Article 6 Notification de l’externalisation des obligations de déclaration

Summary What does Article 6 of the ITS on templates for incident reporting say?

This article governs the transparency obligations that apply when a financial entity chooses to outsource its major ICT-related incident reporting duties to a third party, as permitted under Article 19(5) of Regulation (EU) 2022/2554.

It establishes a clear notification duty in both directions: when the outsourcing arrangement begins and when it ends, ensuring the competent authority is always aware of who is responsible for submitting incident reports at any given time.

Important points:

Inform your competent authority of any outsourcing arrangement for incident reporting before the first notification or report is submitted.
Provide the competent authority with the name, contact details, and identification code of the third-party submitting reports on your behalf.
Inform your competent authority as soon as the outsourcing arrangement for reporting obligations is no longer in place.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

1. Les entités financières qui ont externalisé l’obligation de déclarer les incidents majeurs liés aux TIC en vertu de l’article 19, paragraphe 5, du règlement (UE) 2022/2554 informent leur autorité compétente de cet accord d’externalisation dès que celui-ci a été conclu et, au plus tard, avant la première notification ou déclaration.
1. Les entités financières communiquent à l’autorité compétente le nom, les coordonnées et le code d’identification du tiers qui soumettra, en leur nom, les notifications ou rapports d’incidents majeurs liés aux TIC.
1. Les entités financières informent leur autorité compétente dès qu’elles n’externalisent plus leurs obligations de déclaration selon l’article 19, paragraphe 5, du règlement (UE) 2022/2554.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.