The EBA stopped using the word outsourcing. Read why.

Europe just wrote the rulebook for outsourcing a critical bank function. It does not use the word outsourcing anymore.

The EBA published Guidelines EBA/GL/2026/09 on September 18, 2026. They cover third-party risk for non-ICT services.

They repeal the 2019 outsourcing guidelines. The application date is not set yet, because translation is still pending.

The concept change is the news. Outsourcing is gone as the organising idea.

In its place sits the third-party arrangement. Outsourcing is now a subset of that, and intragroup deals count too.

The deep requirements attach to one category. Critical or important functions, meaning those whose disruption would materially impair the firm.

That definition lines up with DORA. DORA governs technology services, and these guidelines cover everything else.

Read them together and the map is complete. Every external dependency a European bank has now sits in one of two rulebooks.

Firms get two years after the application date. Unfinished reviews of critical arrangements must be reported to the supervisor at that point.

Onboarding a third party has six steps. Most banks think it has two.

Step one is scope. Is this arrangement caught at all?

The old test asked whether a function was outsourced. The new test asks whether an outside provider supports a function on a recurring basis.

Step two is the criticality flag. Would disruption materially impair the firm?

Everything downstream depends on that one answer. Risk analysis, contract terms, monitoring, and exit planning all branch from it.

Step three is due diligence. The bank assesses the provider, the subcontracting chain, and whether the provider can be replaced.

Substitutability is the word that matters. A provider you cannot swap is a concentration risk by definition.

Step four is the contract. Service levels, audit rights, data location, reporting, and termination terms.

Step five is the register. The old outsourcing register becomes a third-party arrangement register.

It can be merged with the DORA register. One row per arrangement, each carrying a criticality flag.

Step six is monitoring and exit. A tested plan for leaving, not a paragraph promising one.

Now put a model into that machinery. A credit agent drafts the first assessment a bank relies on.

That is an outside provider supporting a function on a recurring basis. Step one catches it.

Step two almost certainly flags it critical. Credit assessment is not a peripheral activity.

Steps three through six are where it breaks.

Legacy outsourcing has a clean shape. A named process, a measured output, a service level.

A processing centre either handled the invoices or it did not. Failure is observable and countable.

Substitution works too. Move the contract, move the runbook, retrain the staff.

Model outsourcing has none of that shape. The output is a judgment with a confidence score attached.

Service levels do not map onto judgment. Uptime is measurable and correctness is not.

Audit rights are the second break. A bank can audit a processing centre's controls.

It cannot audit weights. Vendors supply documentation about a model, not the model's reasoning.

Version drift is the third. A provider can change the model underneath a live deployment.

The contract may not require notice. The bank's credit decisions change anyway.

The subcontracting chain is the fourth. A bank contracts a vendor.

The vendor runs on a hyperscaler, which serves a lab's model. Three parties, one register row.

Exit is the fifth and hardest. Leaving a vendor means reinstating a human process.

The analysts who wrote memos by hand have spent two years reviewing drafts instead. That skill does not sit on a shelf waiting.

Three pools move.

The first is third-party risk management itself. Every European bank needs a register, a classification method, and an evidence trail.

That is headcount and software, and it did not exist at this scale in 2024. It joins the model governance line the AI Act created in August.

The second is the vendor field, and it narrows. Only providers that can produce audit artefacts survive a criticality review.

Look at what the large vendors shipped this year. Google's financial services agent returns confidence scores, stated methods, and source citations.

That feature set is not for bankers. It is for this register.

The third is concentration, and it runs the wrong way. A rulebook that demands documentation favours the few firms that can produce it.

Three hyperscalers and a handful of labs sit under most of this. A rule designed to manage dependency will deepen it.

Note who gains without building anything. Banks already running DORA registers extend a process rather than start one.

The word outsourcing died because it described the wrong thing. A bank no longer hands out a process, it rents a judgment.

Europe has now written the paperwork for that. The paperwork is real progress and it does not solve substitutability.

What compresses is the small vendor's route into a regulated bank. What expands is the compliance apparatus around every model in production.

Watch the application date. Nothing starts until translation finishes.

Watch the first critical flag on a model harder. The first bank to flag a credit agent as critical sets the standard.

Territory: +machines on the function, +incumbents on the perimeter.

Credit judgment moves inside vendor models, while the documentation burden hands the market to the largest providers.