Moira Cronin explains how the Digital Operational Resilience Act will impact Irish-based financial services providers, enhancing ICT risk management and digital resilience The Digital Operational Resilience Act (DORA) came into effect on 17 January 2025. Designed to consolidate and upgrade information and communications technology (ICT) risk requirements in the financial sector, DORA applies common standards to all financial system participants. Its aim is to mitigate ICT and cyber risks across providers’ operations. So, what does this Act mean for financial services providers based in Ireland? Legal basis DORA removes obstacles to—and improves the establishment and functioning of the internal market for—financial services, by harmonising the rules applicable in ICT risk management, reporting, security control testing and ICT third-party risk. Subsidiarity The proposal harmonises the digital operational component of a deeply integrated and interconnected sector already benefitting from a single set of rules and supervision in most other key areas. For ICT-related incident reporting, only EU harmonised rules could reduce administrative burdens and financial costs associated with reporting the same ICT-related incident to different EU and national authorities. Proportionality Proportionality is designed in terms of scope and intensity through qualitative and quantitative assessment criteria. While the new rules cover all financial entities, they are also tailored to the risks and needs of their specific characteristics in terms of their size and business profiles. Proportionality is also embedded in the ICT and cyber-risk management rules, digital resilience testing, reporting major ICT-related incidents and oversight of critical ICT and cyber third-party service providers. Choice of instrument The measures needed to govern ICT and cyber risk management, ICT and cyber-related incident reporting, testing and oversight of critical ICT and cyber third-party service providers must be contained in the regulation to ensure that the detailed requirements are effectively and directly applicable in a uniform manner, without prejudice to proportionality and specific rules foreseen by this regulation. Three DORA requirements businesses should aim to achieve are: 1. ICT-related incident reporting One of the main requirements for financial entities is to establish and implement a management process to monitor and log ICT and cyber-related incidents, followed by an obligation to classify them based on criteria detailed in the regulation and further developed by the European Supervisory Authorities (ESAs) to specify materiality thresholds. Only ICT-related incidents deemed significant must be reported to the competent authorities. 2. Cyber operational resilience testing The capabilities and functions included in the ICT risk management framework need to be periodically tested for preparedness, identification of weaknesses, deficiencies or gaps and prompt implementation of corrective measures. This regulation allows for a proportionate application of digital operational resilience testing requirements depending on financial entities' size, business and risk profiles. 3. ICT and cyber third-party risk The regulation is designed to ensure a sound monitoring of ICT and cyber third-party risk; financial entities shall be required to observe several key elements in their relationship with ICT and cyber third-party providers, remaining fully responsible for complying with and discharging all obligations. To this end, contracts governing this relationship will be required to include: At least a complete description of services; An indication of locations where data is processed; Full-service level descriptions accompanied by quantitative and qualitative performance targets; Relevant provisions on accessibility, availability, integrity, security and protection of personal data; Inspection and audit by the financial entity or an appointed third-party; Clear termination rights; and Dedicated exit strategies. As such, DORA should be taken into consideration in close coordination with NIS Directive version 2, CBI Operational Resilience Guidelines and the EU Critical Infrastructure Directive. DORA is part a package of digital finance measures designed to further enable and support the potential of digital finance in terms of innovation and competition while mitigating the risks arising from it. It aligns with the European Commission's priorities to make Europe fit for the digital age and build a future-ready economy that works for the people. Moira Cronin is Digital Risk Partner at PwC Ireland

Two distinctly opposing leadership ideologies now exist, but could one damage your organisation? Michael O'Leary explores the current state of leadership Thirty years ago, the late Colin Powell, former US Secretary of State, listed 18 lessons for leaders in a presentation titled A Leadership Primer. He talked about authenticity, optimism, challenging others and not being afraid to be challenged back. Fast forward to 2025. A friend with a successful track record as a leader and entrepreneur says he fears the examples young people are now exposed to by political leaders around the world –namely, their values, naked self-interest and fervent intolerance for people different from themselves. Beyond Powell’s single set of leadership principles, we now have two diametrically opposing “successful” leadership ideologies – one which engages others around common goals, innovation and adaptability and the other around a populist, narcissistic