningful file entry consists of more than a file attachment. It names the document, its status, the relevant reference, the question concerned and the result of the review. This makes it possible to recognise later whether a decision rests on the original notification, a supplemented service sheet or a test report submitted afterwards.
In the sample case, the suitable recovery evidence is missing on 4 September. This is initially an evidence gap. The bank therefore does not yet know whether the new environment is inadequate or whether only the supporting document is missing. It requests the specific information and assesses the consequence for its timely decision. The gap must be treated neither as already passed nor, without further justification, as an actual failure.
Three different findings
- Mandatory gap
- A relevant binding requirement is not met. A note on risk acceptance does not replace it.
- Evidence gap
- The available information does not yet support a reliable statement. The missing information and its relevance to the decision are identified.
- Residual risk
- After taking the requirements and measures into account, a specifically described risk remains. Its assessment follows the responsible decision and the institution's risk framework.
A certificate must also fit the subject of the review. For the service consumption considered here, EU 2024/1773 specifies how to handle audit reports, certificates and own or pooled audits. Permanently relying exclusively on certificates or on reports provided by the provider is not sufficient. [2, Art. 8]
04 · Assessment and decision
The decision must be reliable before the relevant deadline
A change can affect several functions of the bank. The work is therefore coordinated through a single common case. Responsibilities depend on the bank's own organisation; the following allocation is a proposal for the sample case and not a statutorily prescribed role matrix.
| Role | Contribution to the assessment | Result |
|---|---|---|
| ICT third-party management | Coordinate the case, track the deadline and completeness | Consolidated assessment status and decision template |
| Credit business unit | Assess the impact on processing, deadlines and fallback procedures | Business consequences and minimum service required |
| IT and information security | Review architecture, new dependency, controls and recovery | Technical assessment with evidence and open points |
| Legal and procurement | Assess contract mechanics, deadline, rights and communication | Coordinated contractual response |
| Risk management and responsible decision-making level | Place the assessment within the institution's own risk framework | Reasoned decision under the institution's own scheme of authority |
| Internal audit | Independently review appropriateness and effectiveness | Audit perspective, no operational approval in the sample process |
Data protection is brought in where questions relevant to data protection law arise. The roles may be organised differently in a smaller institution. What matters is that specialist contributions, responsibilities and escalation are allocated in a traceable way. The policy for the service consumption concerned must reflect responsibilities and the handling of material changes. [2, Art. 3–4]
The contractual deadline is a review point in its own right
For the material changes covered, Art. 5 EU 2025/532 provides for timely information and an appropriate contractual deadline. The legal act does not specify a general deadline of 30 days. It takes into account the financial entity's consent and the absence of an objection by the end of the deadline. This must be read in the specific contract mechanics. [3]
The case should therefore record at least receipt, announced implementation date, relevant deadline, responsible handling and escalation point. An automatic reminder helps with organisation. It does not relieve the institution of assessing the end of the deadline and the necessary response.
A follow-up request does not automatically stop the clock
If documents are missing, the bank needs deliberate deadline management in addition to the query. A request to the provider does not, in itself, extend the deadline. Whether and how the deadline can be adjusted must be clarified and documented contractually or legally. A case that is still open internally must not silently be given the status “reviewed”.
Processing a change in an orderly way. Sample procedure for the change: information gaps and objections remain distinct states. Consent presupposes a sufficient assessment; mandatory prerequisites are not postponed to a later follow-up check. Rights and deadlines are to be checked against the specific contract.
Distinguishing objection, request for amendment and termination
If the review shows that the planned change exceeds the risk tolerance, Art. 5 EU 2025/532 requires the corresponding response before the deadline expires, including an objection and a request for amendment. Art. 6 governs termination rights in certain constellations. Such a right does not mean that the contract ends automatically without further action. [3]
The decision template should therefore not be a mere yes/no query. It explains the assessed status, the open questions, possible alternatives and the consequences of the chosen response. A requested adjustment must be specific enough that it can later be seen whether the service provider complied with it.
