Pillar 08 · Govern
The DORA register records what you depend on; it does not tell anyone how badly. Concentration risk is an analytics layer over your supplier data, and a supervisor will ask you to show it.
DORA permits pooled and joint threat-led penetration testing where several firms rely on the same ICT provider. The coordination design, not the red team, is what decides whether the exercise is credible.
Selling insurance through third-party platforms via API pushes IDD conduct, disclosure and data duties to a distribution edge you no longer directly control. How to make the control model travel with the API.
RBNZ’s BS11 requires large registered banks to run core functions independently of a parent or provider. That is a data-severability problem, not a policy document.
How a designated critical ICT third-party provider should prepare for a DORA Joint Examination Team visit: the evidence set and operating posture an ESA-led team inspects.
The proposed HIPAA Security Rule would require covered entities to obtain annual written verification of a business associate’s technical safeguards. A signed BAA has never told you whether a vendor is secure; this makes that explicit.
GPAI providers must give downstream integrators a documentation package under the EU AI Act. Read it as an integrator and it tells you what compliance work you still own.
NIS2 Article 21(2)(d) demands security across the supply chain. Segment suppliers by criticality and build repeatable, tiered assessment and monitoring instead of stale one-off questionnaires.
A single LLM gateway gives regulated firms resilience, cost control and observability that scattered per-app SDK calls never will. Here is the reference pattern.
The UK’s critical third parties regime went live on 13 July 2026, but designation does not touch your own due-diligence duty. Here is how to get assurance evidence from providers who will not rewrite a line for you.