personality, sewing divisiveness and confrontation. Growth in disinformation on social media and in vested print media has spurred an undesirable social contagion of the latter, meaning organisations now need to consider how to combat these external influences on their internal leadership behaviours. As the global economy stumbles, having a positive, optimistic and thriving organisation culture is essential. Who you recruit as a leader determines your culture. Here are the three leadership traits we see too often in geopolitics and how to avoid hiring them. Trait 1: Strict dogma and rigid perspective Even leaders who deliver results occasionally believe that to get things done, they need to do it themselves. The consequences include a feeling of exclusion for employees and that their opinions are not wanted. This erodes collaboration and disengages the team over time. Hire leaders who can give examples of adapting on the move and can describe in detail how they brought their teams on a new journey. Look for leaders who have recognised when to pivot and have engaged with their teams to work out a new direction or multi-pronged approach. Trait 2: Intense control and single-mindedness In extreme cases of dictatorial leadership, curiosity is deliberately stifled. The leader seeks to control matters tightly to their agenda. Curiosity has deep riches; it is the key to continuous improvement, innovation and building connections between people. Leaders should inspire their teams to be open-minded and look for new ways of achieving outcomes. Ask your potential leadership hires to outline examples of where they have completely let go of an issue and had it worked through by a team or team member to the point of resolution. Look for leaders who can respond quickly when asked to give an example of inquisitiveness. Trait 3: Investing only in self Fear of the unknown can drive irrational levels of support for geopolitical leaders, even in the face of their aberrant conduct. Within the context of organisational leadership, self-absorbed leaders are dangerous to team or group morale. Their staff turnover will often be higher as their lack of authenticity undermines their credibility. How self-aware is the leader you are interviewing? Are they attuned to their emotions and impact on others? Can they give examples of areas in which they need development? Do they rely too heavily on their charisma? While it can be useful in motivating others, it can also suggest a potential for arrogance and the need to be at the centre of attention. Though the world and our organisations currently face an unusual number of difficulties, organisation leaders with the right traits understand how to insulate against malign influences and navigate challenges. Their ability to bind intellectual agility to practical demonstration is what makes them outstanding leaders. They do this by behaving in a diametrically opposing manner to those political leaders who seek personal gain at an extreme cost to their citizens. Michael O'Leary is Chairperson at HRM Search Partners

Emma Broderick explains how suppliers of virtual events must account for VAT where customers are located, complicating compliance The EU VAT treatment of live streaming and virtual events services has changed with effect from 1 January 2025. Suppliers of such events will need to consider whether it will be necessary to account for VAT in multiple EU jurisdictions and how to efficiently manage any associated registration ‘footprint’. A virtual event isn’t defined in VAT law, but could include live-streamed events or other online events that involve people interacting in a virtual environment rather than meeting in a physical location.  The change is intended to apply VAT where the service is consumed, in line with the normal place of supply rules for business-to-business (B2B) services and similar rules for electronically supplied services provided on a business-to-consumer (B2C) basis. New measures Currently, VAT is levied on live-streamed events, including virtual events, where that event takes place. This means that live-streamed events are subject to VAT in the country in which the event is taking place, even if the viewers are located in a different jurisdiction. This is the case regardless of the business or non-business status of the customer. From 1 January 2025, EU law applies VAT to such events where the viewer, or customer, is located. This operates as follows: For B2B supplies, the EU business recipient may be required to self-account for reverse charge VAT in their EU country of establishment. For B2C supplies, the supplier will be responsible for collecting and remitting VAT in the EU country where the customer is located. This is intended to bring the VAT treatment of virtual events into alignment with that of other telecommunication, broadcasting and electronically supplied services (including streaming services or the delivery of other pre-recorded content). A pan-European €10,000 threshold applies for EU and NI businesses, and a nil threshold applies for non-EU established businesses. This change follows an amendment to the VAT place of supply rules for certain events services in Directive 2022/542. Irish law has not yet been amended to implement these changes, but we anticipate a statutory instrument to this effect will be issued in the coming weeks. Going forward The VAT treatment of events provided on a B2C basis will change considerably and bring about increased costs of compliance for businesses providing such B2C virtual services. The provider of the online events