The final report on the Regulatory Technical Standard (RTS) on Subcontracting introduces helpful guidance and addresses several key points raised by industry during the consultation period. However, certain provisions remain concerning. The scope of application continues to be overly broad, imposing all the requirements in the RTS on all information and communication technology (ICT) subcontractors that provide ICT services supporting critical or important functions, which risks unnecessary complexity. A more focused application of the requirements to subcontractors that effectively underpin the primary ICT service would allow for a more proportionate and risk-based approach to third-party risk management. Furthermore, the timeline for implementation is insufficient given the scale of changes required. The RTS introduces substantial new obligations that will necessitate updates to existing contractual and operational frameworks. To ensure smooth and effective compliance, a minimum implementation period of two years from the finalisation of the RTS is essential.
Recommendations for Regulatory Technical Standards on Subcontracting under the Digital Operational Resilience Act
Related items
:focal())
Reducing complexity in Europe’s digital rulebook
The EU’s digital regulatory landscape has expanded significantly in recent years. While the creation of these rules pursues important objectives, their interaction has not always been fully aligned, creating legal uncertainty and increased compliance burdens for businesses.
The European Commission’s proposals for a Digital Omnibus and the Digital Omnibus on AI Regulation Proposal (AI Omnibus) both offer opportunities to improve coherence across the EU’s digital rulebook while supporting Europe’s competitiveness in the digital economy. Both initiatives represent a positive step forward, but further refinements will be needed to ensure they fully deliver on their objectives while maintaining high standards for safety and fundamental rights.
The AI Omnibus focuses on the AI Act, while the Digital Omnibus addresses broader elements of the digital acquis, including data and cybersecurity legislation. Together, they aim to reduce fragmentation and streamline obligations across multiple frameworks. Explore below how these proposals can better support innovation and competitiveness in Europe.
:focal())
Discussing digital policy priorities with MEPs in Strasbourg
From Monday, 9 to Wednesday, 11 March 2026, AmCham EU travelled to the European Parliament in Strasbourg for a series of meetings with policymakers to discuss ongoing EU digital policy initiatives. The delegation met with members of the European Parliament, accredited parliamentary assistants and group policy advisers , to discuss priorities for the EU’s digital agenda. This includes exchanges on AI Omnibus, Digital Omnibus, Cybersecurity Act review, the Digital Networks Act and the upcoming Cloud and AI Development Act. Throughout the meetings, members emphasised the importance of urgent action to support the simplification of overlapping digital rules, strengthening cybersecurity while avoiding fragmentation in the Single Market and supporting innovation through proportionate, risk-based regulation.
Advancing EU data and cybersecurity rules through the Digital Omnibus
Policy priorities
Insights and advocacy driving Europe’s policy agenda. Our priorities support growth, innovation and a stronger transatlantic economy.
Membership
Connecting business and policymakers to strengthen the voice of American companies in Europe.