DORA Contractual Requirements, Explained (2026)

DORA changed what a financial firm's technology contracts must say. If you are a bank, insurer, investment firm or many other regulated financial entities in the EU, your contracts with technology vendors now have to contain a defined set of terms. Leave them out and the contract is non-compliant, whatever the commercial deal. This guide explains what DORA is, who it covers, and the exact contract terms it requires, including the heavier set for services that support a critical or important function. It is general information, not legal advice; confirm a live deal with a qualified EU lawyer. ## What DORA is DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It applies from 17 January 2025. Its aim is to make the EU financial sector resilient to technology disruption, so it sets rules on ICT risk management, incident reporting, resilience testing, information sharing and, importantly here, the management of risk from ICT third-party providers. It covers a wide range of financial entities: credit institutions, payment and e-money institutions, investment firms, insurance and reinsurance undertakings, crypto-asset service providers, fund managers, trading venues and more. It also reaches the ICT providers that serve them, and it creates an Oversight Framework for providers designated as critical (critical ICT third-party providers, or CTPPs). ## Why the contract matters DORA treats the contract as a control. It expects financial entities to manage ICT third-party risk across the whole life of the relationship: before signing, during the service, and at exit. Article 28 sets the general principles, including keeping a register of information on all contractual arrangements for ICT services. Article 30 is where the specific contract terms live. So the contract is not just commercial paper; it is evidence that the firm can oversee, test and exit its technology dependencies. ## The mandatory contract terms for every ICT contract Under Article 30(2), every contract for ICT services must include, as a minimum: - A clear and complete description of the services, including whether subcontracting of a critical or important function is allowed and on what conditions.

• The locations where services are provided and where data is processed and stored, with notice of any change.
• Provisions on availability, authenticity, integrity and confidentiality, including protection of personal data.
• Provisions on access to, recovery of and return of data in an easy-to-use format if the provider becomes insolvent, winds down, or the contract ends.
• Service level descriptions.
• A duty on the provider to assist the financial entity at no additional cost, or at a cost agreed in advance, if an ICT incident relates to the service.
• A duty on the provider to cooperate with the financial entity's competent authorities.
• Termination rights and minimum notice periods for termination, in line with supervisory expectations.
• Conditions for the provider's participation in the financial entity's security awareness and training, where relevant. ## The extra terms for critical or important functions If the service supports a critical or important function, Article 30(3) adds a heavier set: - Full service level descriptions with precise quantitative and qualitative performance targets, so the firm can monitor and act on breaches.
• Notice periods and reporting obligations from the provider to the financial entity, including notice of developments that could materially affect the service.
• A requirement for the provider to implement and test business contingency plans and to have ICT security measures appropriate to the applicable law.
• The provider's participation and full cooperation in the financial entity's threat-led penetration testing where relevant.
• Unrestricted rights of access, inspection and audit for the financial entity, an appointed third party and the competent authority, with agreed audit levels.
• Clear exit strategies, including a mandatory transition period during which the provider keeps supplying the service while the firm moves to another provider or brings the function back in house. ## A short checklist for reviewing an ICT vendor contract 1. Identify whether the service supports a critical or important function. This decides which set of terms applies.

2. Confirm all Article 30(2) terms are present for every ICT contract.
3. For critical or important functions, confirm the Article 30(3) additions, especially audit rights, exit transition and testing cooperation.
4. Check subcontracting: is it allowed, under what conditions, and does the chain stay within DORA's reach.
5. Check data location and change notice.
6. Record the arrangement in the register of information required by Article 28.
7. Align termination and notice periods with supervisory guidance. Many firms are re-papering a large back book of vendor contracts to meet these points, which is more an exercise in finding and fixing gaps across hundreds of agreements than in drafting one clause. ## Keeping DORA terms consistent across a vendor portfolio The hard part of DORA is scale. You have to find every ICT contract, tell which ones support a critical or important function, check each against the Article 30 list, and track exit and audit terms across the portfolio. That work, surfacing missing clauses, editing clauses in plain English, keeping a structured record of each contract and tracking renewals and notice periods, is what an AI contract workspace can hold in one place. Adira is built for this, with a per-clause favourable, neutral or unfavourable risk view, a structured clause tree and plain-English clause editing with a diff; it is India-first today with other jurisdictions on its roadmap, so verify EU depth before relying on it for DORA compliance. More at Adira. The guidance above stands on its own. ## Bottom line DORA (Regulation (EU) 2022/2554, applying from 17 January 2025) makes specific contract terms mandatory for ICT services to financial entities. Article 30(2) sets the baseline for every ICT contract, and Article 30(3) adds stronger audit, testing and exit terms where the service supports a critical or important function. Classify each service, check it against the Article 30 list, keep the Article 28 register current, and get EU advice before signing or re-papering a real deal.