Glossary term
Lead Overseer (DORA)
Also: DORA Art. 32, ESA Lead Overseer
One of the three European Supervisory Authorities (EBA, EIOPA, ESMA) responsible under DORA Art. 32 for direct supervision of an ICT third-party provider designated as critical. Assigned by the ESAs' Joint Committee.
The Lead Overseer takes over the continuous supervision of a CTPP: annual oversight plan, requests for information, on-site inspections, access to technical documents, staff interviews, recommendations for risk mitigation. Recommendations are not directly binding but are enforced by national supervisors towards financial entities.
Joint Examination Teams (JET) execute the operational reviews: staff from several national supervisors, coordinated by the Lead Overseer. Working language: English at ESA level, national languages for on-site audits.
In practice
Practical relevance: financial entities must expect Lead Overseer recommendations to be passed down indirectly via BaFin, BaFin equivalents or the ECB SSM. A critical provider without a cooperative Lead Overseer relationship becomes effectively unusable for regulated customers.
Related terms
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
Critical ICT Third-Party Provider (CTPP)
ICT third-party provider designated critical by the European Commission under DORA Art. 31, falling under direct supervision of one of the three European Supervisory Authorities (EBA, EIOPA, ESMA). First CTPP designations expected in 2025/2026.
ICT Third-Party Risk
Sammelbegriff für Risiken aus dem Einsatz externer ICT-Lieferanten: Cloud-Provider, SaaS-Anbieter, MSPs, MSSPs. Unter DORA Art. 28 explizit reguliert; jeder kritische Lieferant muss in einem Register stehen und einer dokumentierten Eignungsprüfung folgen.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.