What does EBA/GL/2026/09 (third-party risk) say about AI in banking?

What are the key points of EBA/GL/2026/09 (third-party risk)?

• Identity and status: final report EBA/GL/2026/09 dated 18 September 2026, issued under Article 16 of Regulation (EU) No 1093/2010, so competent authorities and financial institutions 'must make every effort to comply' and competent authorities must notify the EBA whether they comply; the notification deadline is left blank in the final report.
• Application date not set (paragraphs 18-22): the Guidelines 'apply from [date]' to third-party arrangements entered into, reviewed or amended on or after that date; where the review and documentation of arrangements supporting critical or important functions are not finalised two years after the application date, the entity should inform its competent authority, including the measures planned or the possible exit strategy; other arrangements may be reviewed at renewal. The 2019 Guidelines on outsourcing are repealed from the same placeholder date.
• Split with DORA (paragraphs 5, 7 and 32): the Guidelines apply to non-ICT services 'other than those within the scope of Chapter V' of DORA; ICT risk and ICT services as defined in Article 3(21) of DORA are excluded 'as they fall within the scope of DORA'. Where a non-ICT arrangement also implies the use of ICT services, the financial entity determines whether that use is material and so triggers the DORA framework. Entities 'should have a holistic approach' across both.
• Critical or important functions (paragraphs 17 and 34-36): a function whose disruption would materially impair financial performance, the soundness or continuity of services, or continuing compliance with authorisation; the executive summary says the definition is 'fully consistent' with DORA's. Operational tasks of internal control functions are treated as critical or important unless the entity's assessment shows a failure would not harm those functions, and banking, payment or token-issuance functions performed to an extent that requires authorisation are treated so automatically.
• Governance (paragraphs 38-49): the management body defines, approves and regularly reviews a third-party risk strategy and approves a written policy, reviewed at least once a year; its responsibilities cannot be delegated; the entity must not become an 'empty shell'; a role or senior manager is made accountable for third-party risk, and that role can be combined with the DORA Article 5(3) role. The policy may be merged with the DORA Article 28(10) policy but must distinguish ICT from non-ICT services.
• Register (paragraphs 58-63): an updated register of all third-party arrangements in scope, with extra fields for critical or important functions (governing law, latest audit dates, subcontractors, substitutability assessment). It should be consistent 'to the extent possible' with the DORA Article 28(3) register of information, may be combined with it in a single register, and is given to the competent authority on request in a processable electronic form.
• Lifecycle (paragraphs 68-116): pre-contract assessment of criticality, risks (including concentration risk and scenarios of high-severity operational events) and due diligence; a written contract with minimum terms; conditions, notification and a right to object for subcontracting of critical or important functions; access, information and audit rights for the entity, its competent authority and resolution authorities; termination rights; ongoing monitoring; and a documented exit strategy.
• Exclusions (paragraph 33): services legally required to be performed by a third party such as statutory audit, regulated financial services performed by another regulated financial entity, market information services, inter-bank and central-bank transactions and payment network infrastructures, among others.
• Supervisors (paragraphs 117-128): competent authorities analyse third-party risk at least within the SREP, may ask for detailed information on any arrangement, monitor concentration risk and its potential impact on financial stability, and may limit the scope of the services provided or require exit from an arrangement.

What did EBA/GL/2026/09 (third-party risk) change for banks?

The 2019 Guidelines on outsourcing arrangements (EBA/GL/2019/02, 25 February 2019) covered outsourcing by credit institutions, investment firms, payment institutions and electronic money institutions. EBA/GL/2026/09 replaces 'outsourcing' with the wider 'third-party arrangement' (outsourcing is a subset), extends the addressees to issuers of asset-referenced tokens and mortgage creditors that are financial institutions, and removes ICT services from scope because DORA now governs them, while aligning the definition of critical or important functions, the policy and the register with DORA. The EBA's press release says the Guidelines concentrate on arrangements supporting critical or important functions to reduce the burden for less material ones, take account of the Basel Committee's Principles for the Sound Management of Third-Party Risk, and come with a two-year transitional period. Nothing in the text is specific to AI.

What does EBA/GL/2026/09 require of banks that use third-party service providers?

EBA/GL/2026/09 asks a bank to treat every recurrent or ongoing arrangement with a third-party service provider for a non-ICT service as a third-party arrangement, decide whether it supports a critical or important function, and apply a full lifecycle of controls where it does: a management-body strategy and written policy, pre-contract risk assessment and due diligence, a written contract with audit, access and termination rights, a register, ongoing monitoring and a documented exit strategy. ICT services are outside these Guidelines and remain under DORA. The Guidelines were published on 18 September 2026 and have no application date yet.

The Guidelines are the EBA's update of its 2019 outsourcing guidelines for a rulebook that now includes DORA. The final report says increased reliance on third-party service providers 'requires an evolution of the traditional notion of outsourcing to the broader scope' of third-party arrangements, and that non-ICT services are brought into scope 'to bridge the gap and to enable financial entities to have a holistic approach on third-party risk management'. The legal base is Article 74 of the Capital Requirements Directive on governance arrangements, with the investment-firm, payment-services, MiFID II and MiCAR mandates taken into account.

Proportionality runs through the text. Stricter provisions apply only where a provider supports a critical or important function; for other arrangements the entity keeps governance in place on a risk basis, access and audit rights are considered on a risk-based approach, and existing contracts can be reviewed when they are renewed. Intragroup arrangements are subject to the same framework as external ones, although the entity may take its higher level of control into account in the risk assessment.

The Guidelines address supervisors as well. Title V asks competent authorities to analyse third-party risk at least within the supervisory review and evaluation process, to make sure entities are not operating as an 'empty shell', and to identify concentration at providers, monitoring its potential impact on other financial entities and on the stability of the financial system.

WHAT THIS MEANS IN PRACTICE

• The Guidelines say a financial entity may keep one strategy, one policy and one register across ICT and non-ICT services, provided the policy distinguishes the two and the register stays consistent with the DORA register of information.
• Arrangements supporting critical or important functions are reviewed and documented within two years of the application date; if not, the entity informs its competent authority with the measures planned or the possible exit strategy.
• The application date, the compliance-notification deadline and the repeal date of EBA/GL/2019/02 are all blank in the 18 September 2026 final report; the EBA's guideline page shows them once set.