may need to register and charge VAT in each EU country where their final customers reside. Suppliers of live-streamed and virtual events will need to think about how to identify the location of their consumers and understand the impact of being subject to VAT in another EU jurisdiction. There is a VAT registration simplification available, known as the VAT One Stop Shop, to facilitate one single-EU-wide registration to remit output VAT on supplies, but there remains a challenge of monitoring differing VAT rates across the EU and pricing, contracting and invoicing decisions associated with this. The impact on cross-border B2B supplies should be less significant, as business customers should be able to self-assess for VAT on the reverse charge basis in their country of establishment, but suppliers will still need to consider invoicing and relevant VAT reporting requirements. Emma Broderick is a tax partner at Grant Thornton

As 2024 breaks temperature records, Derarca Dennis explores how businesses are advancing net zero strategies and why urgent climate action is essential In November, the EU climate monitor Copernicus reported that 2024 was "virtually certain" to be the hottest year on record, with warming above 1.5C, highlighting that the world was passing a "new milestone" in temperature records. These statistics, among countless others, highlight the critical need for immediate and sustained action to reduce emissions and mitigate the impacts of climate change. As the global climate crisis intensifies, the urgency for businesses to commit to and achieve net zero carbon emissions has never been more critical. The EY State of Sustainability 2024 report sheds light on the progress organisations are making towards sustainability. However, as events of recent weeks and months have shown us, every business, person and country need to do more. The global climate crisis is arguably the most pressing challenge of our time. Rising temperatures, extreme weather events and the degradation of natural ecosystems are just a few of the devastating impacts of climate change. A revision of National Defined Contributions (NDCs) is an absolute requirement as we know already that we will surpass 1.5C if we continue on current NDCs. As major contributors to global emissions, the actions businesses take to reduce their carbon footprint can have a profound impact on the overall trajectory of climate change. While part of a much bigger and very complex picture, by committing to net zero targets, businesses can help drive the systemic changes needed to transition to a low-carbon economy, protect natural resources and ensure a sustainable future for all. The EY State of Sustainability report shows that increased focus on sustainability is evident in the high rate of adoption of formal sustainability strategies among businesses. According to the report, 70 percent of respondents have approved and implemented a sustainability strategy, with the same number reporting alignment between that strategy and the overall business strategy. This alignment is crucial as it ensures that sustainability is integrated into the core operations and decision-making processes of the organisation. However, 35 percent of respondents feel their organisation is not doing enough, a notable rise from 17 percent in 2022. While it’s positive to see the overall trajectory of sustainability in business in Ireland moving in the right direction, it’s equally heartening to see that organisations are beginning to understand that there is much more to do. One of the most encouraging findings from the report is that 55 percent of organisations are aiming for net zero science-based targets, with 40 percent having established a clear roadmap towards achieving net zero. Leadership plays a crucial role in driving sustainability efforts, with 53 percent of organisations assigning C-suite responsibility for sustainability. In 67 percent of these cases, the CEO or managing director leads the initiative, while in 22 percent, the responsibility falls to the chief sustainability officer or head of sustainability. The assignment of sustainability responsibilities to senior leaders underscores the high priority businesses place on achieving their net zero targets. This commitment from the top is a clear signal to employees, customers and stakeholders of an organisation’s dedication to sustainability. And we need more leaders to follow suit to set the tone from the top if we, as a collective business community, are to play our part in halting the climate crisis. Why business emissions reductions matter Businesses are significant sources of greenhouse gas emissions, creating emissions through electricity and other energy use, manufacturing, transportation, agriculture and food waste, among others. By reducing their emissions, businesses can: Mitigate climate change: Lowering emissions helps to slow the rate of global warming, reducing the frequency and severity of climate-related disasters such as hurricanes, floods, and wildfires. Protect ecosystems: Reducing emissions can help preserve biodiversity and protect ecosystems that are vital for maintaining the planet's health and resilience. Drive innovation: The pursuit of net zero can spur innovation in clean technologies and sustainable practices, creating new business opportunities and driving economic growth. Enhance reputation: Companies that lead in sustainability can enhance their brand reputation, attract environmentally conscious consumers, and gain a competitive edge. Ensure regulatory compliance: As governments worldwide implement stricter environmental regulations, businesses that proactively reduce their emissions will be better positioned to comply with new laws and avoid penalties. The adoption of formal sustainability strategies, risk and materiality assessments, clear KPIs, and accountability, along with a strong commitment to science-based targets, are all essential steps towards achieving net zero. While there is more to do, it is very encouraging to see all the progress made in the past two years and great to see business leaders continuing to commit to building a better future for all. Derarca Dennis is Assurance Partner and Sustainability Services Lead at EY

