The European Banking Authority has published its final Guidelines on the management of third-party risk for non-ICT services, moving beyond the traditional outsourcing framework towards a broader approach to external dependencies. The new framework strengthens expectations around governance, critical or important functions, due diligence, contractual safeguards, monitoring, concentration risk and exit planning, while complementing DORA's framework for ICT-related third-party risk. Financial entities should assess their existing third-party arrangements and governance structures in preparation for the new supervisory expectations.