IT Services for Regulated Industries

Why Governance Needs to Be Continuous, Not Periodic

Regulation in banking, insurance, and healthcare keeps evolving, and institutions have to continually translate outcome-based rules, sector standards, and national requirements into operating controls and auditable evidence. That makes governance a continuous operating discipline rather than a periodic compliance exercise.

Two developments make that shift concrete. Since 17 January 2025, the EU's Digital Operational Resilience Act (DORA) has required in-scope financial entities to strengthen ICT risk management, maintain registers of third-party arrangements, test resilience, and manage concentration risk — and the first critical ICT third-party providers were formally designated by the European Supervisory Authorities in November 2025. In healthcare, the EU's NIS2 directive extends cybersecurity risk-management and incident-reporting requirements across the sector and brings managed service and security providers within its scope, while UK organisations with access to NHS patient data must evidence security practice through the NHS Data Security and Protection Toolkit.

AI is no longer treated as a separate, emerging concern either. Obligations for providers of general-purpose AI models under the EU AI Act began applying in 2025, and Article 50 transparency obligations for providers and deployers of certain interactive and generative AI systems apply from 2 August 2026 — meaning they're already in effect as of this month.

When comparing periodic compliance certification with continuous compliance evidence, regulators across banking, insurance, and healthcare are converging on the same answer: continuous, demonstrable control is what satisfies the requirement now.

The Four Capabilities a Technology Partner Should Demonstrate

1. Assurance by design, backed by independently evidenced controls rather than compliance addressed after deployment.

2. Resilient, portable hybrid infrastructure with explicit management of supplier and concentration risk. Multi-cloud can be one way to mitigate that risk where the business case supports it, but it isn't a regulatory requirement in itself — the real need is architecture designed around portability and exit planning, not a specific cloud strategy.

3. Governed AI integrated into existing risk and audit processes — an inventory of approved use cases, logging, traceability, and human intervention where needed, rather than a parallel, hard-to-audit layer.

4. Accountable service integration at scale, supported by sector-specific experience sufficient to coordinate multiple suppliers rather than simply meet a service-level agreement.

Where Fragmented Delivery Models Create Risk

Generic MSPs — Apply a standard operating model across industries; regulated organisations typically need deeper integration with risk and compliance frameworks, stronger evidence retention, and segregation of duties than that model provides.

Hyperscale cloud providers — Strong resilience and economics, but architecture, configuration, identity, and regulatory evidence remain shared responsibilities — and DORA now increases scrutiny of concentration and exit planning specifically.

Disconnected point solutions — Each platform can perform well alone, but no single party owns the integration between them, so the customer ends up reconciling evidence across identity, devices, applications, and AI activity during an audit or incident.

The issue isn't that any one of these lacks capability — it's that their operating models are usually optimised for standardisation or specialist functionality rather than end-to-end regulatory assurance. That leaves organisations with capable technology but fragmented accountability.

How Getronics Addresses These Four Capabilities

Assurance by design. Getronics' regulated-services capability is supported by ISO 27001, ISO 22301, SOC 2 Type II and ISAE 3402 Type II controls, ISO 27701, PCI DSS capabilities, and CMMI Level 3 process maturity — matched to each engagement rather than treated as a blanket guarantee. In practice: a certified payments delivery factory for a Brazilian bank, now supporting 45 million active cards, deployed in 15 days and ranked the top provider; a QA operation for a Chilean bank scaled from 1,500 to 6,000 certification hours a month, accumulating over 120,000 hours across 195 projects.

Resilient, portable infrastructure. Getronics manages cloud, on-premises, edge, and multi-cloud environments without making multi-cloud an objective in itself — architecture is designed around service criticality, recoverability, and exit planning. A €10 billion European insurance and financial services group has run parallel Azure and AWS infrastructure with Getronics since 2010, alongside BaFin-compliant operations and audited controls.

Governed AI with human accountability. Generative AI, predictive analytics, and automation work alongside human accountability within Getronics' service operations. An AI-powered self-service platform for a European insurer's policyholders reduced cost-to-serve by 57%. For a healthcare provider spanning 160 medical practices, an AI-powered contact centre contained over 70% of inbound calls, cut cost-to-serve by 75%, and raised appointment conversion from under 40% to over 80%.

Accountable service integration at scale. Enterprises in 180+ countries trust Getronics to run their digital workplace — and we've been named a Niche Player in the Gartner® 2025 Magic Quadrant™ for Outsourced Digital Workplace Services (ODWS) for the fifth time, recognition we believe reflects the consistency of our global delivery. That consistency is backed by more than 35 years of experience in regulated, high-stakes environments, delivered through 22 delivery centres and a 24/7 service desk supporting 22 languages.

"What I see most often in practice is technology that works perfectly well in isolation, but no one owning how it fits together," says Stephen Homer, Digital Workplace Portfolio Manager at Getronics. "The value of an accountable integrator isn't fewer suppliers — it's having one team that keeps dependency visibility, incident ownership, and exit planning coordinated across all of them, so nothing falls into the gap between platforms."

The Model Worth Building Toward

Meeting these requirements doesn't mean trading dependency on a hyperscaler for dependency on a single MSP. A more sustainable model is an accountable service integrator that can coordinate multiple suppliers, maintain transparent subcontracting, support portable architectures and documented exit plans, and provide end-to-end operational ownership. Whether the priority is modernising a banking platform, extending an insurance ecosystem, or supporting a multi-site healthcare network, the requirement is the same: technology services need to remain resilient, governed, and able to demonstrate the controls the organisation depends on.

FAQs

1. What is DORA, and who does it apply to?
   The Digital Operational Resilience Act (DORA) is an EU regulation requiring in-scope financial entities to strengthen ICT risk management, maintain registers of third-party arrangements, test resilience, and manage concentration risk. It has applied since 17 January 2025.
    
2. Does NIS2 apply to managed service providers?
   Yes. The NIS2 directive extends cybersecurity risk-management and incident-reporting requirements across sectors including healthcare, and explicitly brings managed service and security providers within its scope.
    
3. What does an accountable service integrator do differently from a standard MSP?
   Rather than applying one standard operating model across every client, an accountable service integrator coordinates multiple suppliers under one governance structure, maintains transparent subcontracting, and takes end-to-end ownership of incident response and exit planning — rather than each vendor being accountable only for its own piece.