{
  "url": "https://openlegislation.uk/eu-regulation-2018-1640/article-2",
  "json_url": "https://openlegislation.uk/eu-regulation-2018-1640/article-2.json",
  "legislation": "eur/2018/1640",
  "legislation_title": "Commission Delegated Regulation (EU) 2018/1640 of 13 July 2018 supplementing Regulation (EU) 2016/1011 of the European Parliament and of the Council with regard to regulatory technical standards specifying further the governance and control requirements for supervised contributors (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2018-1640",
  "path": "article/2",
  "kind": "article",
  "number": "2",
  "heading": "Control framework",
  "text": "The control framework that a supervised contributor is required to have in place pursuant to Article 16(1) of Regulation (EU) 2016/1011 shall include the establishment and maintenance of at least the following controls:\n(a) an effective oversight mechanism for overseeing the process for contributing input data that includes a risk management system, the identification of senior personnel who are responsible for the data contribution process and the involvement of any compliance and internal audit functions within the contributor's organisation;\n(b) a policy on whistle-blowing, including appropriate safeguards for whistle-blowers;\n(c) a procedure for detecting and managing breaches of Regulation (EU) 2016/1011 and breaches of the applicable code of conduct developed under Article 15 of that Regulation, including a procedure for investigating any detected breach and recording the actions taken as a consequence;\n(d) periodic reviews of the process for contributing data, to be conducted at least annually and whenever there is a change in the applicable code of conduct.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2018/1640/article/2",
    "retrieved_at": "2026-11-01T14:43:51.302805+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}