Unsuitable use of Level 2 and 3 Regulation

Problem

There is a political wish to reduce the reporting requirements put on European companies as expressed by von der Leyen during her State of the Union speech on 13 September 2023.  Commission President von der Leyen committed to reducing reporting requirements by 25% on European businesses stemming from EU regulation. The ambition is widely welcomed by European businesses as the realisation of this will reduce burdens and strengthen the competitiveness of European companies.

At the same time though, the use of level 2 and 3 regulation is on the rise and especially the European agencies often use the level 2 regulation to introduce reporting requirements that are not proportionate to the aim of the level 1 regulation as adopted by the legislators.  

One example is the implementation of the Digital Operational Resilience Act (DORA). According to Article 28(3) of DORA, all financial entities are required to maintain and update a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT Third Party Service Providers (ICT TPPs).

In continuation hereof, Article 28(9) of DORA mandates the European Supervisory Authorities (ESAs) to develop a draft implementing technical standard (ITS) to establish the templates for the purposes of the register of information, including information that is common to all contractual arrangements on the use of ICT services.

The ITS drawn up requires the financial entities to register 100+ data points for each ICT TPP. Thus, it is an overwhelming task for financial entities to develop the comprehensive registers and manually populate the extensive taxonomy. In other words, the benefit to cost ratio between strengthening the digital operational resilience within the financial sector and the administrative burden put on the FEs is disproportionate and skewed and not in line with the political aim of reducing reporting requirements as suggested by the Commission President.

In general, the approach of in relation to level 2 and 3 regulation is not sustainable as:

1. it is often not aligned with overall political objectives as emphasis is put on narrow practical issues tightly connected to oversight activities, and
2. the benefit to cost ratio between meeting the objectives of the level 1 regulation and the administrative burden put on the European companies is too often skewed resulting in increased administrative burdens and increased costs for companies and consumers.

Justification for proposal 

The current use of level 2 and 3 regulation is not sustainable. Too often the technical regulation adopted by an agency is not aligned with the political objectives of the original act. As a consequence, the benefit-to-cost ratio between meeting the aims of the level 1 regulation and the administrative burden put on the European companies is too often disproportionate and skewed.

Consequences for Danish and EU businesses

The current approach in relation to drawing up level 2 regulation leads to the introduction of regulation that put disproportionate requirements on European companies and weakens the competitiveness of Danish and EU businesses.  

Affected EU-legislation

In general, the unsustainable use of level 2 and 3 regulations can be detected across the EU regulation. E.g., in relation to the implementation of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (“DORA”)

Cf. 1) the Member States should call for the Commission and the agencies to introduce a truly risk-based approach when drawing up level 2 regulation, meaning it should be ensured, that the reporting requirements put on the European companies mirror the risks faced by the individual company. Furthermore, the agencies should be mandated to perform impact assessments – in accordance with the criteria outlined in the Commission’s “Better regulation” agenda – when drafting reporting requirements, to ensure, that the administrative burden put on the European companies by introducing a specific reporting requirement, is proportionate to the aim(s) of the level 1 regulation.  

Cf. 2) the current process for drawing up level 2 and 3 regulations is flawed when it comes to checks and balances, as the processes take place outside the realm of politics, i.e. the decisions are not subject to any controls at political level. In addition, the interests and outlook of the actors involved in the processes – civil servants from oversight authorities – are to a large extent overlapping and driven by a strive to accumulate information to ease the task of performing oversight and therefore tend to disregard the administrative burden put on European businesses.

Whereas oversight activities are important elements in ensuring safety and a level playing field in the single market, it is not the sole element in the efforts to create a well-functioning single market in the EU. Other elements are equally important such as competition and innovation.

To counter the shortcomings of the current system, it should be the norm to involve relevant organisations such as large European business interest associations and consumer associations to a larger extent in the drafting process. The current system with broad consultations, when the draft regulations have been finalised, is evidently not working. Key organisations need to be involved at an earlier drafting stage in the process. This could take place via stakeholder meetings and consultations concerning preparing impact assessments.   
 
Cf. 3) In view of the above it should be considered by the legislators if the present wide use of level 2 and 3 regulation is optimal or in the future to a larger extent rely on regulating via level 1 regulation. This would enhance the political control with the regulation via the Council and the European Parliament and thereby ensure that the regulation is aligned with the political objectives of the legislators. 

Regeringen kan delvist tiltræde anbefalingen. Regeringen har det som en klar ambition, at EU-regulering skal påføre danske virksomheder færrest mulige byrder og rapporteringsforpligtelser. Regeringen er derfor også opmærksom på de byrder, der stammer fra level 2 og level 3 regulering. Regeringen arbejder derfor for, at level 2 og 3 regulering kun introduceres, hvor det er relevant, og at level 2 og 3 regulering skal påføre erhvervslivet færrest mulige byrder. Konkret arbejder Regeringen for, at level 2 og 3 regulering skal have proportionalitet, overholde lovgivningens formål samt have en risikobaseret og evidensbaseret tilgang. Herudover arbejder regeringen for, at der skal udarbejdes konsekvensanalyser i væsentlige tilfælde og at relevante interessenter skal involveres, hvor det er relevant i udarbejdelsen af level 2 og 3 regulering. Regeringen kan derfor tiltræde, at der arbejdes for disse principper i interessevaretagelsen mod EU-Kommissionen i tråd med anbefalingen.

Regeringen kan således tiltræde indholdet i anbefalingen, men regeringen ønsker at organisere interessevaretagelsen mod Kommissionen på anden vis end gennem et brev med ligesindede lande til forpersonen for den Europæiske Kommission, Ursula Von Der Leyen. Regeringen har allerede flere igangværende interessevaretagelsesindsatser mod Kommissionen med ligesindede lande, der sigter mod at nedbringe byrder for erhvervslivet, hvor brugen af level 2 og 3 regulering indgår som en del af denne interessevaretagelses indsats. Det vurderes derfor ikke optimalt for indsatsen at igangsætte udarbejdelsen af et separat brev til Kommissions forperson Ursula Von Der Leyen på nuværende tidspunkt. Det vurderes i stedet, at man kan opnå de ønskede mål i anbefalingen om at reducere byrder fra level 2 og 3 regulering gennem disse igangværende indsatser, hvilket regeringen vil fortsætte med at arbejde for.