(1) Institutions shall implement policies and processes to - 

(a) evaluate and manage the exposures to operational risk, including model risk and risks resulting from outsourcing, and

(b) cover low-frequency high-severity events.

(2) Institutions shall articulate what constitutes operational risk for the purposes of the policies and procedures referred to in paragraph (1).

(3) Institutions shall have adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans for the technology they use for the communication of information, and that those plans are established, managed and tested in accordance with Article 11 of the DORA Regulation, in order to allow institutions to keep operating in the event of severe business disruption and limit losses incurred as a consequence of such disruption.

(4) In this Regulation, "model risk" means the potential loss an institution may incur, as a consequence of decisions that could be principally based on the output of internal models, due to errors in the development, implementation or use of such models.