AmCham EU publishes position on Digital Operational Resilience Act (DORA)

The use of technology in financial services is not new. In fact, the financial services industry has always been at the forefront of testing and adopting new technologies to transform the financial services industry, increase competition and efficiency, as well as offering new solutions to its customers. What is new is the speed of innovation we are seeing in recent years covering all aspects of the financial services sector and leading to the development of new business models, services and products.

Amongst these new developments is the use of information and communications technology (ICT), which finds itself at continuously greater use in the sphere of finance, requiring greater security resilience for firms. The Digital Operational Resilience Act (DORA) represents thus a crucial step towards a harmonized EU framework for digital resilience in financial operations. Due to the unique factors coming together in the financial services sector, given its fast evolution, increased diversification and international nature, additional care needs to be taken into consideration in the adoption of the new proposed regulation. Read our position here.

News
7 Mar 2021
Digital, Financial services
AmCham EU publishes position on Digital Operational Resilience Act (DORA)

As the voice of American businesses invested in Europe, AmCham EU emphasises the transatlantic dimension and the need for a coordinated international approach to ICT risk management in this paper. The recommendations contained within this paper therefore focus on building on existing international practices and call for openness to incorporating international best practices into the implementation of the EU’s digital operational resilience.

The issues addressed in this paper include general principles; cloud computing; third-country provisions; intragroup delegation; ICT risk management; legislative consistency; the designation critical third-party providers; testing; incident reporting; EU oversight of critical third-party providers; contractual arrangements; outsourcing and sub-outsourcing; cyber threat information sharing; sanctions and penalties; oversight fees; and the implementation period.

Related items

News
19 Jun 2026

Examining Europe’s AI ambitions with the Cypriot Presidency of the Council of the EU

How can Europe strengthen its digital resilience while remaining open to the partnerships that drive AI innovation? On Wednesday, 17 June, Malte Lohan, CEO, AmCham EU, addressed this at a conference organised by the Cypriot Presidency of the Council of the EU in Nicosia, Cyprus. Discussions focused on how Europe can build a more resilient digital ecosystem while remaining an attractive destination for investment and innovation. Mr Lohan underlined that secure supply chains and trusted partnerships are essential to Europe’s AI competitiveness. He also highlighted the role of US businesses as committed partners in helping Europe build and compete globally, while stressing the need for balanced policies that strengthen resilience and give companies the confidence to invest in Europe.

Presidency
Digital
Simplification
Read more
Read more about Examining Europe’s AI ambitions with the Cypriot Presidency of the Council of the EU
News
10 Jun 2026

Discussing transatlantic regulatory cooperation with SEC Commissioner Mark Uyeda

On Wednesday, 10 June, AmCham EU hosted Mark Uyeda, Commissioner, US Securities and Exchange Commission, for a discussion on transatlantic regulatory cooperation. The exchange focused on developments shaping global capital markets. Topics included the Savings and Investment Union, ESG and climate-related disclosures, digital finance and stablecoin regulation as well as EU-US capital markets competitiveness. Participants discussed how proportionate regulation can support innovation, lower costs for investors and contribute to economic growth on both sides of the Atlantic. The meeting also highlighted the importance of continued engagement between EU and US regulators as the financial landscape evolves.

Financial services
Read more
Read more about Discussing transatlantic regulatory cooperation with SEC Commissioner Mark Uyeda
News
5 Jun 2026

Tech Sovereignty Package: positive steps for energy resilience, but a risky gamble for digital competitiveness

This week the European Commission unveiled its Tech Sovereignty Package. While the Package’s energy proposals mark a significant step forward for EU energy resilience, the Cloud and AI Development Act (CADA) proposal overlooks the reality of global technology supply chains and introduces significant legal uncertainty and fragmentation for businesses.

The central question for the Tech Sovereignty Package is how to build resilience without undermining competitiveness. Concerns around overdependence on a limited number of providers, the risk of external disruption to service continuity and the long-term position of the EU’s digital industries are all legitimate. However, greater sovereignty will only be sustainable if it is built on a competitive, diverse and innovative digital ecosystem. The technologies that underpin the global digital economy are developed through highly international supply chains, with innovation spread across multiple markets.

Viewed through this lens, the individual proposals in the Package vary in the extent to which they reinforce resilience while preserving openness and competitiveness. In particular, the proposed CADA risks discriminating against providers that rely on global supply chains – both those based in Europe and those in third countries – even where they offer superior resilience.

‘An origin-based approach is too blunt for such a complex global market’, said Malte Lohan, CEO of the American Chamber of Commerce to the European Union, commenting on the Package.

‘A more credible path to achieving greater resilience and control in such an interconnected landscape is to define sovereignty in terms of outcomes: secure and reliable technologies, customer choice, strong safeguards against undue interference and a business environment that supports investment and growth. That points to a risk-based framework where the EU is open to working with trusted partners. This trust should be assessed on the basis of objective standards rather than origin alone’, Mr Lohan added.

Last year alone, US technology firms operating in Europe and their supply chains supported €1.0 trillion in EU GDP, equivalent to 5.4% of total output. The scale of this contribution underscores the need for the EU to preserve an open environment with legal clarity and proportionality in any restrictions or safeguards that would impact commercial operations.

The Package’s Strategic Roadmap for Digitalisation and AI in energy is a positive step that could help unlock the benefits of digitalisation for Europe’s energy needs, enabling faster and more flexible grids. Digitalisation provides new opportunities to strengthen the reliability and resilience of energy systems. If executed well, the roadmap could support the growing demand of Europe’s digital and AI sectors for low-carbon energy.

Ultimately, the importance of the Tech Sovereignty Package extends well beyond the technology sector itself. Manufacturers, healthcare and life sciences, financial services, mobility, energy and retail all increasingly depend on access to advanced digital technologies to innovate and compete. For the Tech Sovereignty Package to support these sectors, it must ensure companies in Europe continue to benefit from economic openness.

Digital
Read more
Read more about Tech Sovereignty Package: positive steps for energy resilience, but a risky gamble for digital competitiveness