How the sample case reaches consent
On 11 and 16 September, additional information arrives in the fictional case. The bank assesses the recovery evidence submitted afterwards, the control coverage, the contractual rights and the effects of the shared hosting. Evidence gaps relevant to the decision are closed; the relevant mandatory contractual requirements are assessed as met before consent is given. The service SVC-D from TP-D, which the bank already receives, is expressly not regarded as an independent replacement for SVC-A, because both services depend on TP-C. Moreover, a deadline and status report does not, in functional terms, replace either the credit file or the document workflow.
On 18 September, the responsible decision-making level documents consent. The concentration remains elevated. In the case it is assessed as within the assumed tolerance only because the independent, limited emergency operation IN-01 was tested and the exit to the internal target environment Z-01 is made plausible by test-data return, review of material processing steps and a plan exercise. A full production migration was not carried out in the teaching case. These are synthetic case assumptions, not a general approval rule for hosting concentrations.
The consent includes measures for the follow-up check of implementation. It does not postpone to a later date any requirement that must be met before the decision. If, in a real case, the very prerequisites on which the consent is supposed to rest are missing, the decision must come out differently.
From the fictional decision template
A reasoned decision also states its limits
Subject: announced hosting change for SVC-A from TP-B to TP-C. Information status: including the additions of 11 and 16 September. Assessment: shared dependency with SVC-D identified; no technical diversification through TP-D. Decision: documented consent on 18 September after review of the prerequisites. Next steps: track implementation, review consequences for the register and carry out the agreed follow-up checks.
The complete fields, evidence and remaining tasks are in the case package.
05 · Handovers
A decision changes several working states
Once consent has been given, the work is not yet complete. The decision may affect contract documents, the register, risk assessment, continuity planning and technical documentation. These consequences should arise from the same change case. Otherwise a current supply chain can easily end up standing next to an outdated exit plan.
| Work area | Review in the sample case | Evidence of handover |
|---|---|---|
| Contract and subcontracting clause | Is the change within the agreed mechanics, or is a contract amendment required? | Mapping of the response and, where applicable, of the dated contract document |
| Risk and dependency picture | Make the shared hosting of SVC-A and SVC-D visible | Updated assessment with reference to the decision |
| Register of information | Review the information and supply chain references concerned according to the applicable scope | Versioned maintenance case with controlled change date |
| Continuity and recovery | Take the new environment and outage assumptions into account in the relevant documents | Reconciliation of technical and business arrangements |
| Exit | Does the intended alternative remain usable under the new dependency? | Updated prerequisites and a traceable test basis |
| Measures and reporting | Track follow-up checks, responsible persons and deadlines | Viewable status with closure evidence or escalation |
For material changes to the contractual arrangement concerned, EU 2024/1773 requires written formalisation in a dated document signed by the parties. This is to be distinguished from a notification that is handled within a subcontracting mechanism already agreed. Not every notification automatically leads to a new master contract. [2, Art. 8(4)]
Register maintenance and informing the authority are separate questions
The register of information under Art. 28(3) DORA is kept and updated. Whether a specific situation additionally triggers a notification to or reporting to the competent authority must be reviewed separately. The mere change of a subcontractor does not give rise to a blanket rule of “report to BaFin immediately”. [1]
In the working case there are therefore two separate control points: which register entries are affected? And does the specific situation give rise to an additional duty to inform under the competent supervisory regime? This prevents a technical data change from being confused with a legal reporting decision. The data structure and review are explained in the article on the DORA register of information. [6]
Recovery and exit answer different questions
A successful recovery test does not automatically show that a switch to another solution is possible. Conversely, a contractual right to the return of data does not in itself prove a functioning target operation. For ICT services supporting critical or important functions, DORA requires documented, sufficiently tested and regularly reviewed exit plans. [1, Art. 28(8)]
In the sample case, it is particularly important to note that SVC-D sits with the same host. If the bank named SVC-D as a fallback solution, it would have a different direct provider but would not have resolved the decisive dependency. A meaningful test scenario must take precisely this common cause of failure into account.
