EBA Third-Party Risk Guidelines 2026: What CISOs Need to Know

Two publications, one pressure point

The first is the EBA's final Guidelines on the sound management of third-party risk, published in September 2026. They focus on third-party arrangements related to non-ICT services and give particular attention to services supporting critical or important functions. The EBA describes the framework as proportionate: higher-risk arrangements receive more scrutiny, while less material arrangements carry a lighter burden.

The second is the ECB Supervisory Letter on AI-enabled cybersecurity threats, dated 7 July 2026. The ECB says emerging AI models can identify vulnerabilities and generate functioning exploits at unprecedented speed. Its conclusion is important: this is a long-term shift in the threat landscape, and it increases the speed and scale at which existing cyber risks can materialise.

These are different documents with different scopes. The EBA Guidelines address non-ICT third-party risk and align that framework with DORA. The ECB letter is directed to significant institutions under European Banking Supervision and focuses on cyber resilience. For a CISO, both land on the same dependency problem: the organisation remains accountable for risk that sits outside its own walls.

What the EBA Guidelines change in practice

The EBA is trying to make third-party risk management more consistent across ICT and non-ICT services while keeping the approach proportionate. The Guidelines cover the full lifecycle of a third-party arrangement: risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies.

The emphasis on critical or important functions matters. The EBA describes these as functions whose disruption would materially impair the performance of a financial entity. That gives security and risk teams a practical prioritisation principle: the depth of oversight should follow the importance of the dependency.

Which ties directly to the value of Digital Proximity: understanding how closely a supplier is connected to the systems and functions you depend on gives you another way to judge which relationships deserve the deepest scrutiny. A supplier sitting close to a critical function should naturally command more attention than one with little meaningful connection to it.

The current draft already captures several consequences for teams managing those relationships: a processable register of non-ICT third-party arrangements, clear governance, visibility into relevant subcontracting, appropriate contractual rights, and documented exit and continuity arrangements. The EBA also provides a two-year transitional period to support implementation.

One important timing point: the EBA lists the final Guidelines as not yet applicable and awaiting translation into the EU official languages. The September publication is therefore a prompt to prepare, rather than a reason to imply that every requirement is already in force today.

The ECB adds urgency to the cyber side of the equation

The ECB letter is much more immediate. It asks significant institutions to assess the changing threat landscape without delay and develop a comprehensive action plan with concrete measures, resources, responsibilities and implementation timelines. That plan is due to the relevant Joint Supervisory Team by 31 October 2026.

The short-term priorities are very familiar to security leaders, but the expected pace is changing.

The ECB specifically highlights:

• accelerating vulnerability and patch management at scale;

• strengthening monitoring, detection and AI-enabled defensive capabilities;

• checking whether third-party risk management remains fit for purpose, particularly given the role of ICT service providers in critical supply chains;

• prioritising internet-facing and externally exposed assets, including cloud environments, third-party software and open-source components.

The annex goes further by calling out continuous monitoring of externally exposed assets, third-party VPN connections, perimeter technologies and the preparedness of third-party ICT service providers for faster vulnerability disclosure and patching. The ECB also reminds institutions that outsourced ICT risk remains their responsibility.

That is the problem we work on at ThingsRecon. Attack Surface Discovery gives security teams an external view of internet-facing assets and exposures, while Supply Chain Intelligence extends that visibility into supplier relationships and digital dependencies. The aim is to give teams evidence of what is actually exposed and connected, then help them decide where deeper investigation or action is warranted.

The ECB's emphasis on continuous monitoring is particularly important. External environments change constantly: infrastructure moves, services are added, suppliers change their technology, and new connections appear. A periodic inventory can only tell you what was known at the time it was created. Continuous external discovery gives security teams a way to keep testing that picture as the environment changes.

So what does this mean for CISOs and TPRM leaders?

For me, the useful way to read these publications is as a set of questions to put in front of the security, risk and procurement teams. They are less about producing another policy document and more about proving that the organisation understands the dependencies behind its critical services.

A practical reading for security leaders

What I would do next

If I were using these publications as a working session with my peers, I would keep the first pass simple. I would want to leave the room with five things clear:

1. Which third-party arrangements support critical or important functions;

2. Whether the register, asset inventory and dependency view are current enough to support that classification;

3. Where internet-facing, cloud, third-party software and open-source exposure needs faster monitoring or remediation;

4. Whether key providers and subcontracting arrangements can meet the institution’s resilience and patching expectations;

5. Who owns the resulting actions, with board and senior-management oversight where the sources require it.

The regulatory message is getting harder to ignore

DORA already made ICT third-party risk a resilience issue for the financial sector. The EBA is now extending a proportionate third-party risk framework across non-ICT services, while the ECB is telling significant institutions that the cyber threat environment requires faster action on exposure, vulnerability management and supply chain assurance.

For security leaders, the useful takeaway is practical. Know the dependencies behind critical services. Keep the exposed environment current. Understand where third parties and subcontractors sit in that picture. Then make sure governance, contracts and resilience plans can keep up with the same reality.

The spreadsheet may still exist, but the risk will keep changing around it.