When considering the trajectory of artificial intelligence, it’s worth looking back to see forward, writes Tania Kuklina Though it’s hard to believe now, following the invention of the World Wide Web in 1989, it took several years for businesses to realise its potential and value.   That journey began, slowly and tentatively, with ‘portals’ providing information for investors and the curious public. Next came sites assisting job applicants or helping customers to make purchasing decisions. With Web 2.0, businesses moved towards self-service models, enhancing customer engagement and user experience. In a clear case of back to the future, what we are currently witnessing in relation to artificial intelligence (AI) is similar, as businesses are only gradually beginning to understand its potential. Of course, it is already here and in a variety of guises. It provides enhanced search capabilities and supports learning and teaching. It can write, summarise and analyse large documents. In the realm of computer vision, AI is already being used for context-specific focus tracking in digital cameras. Despite these advancements, we are still waiting for AI’s first “killer app”, the groundbreaking application that will revolutionise and disrupt the world like the first internet browser on the World Wide Web.   We do not know if this application will be a job killer or a job creator, but what we do know is that, when it comes, it will shape the thinking of employers and employees about AI within their own organisations.   Productivity challenge At present, we believe AI will replace humans in low-stakes tasks. It is increasingly being used for customer engagement tasks, such as the pop-up web chat screens that sometimes launch when we visit websites. But as AI becomes more widespread and demystified, and the large language models that power them are cheaper to build, businesses are returning to a fundamental question – what is its value to them?   For businesses ready to look at their processes in a new way, the best way to assess AI’s value is the old-fashioned way – through business case assessment and return on investment.   Opportunities for improvement need to be quantified, processes may need to be redesigned and specific AI applications need to be developed. Total costs, including regulatory compliance, must be measured against potential benefits. People power People have a key role to play in assessing AI’s value proposition and making the technology work. As part of this work, several trends have emerged. First, workers still struggle with basic AI concepts and applications. Many do not grasp what AI implies for their roles, nor question why they should master a technology that might eventually take their jobs. This uncertainty underscores the need for clear communication and education about AI's personal benefits and potential. It is also increasingly clear that the success of generative AI (GenAI) technologies and the ability to realise their value depends on the ability of the workforce to adopt and apply them effectively. Despite this, many organisations are pushing for rapid adoption before their teams are fully equipped. As GenAI features evolve constantly, providing employees with consistent, stable and coherent learning experiences will prove difficult. With an ever-changing curriculum, Gen AI learning must be broad-based and continue to keep pace with change. Employees also need abundant structured opportunities to apply and practice what they are learning. Yet AI is not well enough democratised – not every employee has access to it, or support. This could lead to the ‘Matthew effect’, which is the phenomenon wherein those with pre-existing advantages accumulate more advantages over time. If access to GenAI is unevenly distributed, it could exacerbate existing disparities. AI has already started to extend our cognitive abilities, enabling us to access, understand and process more information than ever before. Highly skilled individuals find that when they explore and figure out how to use AI to support their work, it enhances and extends their capabilities without diminishing their hard-earned skills. However, for novices, an over-reliance on AI tools may limit their ability to develop essential skills such as problem-solving and subject matter expertise. So, while Gen AI requires traditional methods of evaluating investment and return on investment, in the training and people space, we need to reconsider learning approaches. This includes incorporating data-driven measurements such as tracking understanding and perceptions of GenAI, engagement levels and sustained versus lapsed adoption. KPMG has been actively developing and supporting these initiatives for clients, including through our GenAI Academy. Get it right, now Recognising the central role people play in the AI journey is crucial. It is also important to consider the medium and long-term impacts on skills, roles, learning, and culture. Investing in workforce upskilling is the cornerstone of how organisations show their commitment to putting humans at the centre of AI transformations. We may reach a point in the future where AI can be trusted to work autonomously. We may see a digital workforce of bots emerge as our co-workers. For now, however, AI adoption is a journey in which employee engagement, participation and support are vital. Tania Kuklina is a Director at KPMG