06 · Follow-up check
The case is only done once there is a traceable result
On 24 September, the direct service provider reports in the fictional case that the changeover is complete. The bank now checks whether the assessed status was actually implemented. This includes the confirmed scope of service, the documents concerned and the agreed follow-up checks. If deviations emerge, the assessment is reopened. In the sample case, the subject-matter work ends on 5 October 2026 after the documented follow-up checks are completed; ongoing monitoring remains in place.
A measure status of “closed” should therefore be linked with a statement: what was checked, on the basis of which information, by whom and with what result? An uploaded file can be evidence of receipt. Whether it closes the measure in substantive terms is a separate review.
From receipt to closure. The documents remain linked via CHG-2026-014. The evidence chain shows the identifiers and versions used in the case. The decision replaces neither implementation nor the later closure evidence.
What senior management should take from the case
A report does not have to reproduce every annex. It should make clear which dependency has changed, which decision was taken and which material points are open. In the sample case, the increased shared hosting dependency is a central piece of information. A mere count of closed tasks would not explain it.
- Subject: Which function and which ICT service are affected?
- Assessment: What has changed compared with the previous state?
- Decision: Which response was made, and on what basis?
- Open points: Which measures or uncertainties remain, and with what responsibilities?
- Escalation: Which development requires a new decision?
This is a proposal for a decision-oriented presentation. Scope and reporting lines depend on the organisation and the risk profile. Ongoing monitoring, documentation of the assessment and tracking of remedial action are specified for the service consumption concerned by EU 2024/1773. [2, Art. 9]
07 · Software and AI
The application must preserve the connection
For a single case, a cleanly kept file can be sufficient. It becomes difficult when several services, contracts and business units document the same change differently. The question about software therefore starts with the handovers: where does the information come from? Which assessment uses it? Which decision applies? And which measure changes the status?
A product demonstration should show this process with traceable sample data. A dashboard with green indicators does not yet answer whether the shared hosting dependency is recognisable or whether a decision has to be reviewed again after a document has changed.
| Scenario | What is to be demonstrated | How a gap becomes apparent |
|---|---|---|
| Shared dependency | SVC-A and SVC-D visibly lead to the same subcontractor TP-C. | The application shows only direct providers, without the shared dependency. |
| New document version | The assessment remains linked to the version actually used. A new version is recognisable. | A replaced attachment silently changes the basis of an earlier decision. |
| Open evidence | Missing evidence, query and deadline are in the same case. | A file filing is already counted as a positive substantive assessment. |
| Roles and decision | Editing rights and decision-making authority can be checked against the intended organisation. | A read-only role can approve without having the intended right. |
| Consequential change | Register maintenance, continuity documents and measures are assigned and can report back. | The case counts as closed although a necessary handover is missing. |
| Traceable report | The report leads back to the decision, assessment and evidence basis. | The aggregated presentation conceals a gap relevant to the decision. |
These scenarios are aids for selection and acceptance. They are not tests of a particular product that have been carried out. Scope, configuration and expected result should be agreed before the demonstration. Our guide to selecting GRC software.
Where AI can help with document work
An AI can pre-structure a change notification, show differences between contract versions or search for relevant passages for a review question. In the sample case, a sensible task would be: “Which statements on subcontractors, service locations and recovery change between these two document versions?” For each statement, the result should name the passage used.
Quality also shows at the limits. If the evidence for the new environment is missing, an answer must not derive a positive statement about TP-C from a report on TP-B. If two documents contradict each other, this contradiction must become visible. A technically plausible summary is not yet a substantive assessment of the change.
A usable AI test case also contains missing information
For the demonstration appointment, a complete file and a variant with a missing or outdated piece of evidence are used. In the second case, a recognisable uncertainty or a query is expected. Substantive assessment and decision remain with the responsible roles. This test says more about the intended use than a sample answer that merely succeeds.
In addition, permitted data, model access, permissions and logging are defined. The AI must not make available documents that the person asking is not meant to have access to. Retention and deletion must fit the purpose. Unlimited storage of all content is not a quality feature.
