The service dependency matters more than its label.

The EBA published final guidelines on third-party risk related to non-ICT services. The publication describes a proportionate framework aligned with DORA and focuses attention on critical or important functions. It addresses the relationship across its lifecycle, including assessment, contractual arrangements, monitoring and exit planning. The document is a supervisory framework with its own scope and implementation arrangements, rather than a checklist applicable to every business.

Editorial interpretation: teach dependency mapping through a customer journey. Ask what happens when an external service becomes unavailable, who can restore the journey and what evidence proves recovery. An inventory becomes useful when it connects providers to concrete customer and operational consequences.

A question for your next team meeting

What would we need to verify before this changes our workflow?