European Sovereignty Monitor

Policy and law

UK finalises rules on reporting incidents at critical tech suppliers

The Bank of England, PRA and FCA published final rules requiring UK financial firms to report operational incidents and register material third party arrangements, including cloud and tech suppliers, with compliance due by 18 March 2027.

Verified AI-drafted Financial Conduct Authority, Policy Statement PS26/2, 18 March 2026 (issued alongside the Bank of England and PRA's PS7/26)

What it does not test. Does not establish that any specific cloud or tech supplier has been designated critical, since the duty falls on firms rather than naming providers.

How this item counts. No movement: no answer to who owns, who operates, whose law governs or who made the parts changes. Weight 0. Reporting duty on UK firms only, doesn't change supplier own/operate/law/parts. European Sovereignty Index

How this item was made. Drafted by an AI system (Claude (Anthropic)) from the source cited above and published under the editor’s responsibility without a person reading it first. How the record is made

What the tags mean: VerifiedReportedAI-draftedAI-drafted, editor-readHuman-writtenWhat the tags mean

Previously in Policy and law

VerifiedOpinionAI-drafted DIGITALEUROPE's Bonefeld-Dahl: sovereignty rules need high fences only for sensitive fields ReportedOpinionAbroadAI-drafted FFO says Ofcom cannot enforce Online Safety Act fines on US websites VerifiedAI-drafted EU-backed OSOR report finds national open source policy now a sovereignty tool

All Policy and law news →