08 · Implementation with T-NEX
Bringing the change case together in the Banking Platform
The T-NEX Banking Platform connects specialist modules on a common data basis. For the workflow described, the interplay of requirements, assessments, tasks and reporting is particularly relevant. The platform is offered as an integrated product; the data paths and processes required are set up on the basis of the institution's processes. [10]
A suitable starting point is a clearly delimited change case. Together, it is determined which data already exists, which application remains the lead and which handovers are needed. This makes it possible to judge, using the specific case, whether existing components are sufficient, whether configuration is required or whether an extension has to be developed.
Subject-matter connections
Link service, assessment and measures in the intended data model. The mapping is checked in the agreed working case.
Requirements and processing
The compliance module supports work with requirements, assessments and measures. Its specific use for the service provider process is to be determined.
Reporting relevant to decisions
Present assessment status, open tasks and progress together. The report must be consistent with its data and evidence basis.
The publicly described functions and technical evidence are the starting point for this review. No blanket commitment follows from them regarding a ready-configured DORA third-party process, a native reporting export or a regulatory approval.
A sensibly delimited joint review meeting
For a first substantive walk-through, an anonymised or synthetic change case, the data objects concerned, the intended allocation of roles and an expected result are sufficient. In the meeting, it is possible to go through how the information is received, assessed, decided on and followed up. The six test scenarios above supply specific questions for this.
T-NEX supports the subject-matter and technical preparation through Consulting for institutions. If existing systems are to be connected or additional processes implemented, the scope of the regulated custom development including acceptance criteria is agreed. In doing so, T-NEX itself also belongs in the institution's intended provider review process.
Discuss the service provider process and data paths09 · Working materials
Follow the case and transfer it to your own process
The case package contains four connected worksheets: change and impact, evidence matrix, decision, and measures and closure. The completed version shows CHG-2026-014. The blank version serves as a starting point for your own adaptation.
The materials are editorial working aids. They are not official forms and do not replace any institution-specific professional review. Contractual deadlines, responsibilities, risk tolerance and evidence requirements are not to be adopted from the example without checking.
Completed sample case
Four connected worksheets with a fictional starting position, evidence, decision and closure.
Open HTML (German)Download HTML (German)Editable data (JSON) (German)German · Version 1.0 · As at 15.10.2026HTML 87 KB · JSON 23 KB
Blank worksheet
Can be filled in and printed in the browser. Entries are not saved automatically; before closing, print to PDF or transfer them to your own system.
Open HTML (German)Download HTML (German)Editable data (JSON) (German)German · Version 1.0 · As at 15.10.2026HTML 73 KB · JSON 2 KB
How to use the working aid
- Record the service actually received and the assessed baseline.
- Describe the announced change and its effects. Mark missing information as such.
- Determine the deadline and responsibility on the basis of your own contract and your own organisation.
- Link assessment and decision in a traceable way. Do not close a mandatory gap with a mere acceptance note.
- Track consequential changes and measures through to their evidenced outcome.
The diagrams are also available as scalable SVG files and high-resolution PNG files. There are separate vertical versions for small screens. Text and tables on this page explain the same connections.
10 · Frequently asked questions
Questions from service provider management
Is every change of subcontractor automatically a material change?
The specific content of the change and its significance must be assessed. The mere label of the case does not replace this review. For the scope of application dealt with here, Art. 5 EU 2025/532 governs the procedure for material changes. A new dependency, changed service locations or effects on continuity and control therefore belong in the review. [3]
Does DORA always provide for a 30-day objection period?
No. Art. 5 EU 2025/532 requires an appropriate contractual deadline. The 20 calendar days with an expressly fixed end of the deadline used in the sample case are a synthetic contractual assumption. For your own case, the rule that actually applies must be checked. [3]
Is it enough to request the missing documents?
The follow-up request addresses a need for information. It does not automatically answer how the bank must act before the deadline expires. The contractual response and a possible change of deadline are examined separately. Internally, the case remains recognisable as assessed incomplete.