With some organisations initiating a return-to-office mandate, what impact will this have on workers’ productivity and work quality? Ian Brinkley explores Few recent changes in the labour market have been so dramatic over such a short period as the rise in working at home during the pandemic. And much of that change has persisted in the post-pandemic period. In 2019, just four percent of employees in Ireland usually worked at home, while just over 11 percent reported doing some work remotely. By 2023, these figures had risen to 19 percent and 15 percent respectively, meaning about a third of all employees were involved in remote work, according to Eurostat. These percentages are relatively high compared to the overall standards in the EU. It is often argued that home-working makes workers more productive, improves job retention and increases job quality, such as work-life balance. It has certainly proved popular with workers, and there is some unmet demand from people who would like to work at home but cannot. However, the evidence to support these claims is not as clear-cut as we would like. Productivity While some studies have confirmed a positive impact on productivity, others have suggested it has no impact either way, and some find negative impacts. A 2023 survey from the CIPD found that while more employers reported a positive impact than a negative one, nearly half reported no impact one way or the other. Unsurprisingly, employers were much more enthusiastic about the potential positive impact on retention and recruitment than productivity. Many studies rely on self-assessment by individuals and employers as to whether they think employees are more productive at home, but do not measure actual output when working in the office versus remote work. We should not dismiss self-assessments, but they do make it hard to know just how big any positive or negative impact might be. What we can say is that in both Ireland and the UK, the rise in homeworking is not associated with better productivity performance across the whole economy. According to the Central Statistics Office, productivity performance since 2019 has been poor in both countries. It might be that any positive impacts of home working are being swamped by other changes in the economy, hampering productivity growth. Home working and work quality Homeworking may deliver more significant benefits as a flexible work option which employees value. However, the CIPD’s large-scale Good Work Index survey of workers in the UK does not show much change in most indicators of job quality between 2019 and 2024, despite the big rise in home working.  This is a bit of a puzzle. It could be that many of the people who shifted to homeworking since 2019 – mostly those in managerial, professional and technical occupations –already had good jobs, so moving to a different location did not greatly change their response.  For example, those who did work at home occasionally reported much higher levels of autonomy over how they did their work than those who did not, but it is likely that they would have said the same even if they had been working in the office.  These headline comparisons are instructive but not conclusive. We need to look at reported work quality for workers in similar jobs, with a mix of some working at home and some working in the office. It may also be that the standard work quality questions do not fully capture all the benefits of home-working to employees. The future of home-working There have been high-profile reports that some major employers – often in the US – are either insisting their workers return to the office or limit the number of days they can work at home. In the UK, civil servants working at home have also attracted criticism, albeit without much evidence of any detrimental impacts. The 2023 CIPD survey found that senior managers expressed concern about home working in about 40 percent of all employers surveyed. However, concerns about getting people back into the office when needed, managing teams, and reduced opportunities for communication, collaboration and innovation were more common than concerns that employees either could not be trusted or were less productive at home. On balance, home-working probably does have positive impacts on both productivity and work quality, but to date they have been modest. The shift to homeworking is here to stay despite attempts in some organisations to reign it back. The CIPD 2023 survey found that 20 percent of employers were putting in active steps for more hybrid working over the next 12 months. For many organisations, a better option will be to manage home-working more effectively rather than risk making themselves less competitive in labour markets by limiting a flexible work option that many employees have come to see as an expected and valued part of the work offer. As more organisations learn how to get the best out of home-working employees, perhaps homeworking will eventually start to move the dial on aggregate labour productivity. Ian Brinkley is a labour market economist and commentator