The cloud now has a supervisor: DORA, UK CTPs and concentration risk

In less than eight months, regulators put the world’s biggest clouds under direct supervision. On 18 November 2025 the three EU financial supervisors named 19 critical tech providers under DORA, Microsoft, AWS and Google Cloud among them. On 13 July 2026 the UK designated 4 cloud providers, Microsoft, Google Cloud, AWS and Oracle, as critical third parties to its financial system. For twenty years, an outage at a cloud provider was each bank’s own problem; now the provider has a supervisor too. The Financial Stability Board is building the same lens for AI providers. This week’s 20-hour Microsoft 365 outage, which had a stock exchange asking companies to phone instead of email, is the first big test of what that supervision actually means.

Contents · 10 sections

TL;DR #

• The EU (DORA) and the UK (the Critical Third Parties regime) now oversee the biggest cloud providers directly, not only through the banks that use them.
• Both regimes aim at resilience and recovery, not at preventing outages. They accept that big providers will fail sometimes.
• Designation does not move responsibility. A bank that runs on Microsoft still owns its own outage plan.
• The FSB is building indicators for concentration in AI providers. I expect AI model providers to be designated within one to two years.
• For ordinary companies and engineers, the practical effect is more questions about concentration, exit plans and tested recovery, and more demand for people who can answer them.

What the EU did: DORA’s critical providers #

The Digital Operational Resilience Act has applied to EU financial firms since 17 January 2025. Most of it is about the firms themselves: ICT risk management, incident reporting, resilience testing and contracts with tech suppliers. One part is new. It lets the European supervisors oversee the suppliers directly when the financial system depends on them.

On 18 November 2025 the EBA, EIOPA and ESMA published the first list: 19 providers. Published reporting names, among others, AWS, Google Cloud, Microsoft, Oracle, SAP, IBM, Orange, Deutsche Telekom, Bloomberg, NTT, the London Stock Exchange Group and Tata Consultancy Services. The list mixes hyperscale clouds with data-centre, network and finance-specific technology providers.

How did the supervisors decide? DORA requires every financial firm to keep a register of its ICT contracts. The supervisors pooled those registers and ran a criticality assessment against DORA’s criteria: how systemic the impact of a failure would be, how important the firms that rely on the provider are, how much they rely on it for critical functions, and how hard it would be to substitute. The providers judged critical were notified and could respond before the list was published.

What does oversight mean in practice? A lead overseer from one of the three supervisors assesses each provider’s risk management, governance, incident handling, subcontracting and ICT security. It can request information, investigate and inspect, and it issues recommendations. If a provider does not follow them, the supervisor can make that public. As a last resort, financial firms can be required to suspend or end their use of the provider’s services. Providers pay oversight fees, and the list will be updated every year.

What the UK did: critical third parties #

The UK built a parallel regime through the Financial Services and Markets Act 2023. HM Treasury designates the providers, and the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority oversee them together.

On 10 July 2026 the government announced its first designations, effective 13 July 2026:

• Microsoft Ireland Operations Limited
• Google Cloud EMEA Limited
• Amazon Web Services EMEA SARL
• Oracle Corporation UK Limited

Two limits matter. Oversight covers only the services these companies provide to the UK financial sector, not the rest of their business. And designation is not a seal of approval: it says the provider matters, not that it is safe. The Treasury describes the regime as rolling, so more designations can follow. According to one law-firm summary, the providers must show they can prevent, adapt to, respond to, recover from and learn from operational incidents.

The FSB: AI providers are next #

The Financial Stability Board has worried about this since its 2019 cloud report, which said concentration “could pose avenues for financial stability risks”. It published a toolkit on third-party risk in December 2023. Its October 2025 report on monitoring AI adoption goes further. Using that toolkit, it proposes indicators for the “criticality, concentration, substitutability and the systemic relevance” of third-party AI service providers. It also admits the hard part: it is difficult to tell when an AI service becomes systemically important.

My reading, and it is an inference, not a documented plan: the large model providers will follow the clouds onto the designation lists within one to two years. The logic is the same. A few providers, used by many firms, with little practical fallback.