Can the bank accept as a risk a contractual requirement that is not met?
An internal acceptance note does not replace a relevant binding requirement. The case must distinguish whether an obligation is not met, a piece of evidence is missing, or a justifiable residual risk remains after requirements have been met. These findings lead to different next steps.
Must a change of subcontractor be reported to BaFin immediately?
A blanket reporting requirement for every change cannot be derived from this. Register maintenance, information on planned contracts for critical or important functions and other relevant notification or information duties are to be reviewed separately. The specific facts and the competent supervisory authority are decisive. [1, Art. 28(3)]
Is a second direct service provider a sufficient alternative?
That depends on the actual dependencies and on whether the alternative can be used. In the sample case, both direct providers use the same hosting subcontractor. The second contract therefore does not remove this common cause of failure.
Can AI approve the change on its own?
In the procedure proposed here, AI supports the information work. The decision is taken by the people responsible under the institution's own organisation. A summary, a risk indicator or an automatically detected clause difference is not yet a substantive approval.
Is the T-NEX Banking Platform a ready-made DORA reporting tool?
The Banking Platform is an integrated product with connected specialist modules and common platform functions. The specific third-party process and any extensions required are checked against the working case. This article does not claim that a native DORA reporting export is already available. To the product To the evidence
11 · Authors and references
Sources, context and subject-matter status
Publisher: T-NEX GmbH. Subject-matter status: 15 October 2026. The article explains a constructed working case for a bank within the regular DORA framework. Normative requirements, practitioner perspectives and editorial working aids are kept separate. The podcast and webinar passages are paraphrased accounts, not verbatim quotations. Information on our editorial approach can be found under Editorial team.
- DORA, Regulation (EU) 2022/2554. In particular Art. 3, 5 and 28–31. Official source at EUR-Lex; official English Official Journal version at IVASS.
- Delegated Regulation (EU) 2024/1773. Guideline on contractual arrangements for ICT services supporting critical or important functions; in particular Art. 3, 4 and 8–10. EUR-Lex; official English version at IVASS.
- Delegated Regulation (EU) 2025/532. Subcontracting, in particular Art. 3–6. EUR-Lex; official Spanish Official Journal version at BOE, Art. 5 on page 6 and Art. 6 on page 7.
- BaFin: MaRisk, Circular 06/2026 (BA), 30.06.2026. For the supplementary classification of scope of application and outsourcing. Official source.
- § 25b Kreditwesengesetz. Statutory requirements for outsourcing. Gesetze im Internet.
- Implementing Regulation (EU) 2024/2956. Standard templates for the register of information. EUR-Lex. The technical details are covered in the linked article on the register of information.
- Payment & Banking: Alles Legal #101, “Was DORA beim IT-Einkauf verlangt”. Josefine Spengler, Annerton; 18.06.2025. Passage 13:10–13:45, additional context 14:19–15:08. Official episode page. Legal practitioner perspective, not an official source.
- Finanzmarkt Compliance #7, “Auslagerungen”. Conversation between Andrea Fechner and Dr. Anna Izzo-Wagner; published 15.05.2025, recorded 02.05.2025. Passage 50:47–52:26. Publisher's current podcast page; Episode overview. Practical observation on outsourcing management; DORA is excluded from the episode.
- Pulsar: “Is TPRM Ready for the AI Era?”. Webinar, June 2026; Orlando Fernández Ruiz, introduced in the conversation as Senior Policy Specialist at the Bank of England. Passage 04:13–05:18. Original video with timestamp. Paraphrased from the English; not an official legal interpretation or a recommendation for T-NEX.
- T-NEX: Banking Platform and documented functions. Product description, Compliance module, Evidence. Provider information on the functional status described, not a DORA conformity certificate.
The official full texts were cross-checked for the core questions of the case against the sources and Official Journal versions cited. For the practitioner perspectives, the relevant transcript passages and public source details were reviewed; an audio comparison for verbatim quotations is not part of this version.