In this Legal Update, we highlight the main changes introduced by ASF Regulatory Standard 6/2026-R of October 20, which sets out reporting obligations to the ASF on digital operational resilience under Regulation (EU) 2022/2554 (the “Digital Operational Resilience Act” or “DORA”) and Law 73/2025 of December 23.
Regulatory Standard 6/2026-R sets out the information to be reported to the ASF on contractual arrangements with ICT third-party service providers, major ICT-related incidents, and significant cyber threats. To this end, it amends Regulatory Standards 4/2023-R, 5/2023-R, and 13/2020-R, and repeals Regulatory Standards 6/2022-R, 7/2024-R, and 9/2024-R, as well as Circular 3/2025.
Regulatory Standard 6/2026-R entered into force on October 29, 2026. However, the obligation to notify the ASF in advance of planned contractual arrangements for ICT services supporting critical or important functions applies only from November 27, 2026.
These amendments aim to avoid overlapping regimes and reporting requirements and to simplify the existing reporting of cyber incidents. Such reporting will now be quarterly rather than monthly and will no longer include economic impact variables.
The new obligations include the annual submission to the ASF, by February 28, of the register of information on all contractual arrangements with ICT third-party service providers. Our understanding is that the first submission must be made by February 28, 2027.
Regulatory Standard 6/2026-R applies to insurance and reinsurance companies (including branches of third-country companies), pension fund management companies, and insurance, reinsurance, and ancillary insurance intermediaries subject to DORA.