What regulators are really saying #

Read the two regimes together and a quiet admission emerges. Neither tries to make outages impossible. Both focus on testing, incident reporting, exit plans and recovery. That is Charles Perrow’s argument from Normal Accidents, translated into rulebooks: in complex, tightly coupled systems, failure is normal, so plan for it. The regulators have moved from “is each bank’s outsourcing sound?” to “where are the system’s single points of failure?”

Timing is telling too. The DORA list came out weeks after the AWS us-east-1 outage and the Azure Front Door failure of October 2025. This week’s outage hit a provider that is now on both lists. Microsoft 365 was down for about 20 hours, and Euronext told listed companies to phone rather than email. LSN News, my news engine, counted 4,556 articles from 2,272 outlets in 55 languages on it. I expect supervisors to ask Microsoft hard questions about it. What they publish, if anything, will show how much teeth the new oversight has. As of 13 November I have seen no public statement from either regime about this incident.

What it means for ordinary companies #

If you are a bank, insurer or investment firm, little of your work goes away. Designation does not transfer responsibility. You still need your register of ICT contracts, a concentration assessment, a tested exit or fallback plan for critical services, and your own incident reporting. What changes is that your supervisor now also sees your provider’s side, so “the cloud was down” carries less weight as an explanation for why your customers could not pay.

If you are not in finance, you are not directly covered, but the ideas travel. The EU’s NIS2 directive already pushes essential and important entities to manage supply-chain risk. Large customers increasingly copy DORA-style questions into procurement: which provider, which region, what happens if it fails, and when did you last test that? Expect those questions even from customers who are not regulated.

What it means for engineers #

The practical work is what good platform teams already know, now with an auditor attached:

• Map your real dependencies, including identity, DNS, email and the SaaS your incident process runs on.
• Write down what happens when each critical provider is unavailable for 24 hours, and test it.
• Keep a recovery path that does not share fate with the main provider: out-of-band communication, break-glass identity, offline runbooks.
• Make exit plans real, in the form of data exports you have actually restored, not paragraphs in a policy.

This is also a career point. “I design for the provider being down” is now a skill that regulated buyers and auditors pay for. This week supplied a fresh, well-documented example to put in a design review.

What to watch #

• Whether EU or UK supervisors comment on, or ask for information about, the November Microsoft 365 outage.
• The annual DORA list update, expected around November, and whether it adds or drops providers.
• Further UK designations under the rolling regime.
• Any FSB or national move to name AI model providers as systemically important.
• Microsoft’s post-incident review, which designated providers have every reason to make thorough.

Frequently asked questions #

What is a critical ICT third-party provider under DORA? #

It is a tech supplier that the EU’s three financial supervisors judge to be systemically important to EU financial firms, because of how many firms rely on it, for what, and how hard it would be to replace. The first 19 were named on 18 November 2025, and those providers are now under direct EU oversight.

Which cloud providers are designated in the UK? #

Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL and Oracle Corporation UK Limited, from 13 July 2026. The Bank of England, the PRA and the FCA oversee them jointly, for the services they provide to the UK financial sector.

Does designation mean these providers won’t have outages? #

No. Both regimes aim at resilience and recovery, not prevention. This week’s Microsoft 365 outage happened at a provider designated in both the EU and the UK.

Does my company need to do anything if it is not a bank? #

Not under these regimes directly. But NIS2 and large customers’ procurement rules increasingly ask the same questions about concentration, fallback and tested recovery, so it is worth having answers.

Will AI providers be regulated the same way? #

Not yet, as of 13 November 2026. The FSB has proposed indicators for measuring concentration in AI providers. My expectation, which is an inference, is designation within one to two years.

The lesson #

The interesting thing about the new regimes is what they concede. Regulators did not try to make the cloud unbreakable. They accepted that a handful of providers now carry the financial system, that those providers will sometimes fail, and that the job is to make failure survivable and visible. That is the right lesson for everyone else too. You cannot audit your way out of concentration risk, but you can know where it is, and you can test what you would do on the day it bites.