The question that arrives from procurement is always the same: is this product DORA compliant? It has no answer. Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA), does not certify information and communication technology (ICT) products. It places duties on the financial entity that buys them. No supplier discharges those duties for you, and no badge in a sales pack closes them. What the regulation does give you is a sequence of checks to run before signature, and a record to keep afterwards. This article is that sequence.
Why no ICT product is DORA compliant
DORA regulates financial entities. It also brings a small number of providers under direct oversight by the European Supervisory Authorities (ESAs) once they are designated as a critical ICT third-party provider (CTPP), under Articles 31 to 44. What it does not operate, anywhere in the text, is a product certification scheme. There is no conformity mark for software, no register of approved platforms, and nothing a provider can hand you that transfers the obligation.
The duties that bite are yours. You assess the arrangement before you enter it (Article 28(4)), you record it (Article 28(3)), you make sure the contract carries the required provisions (Article 30), and you keep the ability to leave (Article 28(8)). Designation changes who supervises the provider, not who owes those four duties. Even where a provider is a designated CTPP, the entity still records the arrangement in its Register of Information, applies the Article 30 provisions, and assesses concentration risk under Article 29.
So reframe the procurement question before you answer it. Not is this product compliant, but can this arrangement be evidenced against Articles 28 to 30, and would I put the file in front of my competent authority as it stands? The six steps below are what turns the second question into a yes. The ICT third-party risk guide covers the Article 28 to 30 chain end to end; this is the pre-signature slice of it.
Step 1: Decide whether the service supports a critical or important function
This decision governs the depth of everything that follows, so it is the one to settle first. A critical or important function (CIF) is defined at Article 3(22): a function whose disruption would materially impair the financial performance of the entity, or the soundness or continuity of its services and activities, or whose discontinued or defective performance would materially impair continued compliance with the conditions and obligations of its authorisation. Any single limb is enough.
Answer yes and the full pre-contractual regime engages: the Article 28(4) assessment, the Article 28(8) exit strategy, the reinforced service levels at Article 30(3), and the two delegated regulations covering third-party policy and subcontracting. Answer no and the arrangement is lighter, but it still goes into the Register of Information. There is no category of ICT contract that escapes the register.
| What to settle | Legal basis | Evidence that closes it |
|---|---|---|
| Whether the function the service supports is critical or important | Art. 3(22) | A decision record per function: the function in one line, the reasoning limb by limb, the conclusion, the approver and the date |
| That the decision followed your board-approved third-party policy | Art. 28(2), RTS (EU) 2024/1773 | The policy version in force at the decision date, and the minute approving it |
Our guide to identifying critical or important functions works through the definition itself, and the CIF decision record sets out what the written record has to contain. The common failure here is silence: a function nobody ever classified is a function you cannot defend either way.
Step 2: Run the pre-contractual assessment
Article 28(4) is the step procurement most often skips, because the commercial decision usually arrives already made. Before entering any new arrangement with an ICT third-party service provider for a critical or important function, the financial entity must conduct a proportionate due diligence assessment. Proportionate sets the depth, not whether you do it, and the reasoning that made a given depth proportionate is itself an artefact worth keeping.
What the assessment has to reach is wider than a security questionnaire. It covers the provider itself, the service as it will be delivered in practice, where it will be delivered from, who else sits in the chain behind it, and whether the provider will cooperate with audit and inspection. A platform that is technically excellent and contractually opaque fails this step.
| What to assess | Legal basis | Evidence that closes it |
|---|---|---|
| The provider's ability to deliver the service to the standard the function needs | Art. 28(4) | The completed assessment, dated, with the conclusion and the assessor named |
| Locations of service delivery and of data processing and storage | Art. 30(2)(b) | Named countries, not regions, confirmed in writing by the provider |
| The subcontracting chain as it stands at signature | Art. 30(2)(a), RTS (EU) 2025/532 | A named list, with the function each subcontractor touches |
| Audit, access and inspection cooperation | Art. 30(2) and (3) | The clause text as agreed, not a statement of intent in a sales document |
If you would rather start from a prepared instrument than draft one, the free due diligence questionnaire puts 22 requirements drawn from Articles 28 to 30 into an editable Excel workbook, each with an evidence column and an assessment column, so the answers arrive in a form you can file. The third-party risk scorer then turns the answers into a score you can take to a committee.
Step 3: Assess concentration before you sign, not at year end
Article 29 requires you to assess ICT concentration risk, and a single contract never shows it. The exposure appears when you count across the estate: how much of your critical or important functions depends on one platform, counted at group level, and whether a credible alternative provider exists. The sharpest version of the problem is invisible in every individual contract, which is the same subcontractor sitting behind several of your providers at once.
Running this at signature rather than at the annual review changes the outcome, because at signature you still have leverage. Once the migration is done, the concentration you created is a finding you manage rather than a decision you make.
| What to assess | Legal basis | Evidence that closes it |
|---|---|---|
| Dependency on this provider across all critical or important functions, at group level | Art. 29 | The concentration assessment showing the share per provider, with the counting basis stated |
| Whether a substitutable alternative provider exists | Art. 29 | The alternative provider analysis, including the case where the answer is none |
| Shared subcontractors behind otherwise unrelated providers | Art. 29, RTS (EU) 2025/532 | The chain view across providers, not provider by provider |
Step 4: Check the contract carries the Article 30 provisions
Article 30 turns the assessment into obligations that survive the relationship. The clauses below are the ones a reviewer opens first. Treat a missing clause as a blocking issue rather than a drafting preference, because after signature it becomes a change request you have to pay for.
