Nos derniers articles

EBA has designated the development of supervisory capacity for DORA as a top-tier Union-wide strategic supervisory priority for the 2024-2026 cycle. Underscoring this priority are pressing industry concerns, evidenced by the submission of 28 new Q&As focused on 𝗗𝗢𝗥𝗔’𝘀 𝗽𝗿𝗶𝗺𝗮𝗿𝘆 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗵𝘂𝗿𝗱𝗹𝗲𝘀: 𝗜𝗖𝗧 𝘁𝗵𝗶𝗿𝗱-𝗽𝗮𝗿𝘁𝘆 𝗿𝗶𝘀𝗸 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁, 𝘁𝗵𝗲 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗼𝗳 𝗜𝗖𝗧-𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀, 𝘁𝗵𝗲 𝗼𝘃𝗲𝗿𝘀𝗶𝗴𝗵𝘁 𝗼𝗳 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿𝘀, 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗺𝗮𝗶𝗻𝘁𝗲𝗻𝗮𝗻𝗰𝗲 𝗼𝗳 𝘁𝗵𝗲 𝗿𝗲𝗴𝗶𝘀𝘁𝗲𝗿 𝗼𝗳 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻. In response, the EBA is executing a significant capacity-building initiative, delivering intensive, advanced training to supervisors through the Supervisory Digital Finance Academy (SDFA)—a multi-year effort coordinated with and backed by the European Commission. This convergence of strategic prioritization, targeted industry queries, and comprehensive supervisory training signals a new era of heightened and more sophisticated regulatory scrutiny. In consequence the digital operational resilience frameworks must be prepared to withstand proactive, in-depth, and increasingly specialized reviews from better-equipped competent authorities.

Les recommandations d’Insurance Europe, publiées en amont du paquet « Omnibus numérique » de la Commission européenne, proposent des règles numériques européennes plus claires et cohérentes. L’organisation considère le secteur de l’assurance comme un acteur central de la transition numérique de l’Europe, soulignant ses investissements dans la cyber-résilience, l’utilisation responsable des données, ainsi que dans les outils d’intelligence artificielle permettant d’accélérer les indemnisations, d’améliorer la prévention, de renforcer la sécurité des données et d’élargir l’accès des consommateurs.

Le cadre réglementaire existant — comprenant notamment le règlement sur l’IA (AI Act), le RGPD, le règlement DORA et l’Acte sur la cyber-résilience (CRA) — est décrit comme complexe, en raison d’exigences qui se chevauchent. Cette situation entrave la mise en œuvre pratique des règles et détourne des ressources qui pourraient être consacrées à l’amélioration des services.

Les recommandations appellent à :
• des clarifications sur le champ d’application de l’IA afin d’éviter les chevauchements avec la législation financière ;
• une réduction des obligations de reporting répétitives dans le cadre de DORA, en s’appuyant sur les certifications existantes ;
• une harmonisation des règles de cybersécurité et d’informatique en nuage entre DORA, le CRA et les cadres nationaux et des orientations plus claires concernant le RGPD, l’AI Act et le Data Act pour l’utilisation des données dans la formation des IA et leur anonymisation.

Ces ajustements permettraient de réorienter les ressources vers une meilleure gestion des sinistres, une protection renforcée contre la cybercriminalité, une prévention accrue et des produits plus accessibles pour les consommateurs.

Insurance Europe's recommendations ahead of the EU Commission’s Digital Omnibus package propose clearer and more consistent EU digital rules. The organization views the insurance sector as central to Europe's digital transition, citing its investments in cyber resilience, responsible data use, and AI tools for faster claims, improved prevention, safer data handling, and expanded consumer access.
The existing framework—including the AI Act, GDPR, DORA, and Cyber Resilience Act— is described as creating complexity through overlapping requirements, which hinders practical application and diverts resources from service enhancements.
The recommendations call for clarifications on AI scopes to avoid duplication with financial laws; reduced repetitive reporting under DORA with use of existing certifications; alignment of cybersecurity and cloud rules across DORA, CRA, and national frameworks; and clearer guidance on GDPR, AI Act, and Data Act for data use in AI training and anonymization.
These adjustments would redirect resources to better claims, cyber protection, prevention, and accessible products.

En 2026, l’Autorité Bancaire Européenne (EBA) intensifie la mise en œuvre du règlement DORA face aux cybermenaces croissantes et à la dépendance aux fournisseurs tiers. Les priorités incluent la surveillance directe des fournisseurs tiers critiques (CTPPs) via un cadre conjoint avec l’ESMA et l’EIOPA, des inspections ciblées et des analyses thématiques. L’EBA renforcera l’analyse des incidents TIC et publiera un rapport annuel sur les cybermenaces. Les institutions financières devront améliorer leurs cadres de gestion des risques TIC et leur résilience interne, sous une supervision accrue, pour assurer conformité et robustesse dans un environnement numérique complexe.

