Unsuitable use of Level 2 and 3 Regulation

Problem

There is a political wish to reduce the reporting requirements put on European companies as expressed by von der Leyen during her State of the Union speech on 13 September 2023.  Commission President von der Leyen committed to reducing reporting requirements by 25% on European businesses stemming from EU regulation. The ambition is widely welcomed by European businesses as the realisation of this will reduce burdens and strengthen the competitiveness of European companies.

At the same time though, the use of level 2 and 3 regulation is on the rise and especially the European agencies often use the level 2 regulation to introduce reporting requirements that are not proportionate to the aim of the level 1 regulation as adopted by the legislators.  

One example is the implementation of the Digital Operational Resilience Act (DORA). According to Article 28(3) of DORA, all financial entities are required to maintain and update a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT Third Party Service Providers (ICT TPPs).

In continuation hereof, Article 28(9) of DORA mandates the European Supervisory Authorities (ESAs) to develop a draft implementing technical standard (ITS) to establish the templates for the purposes of the register of information, including information that is common to all contractual arrangements on the use of ICT services.

The ITS drawn up requires the financial entities to register 100+ data points for each ICT TPP. Thus, it is an overwhelming task for financial entities to develop the comprehensive registers and manually populate the extensive taxonomy. In other words, the benefit to cost ratio between strengthening the digital operational resilience within the financial sector and the administrative burden put on the FEs is disproportionate and skewed and not in line with the political aim of reducing reporting requirements as suggested by the Commission President.

In general, the approach of in relation to level 2 and 3 regulation is not sustainable as:

1. it is often not aligned with overall political objectives as emphasis is put on narrow practical issues tightly connected to oversight activities, and
2. the benefit to cost ratio between meeting the objectives of the level 1 regulation and the administrative burden put on the European companies is too often skewed resulting in increased administrative burdens and increased costs for companies and consumers.

Justification for proposal 

The current use of level 2 and 3 regulation is not sustainable. Too often the technical regulation adopted by an agency is not aligned with the political objectives of the original act. As a consequence, the benefit-to-cost ratio between meeting the aims of the level 1 regulation and the administrative burden put on the European companies is too often disproportionate and skewed.

Consequences for Danish and EU businesses

The current approach in relation to drawing up level 2 regulation leads to the introduction of regulation that put disproportionate requirements on European companies and weakens the competitiveness of Danish and EU businesses.  

Affected EU-legislation

In general, the unsustainable use of level 2 and 3 regulations can be detected across the EU regulation. E.g., in relation to the implementation of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (“DORA”)

Cf. 1) the Member States should call for the Commission and the agencies to introduce a truly risk-based approach when drawing up level 2 regulation, meaning it should be ensured, that the reporting requirements put on the European companies mirror the risks faced by the individual company. Furthermore, the agencies should be mandated to perform impact assessments – in accordance with the criteria outlined in the Commission’s “Better regulation” agenda – when drafting reporting requirements, to ensure, that the administrative burden put on the European companies by introducing a specific reporting requirement, is proportionate to the aim(s) of the level 1 regulation.  

Cf. 2) the current process for drawing up level 2 and 3 regulations is flawed when it comes to checks and balances, as the processes take place outside the realm of politics, i.e. the decisions are not subject to any controls at political level. In addition, the interests and outlook of the actors involved in the processes – civil servants from oversight authorities – are to a large extent overlapping and driven by a strive to accumulate information to ease the task of performing oversight and therefore tend to disregard the administrative burden put on European businesses.

Whereas oversight activities are important elements in ensuring safety and a level playing field in the single market, it is not the sole element in the efforts to create a well-functioning single market in the EU. Other elements are equally important such as competition and innovation.

To counter the shortcomings of the current system, it should be the norm to involve relevant organisations such as large European business interest associations and consumer associations to a larger extent in the drafting process. The current system with broad consultations, when the draft regulations have been finalised, is evidently not working. Key organisations need to be involved at an earlier drafting stage in the process. This could take place via stakeholder meetings and consultations concerning preparing impact assessments.   
 
Cf. 3) In view of the above it should be considered by the legislators if the present wide use of level 2 and 3 regulation is optimal or in the future to a larger extent rely on regulating via level 1 regulation. This would enhance the political control with the regulation via the Council and the European Parliament and thereby ensure that the regulation is aligned with the political objectives of the legislators.