| Clause group | Legal basis | What it has to state |
|---|---|---|
| Services and subcontracting | Art. 30(2)(a) | A full description of the functions and services, and the conditions attached to subcontracting them |
| Locations of services and data | Art. 30(2)(b) | The countries where the service is delivered and where data is processed and stored, and notice before they change |
| Data protection, access and return | Art. 30(2)(c) and (d) | Availability, integrity and confidentiality of data, plus access and return of data on exit and on insolvency |
| Service levels | Art. 30(2)(e), and Art. 30(3)(a) for a CIF | Quantitative and qualitative performance targets, updated on changes, with reporting that lets you see them |
| Incident assistance, cooperation and training | Art. 30(2)(f), (g) and (i) | Assistance at no additional cost or at a pre-agreed cost, cooperation with your competent authorities, and the conditions of the provider's participation in your ICT security awareness and training programmes |
| Termination and notice | Art. 30(2)(h), with Art. 28(7) | Termination rights, minimum notice periods, and the circumstances that trigger them |
The full clause list, including the additional provisions that only apply to arrangements supporting a critical or important function, is set out on the ICT third-party risk guide. Reading the same ground from the other side of the table is often faster than arguing it: our guide for ICT providers is what a well-prepared supplier has already read.
Step 5: Settle subcontracting and the exit while you still have leverage
Two obligations are routinely deferred to after signature, and both get harder once the service is live.
The first is subcontracting. Commission Delegated Regulation (EU) 2025/532, the regulatory technical standards (RTS) on subcontracting of ICT services supporting critical or important functions, has applied since 22 July 2025. It covers what a financial entity must determine and assess before allowing subcontracting at all: notification of changes, visibility into the chain, the concentration that the chain creates, and transparency over where data sits. The practical consequence is that a contract which lets the provider subcontract freely, with notice given afterwards, does not meet the standard.
The second is the exit. Article 28(8) requires exit strategies for services supporting critical or important functions, so that termination does not disrupt the entity. An exit strategy drafted after signature is a negotiation you have already lost, because the provider now holds the data, the configuration and the timetable. Write the exit before you sign, and make sure the data return clause at Article 30(2)(d) says the same thing your exit plan assumes.
| What to settle | Legal basis | Evidence that closes it |
|---|---|---|
| The conditions under which subcontracting is permitted, and how changes reach you | Art. 30(2)(a), RTS (EU) 2025/532 | The agreed conditions, the notification mechanism, and the assessment you ran before permitting it |
| An exit strategy that does not depend on the provider's goodwill | Art. 28(8) | The documented exit plan: trigger, transition route, data format, timetable and the tested assumption |
Step 6: Write the arrangement into the Register of Information
Article 28(3) requires every in-scope financial entity to maintain a Register of Information (RoI) on all contractual arrangements for the use of ICT services provided by third-party providers, and to report it to its national competent authority. The format is not yours to choose: Commission Implementing Regulation (EU) 2024/2956, the implementing technical standards (ITS) on the register, sets out 15 templates in a machine-readable xBRL-CSV form.
This is where the assessment pays for itself. The register wants the provider's legal entity identifier (LEI) and legal name, the services, the locations, the function supported and the subcontracting chain, which is exactly what steps 1 to 5 established. Collect those at assessment time and the register entry is transcription. Collect them at reporting time and you are re-opening a closed negotiation under a deadline.
One check before you file: the register entry and the contract have to say the same thing. A register that names three countries while the contract names two, or that omits a subcontractor the contract permits, is the first inconsistency a supervisor notices. The Register of Information guide covers the templates and the format, and the build methodology sets out the order to populate them in.
What the assessment record contains
A reviewer does not ask whether you assessed the provider. They ask to see the assessment, dated, with a name on it. Six artefacts close the file:
| Artefact | Answers |
|---|---|
| The CIF decision for the function the service supports | Art. 3(22) |
| The completed pre-contractual assessment, with the provider's answers and your conclusion | Art. 28(4) |
| The concentration assessment and the alternative provider analysis | Art. 29 |
| The signed contract, with the Article 30 clauses identified clause by clause | Art. 30(2) and (3) |
| The subcontracting conditions and the exit plan | Art. 28(8), RTS (EU) 2025/532 |
| The Register of Information entry, consistent with all of the above | Art. 28(3), ITS (EU) 2024/2956 |
Keep them together, per arrangement, rather than scattered across procurement, legal and the risk function. The file is the deliverable.
Three answers that should stop a signature
Most assessments end in a negotiation rather than a refusal. These three answers are the exceptions, because each one leaves an obligation you cannot meet by any other route.
No audit, access or inspection. If the provider will not grant access rights to you, your appointed third party and your competent authority, you cannot satisfy Article 30, and for a critical or important function you cannot evidence oversight of the service at all.
No named subcontracting chain, or changes notified after the fact. Under RTS (EU) 2025/532 you have to assess the chain before you permit it. A provider who will not name it is asking you to accept a dependency you are required to have assessed.
No data return on exit or insolvency. Article 30(2)(d) exists because this is the clause that decides whether an exit strategy is real. Without it, the Article 28(8) exit plan is a document describing something you cannot do.
None of these three depends on the size of the contract, and proportionality under Article 4 does not soften them: a proportionate control is still a control that exists on paper.
What to do next
Take the arrangement currently closest to signature and run it through the six steps in order. Start at step 1, because if the function is not classified, the depth of every later step is unsettled. Send the provider the due diligence questionnaire rather than a bespoke email, so the answers come back in a filing format, score the result with the third-party risk scorer, and keep the six artefacts above in one place per provider.
If this is the first arrangement you have taken through the full sequence, expect the gaps to be in steps 3 and 5 rather than in the contract itself. Concentration and exit are the two obligations that no supplier raises for you, and the two that are cheapest to fix before signature and most expensive to fix after it.