The EBA, alongside ESMA and EIOPA, plans 𝗷𝗼𝗶𝗻𝘁 𝗼𝘃𝗲𝗿𝘀𝗶𝗴𝗵𝘁 𝗼𝗳 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗜𝗖𝗧 𝗧𝗵𝗶𝗿𝗱-𝗣𝗮𝗿𝘁𝘆 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝗿𝘀 (𝗖𝗧𝗣𝗣𝘀) from 2026, following their 2025 designation. Measures include direct engagement on governance, thematic contract reviews, and 𝗼𝗻𝘀𝗶𝘁𝗲 𝗶𝗻𝘀𝗽𝗲𝗰𝘁𝗶𝗼𝗻𝘀 𝗼𝗳 𝗵𝗶𝗴𝗵-𝗿𝗶𝘀𝗸 𝗮𝗿𝗲𝗮𝘀, with recommendations passed to financial entities. Supervisors will assess institutions’ 𝗜𝗖𝗧 𝘁𝗵𝗶𝗿𝗱-𝗽𝗮𝗿𝘁𝘆 𝗿𝗶𝘀𝗸 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁, 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲, 𝗮𝗻𝗱 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗿𝗲𝗽𝗮𝗿𝗲𝗱𝗻𝗲𝘀𝘀, 𝗶𝗻𝗰𝗹𝘂𝗱𝗶𝗻𝗴 𝗹𝗲𝗴𝗮𝗰𝘆 𝘀𝘆𝘀𝘁𝗲𝗺 𝗿𝗶𝘀𝗸𝘀. The EBA will analyze major ICT incidents, contribute to a pan-European coordination framework for systemic events, collect new datasets via EUCLID, and support supervisory convergence to ensure 𝗰𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝘁 𝗗𝗢𝗥𝗔 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗮𝗰𝗿𝗼𝘀𝘀 𝘁𝗵𝗲 𝗘𝗨.

The white paper examines how the EU’s **NIS2 Directive** and **DORA Regulation** impose resilience, security, and compliance obligations on critical and financial-sector entities. It describes how NIS2 applies broadly to “essential” and “important” operators, while DORA targets financial firms, and compares their requirements for risk management, incident reporting, audits, third-party oversight, governance, testing, and information sharing. The document outlines potential penalties for noncompliance, the need for gap assessments and harmonization across jurisdictions, and emphasizes that entities both inside and outside the EU may be affected by these rules.

The report discusses the growing threat of cyber risk to the EU's financial stability. Key points include:

• Cyber risk is a significant and systemic threat to the EU's financial sector, with increasing frequency and sophistication of attacks.

• Factors amplifying risk include geopolitical tensions, third-party IT dependencies, and the dual-edged impact of AI.

• The financial sector, including banks and insurers, faces tangible impacts from cyber threats.

• DORA is seen as a critical step requiring ongoing commitment to vigilance and resource allocation for digital infrastructure defense.

The 𝗖𝗲𝗻𝘁𝗿𝗮𝗹 𝗕𝗮𝗻𝗸 𝗼𝗳 𝗜𝗿𝗲𝗹𝗮𝗻𝗱 guidance highlights 𝗰𝘆𝗯𝗲𝗿 𝗿𝗶𝘀𝗸𝘀 as a central component of 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗶𝗻 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀, framing them under 𝗜𝗖𝗧 𝗿𝗶𝘀𝗸 and 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲. It identifies cyber incidents and attacks as major disruptive events, alongside technology failures and insider threats. ICT risk is defined broadly, encompassing threats to systems, operations, and services. Firms are expected to align ICT resilience strategies with critical business services and integrate incident management into resilience frameworks. The guidance emphasizes alignment with 𝗗𝗢𝗥𝗔 and 𝗡𝗜𝗦𝟮, marking a regulatory shift from earlier cybersecurity guidance toward 𝙝𝙖𝙧𝙢𝙤𝙣𝙞𝙯𝙚𝙙, 𝙝𝙤𝙡𝙞𝙨𝙩𝙞𝙘 𝙧𝙚𝙨𝙞𝙡𝙞𝙚𝙣𝙘𝙚 𝙥𝙧𝙖𝙘𝙩𝙞𝙘𝙚𝙨.

The draft strengthens governance arrangements, clarifies management body roles, and enhances oversight of internal control, risk management, and compliance functions. It incorporates ICT and security risk management in line with DORA, requiring institutions to integrate digital operational resilience into governance frameworks. The revisions also address anti-money laundering, conflicts of interest, and gender-neutral remuneration. Stakeholders can submit feedback until October 2025, with final guidelines to replace the 2017 version.

The paper 𝙏𝙝𝙚 𝙍𝙚𝙜𝙪𝙡𝙖𝙩𝙞𝙤𝙣 𝙤𝙛 𝘿𝙖𝙩𝙖 𝙋𝙧𝙞𝙫𝙖𝙘𝙮 𝙖𝙣𝙙 𝘾𝙮𝙗𝙚𝙧𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 by Jasmin Gider (Tilburg University - Tilburg University School of Economics and Management), Luc Renneboog (Tilburg University - Department of Finance), and Tal Strauss (European Central Bank ECB) compares and contrasts the regulatory landscapes of data privacy and cybersecurity in the EU and the US. It outlines the fragmented nature of US regulations, often relying on state-specific laws and sectoral approaches, in contrast to the EU's more unified framework like 𝗚𝗗𝗣𝗥 and 𝗡𝗜𝗦 Directives. The text details the increasing costs and frequency of cyber incidents, emphasizing the insufficient mandatory disclosure requirements in both regions. Furthermore, it identifies gaps in current legislation and ongoing efforts, such as the 𝗘𝗨'𝘀 𝗖𝘆𝗯𝗲𝗿 𝗥𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗔𝗰𝘁 and the US.'s 𝗖𝗜𝗥𝗖𝗜𝗔, to enhance 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 and address underinvestment in 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆.