DORA Didn’t Give You One Hard Contract. It Gave You a Thousand.
The Digital Operational Resilience Act tells you exactly what your ICT contracts must say. The hard part is that they all have to say it — every agreement, every renewal, every new vendor.
The EU’s Digital Operational Resilience Act is unusually specific about what it wants. What makes it hard to comply with has less to do with understanding the regulation than with the number of contracts it reaches.
DORA is clear about the terms it requires. Article 30 lists what a contract between a financial entity and a provider of information and communication technology (ICT) has to contain: a full description of the services, the locations where data is processed and stored, how that data is protected, how incidents are handled, the firm’s right to monitor and audit, controls on subcontracting, service levels, and an exit plan. For the ICT services that support a critical or important function, the list is longer still.[1] It reads, in effect, as a checklist. Sit down with one contract and that list, and you could work through it in an afternoon.
The catch is that you never have just one contract.
The regulation is a checklist. Your estate is the workload.
A bank, an insurer, a payment firm — none of them run on a single ICT agreement. They run on dozens, often hundreds: the core platform, the cloud, the data feeds, the SaaS tools scattered across every department, the payment rails, the analytics vendor someone signed up two years ago. Almost all of it sits on the provider’s paper. Much of it was signed before DORA existed, or was re-papered since with an addendum that may or may not carry the terms Article 30 actually requires.
DORA has applied since January 2025 across the EU’s financial sector — an estimated 22,000 firms — and it reaches their ICT suppliers through the contracts those firms are now required to hold.[2] Compliance here is not a policy you adopt once and file. It is a term-by-term review of every one of those agreements against the same list, and then every renewal, and every new provider onboarded after this. The requirement is settled. The volume is the problem.
Where the time actually goes
Financial firms rarely struggle to understand what DORA asks for. They struggle to check it, across the whole estate, at the speed contracts keep arriving, and to check it the same way every time.
Reading a single ICT contract properly against Article 30 takes a specialist the better part of an hour: is the data location actually stated, or only implied; is the audit right unrestricted, or quietly capped; is there an exit plan at all, or does the service simply stop at termination. Multiply that by a vendor list that keeps growing, and the review turns into a project that never quite closes. Two reviewers reading two contracts reach two different conclusions about whether a “reasonable security” clause is good enough. A legacy agreement with no exit plan sits unnoticed until an examiner asks to see it.
I don’t read any of that as a failure of the people doing the work. It is what happens when a specific, high-stakes review lands on a lean legal or vendor-risk team, across more contracts than anyone can read by hand, with a regulator’s checklist as the standard and no practical way to apply it evenly to all of them.
Let software make the first pass
Software handles this kind of pattern-matching well. LegalSifter ReviewPro reads an ICT contract or a DORA addendum against the Article 30 terms, in minutes, inside Word. It flags where a required term is missing or too weak: no description of the functions, an undisclosed data location, an audit right narrowed so it cannot be exercised, a subcontracting clause with no conditions, no exit plan. It redlines what falls outside your positions and surfaces the calls that need a person’s judgment.
It helps on more than one front at once. It scales, so every contract in the estate gets the same pass, not only the ones someone had time to worry about. It carries the Article 30 standard in a playbook, so the reviewer does not have to hold the whole regulation in their head to catch a gap. And it applies that standard consistently, leaving a record of what was checked and changed that you can put in front of a regulator. It is a first pass, not a compliance opinion. Your counsel and compliance function still own that determination; ReviewPro lets them spend their time on the genuine gaps rather than re-reading contracts that are already fine.
The same review works from the other side of the table. If you are the ICT provider being handed a DORA addendum — and any software company selling into EU financial institutions increasingly is — reading it against your own positions tells you what you are being asked to commit to, and where an obligation is not operationally achievable, before you sign.
Start with what’s critical
Begin with the contracts that carry the most weight: the ICT services supporting your critical or important functions, where DORA’s requirements are strictest. Write down the Article 30 positions you expect every one of those agreements to meet, turn them into a playbook, and run the contracts through a first pass. Two things come back quickly — a list of which agreements have gaps, and a realistic sense of how much of the estate you can clear per week once the routine review is off your team’s plate.
None of this is going away. The regulation is settled, and the vendor list only grows. What is still open is whether your contracts actually carry the terms DORA requires, and whether you can show it the day a supervisor asks. That is the part worth getting ahead of: an estate held to one standard, a review your team can keep pace with, and a file that answers the question before it is put to you.
See how ReviewPro reviews ICT contracts and DORA addenda for financial services firms →
Notes
- The mandatory contractual terms summarized here are set out in Article 30 of Regulation (EU) 2022/2554 (DORA), which requires a baseline set of terms for all ICT service contracts and an enhanced set for services supporting a critical or important function. Full text: EUR-Lex, Regulation (EU) 2022/2554, Article 30 — https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng. ↩
- DORA entered into force on 16 January 2023 and has applied since 17 January 2025 to the EU financial sector, commonly estimated at around 22,000 financial entities, and to their ICT third-party service providers through the contractual requirements DORA places on those firms. Sources: EUR-Lex, Regulation (EU) 2022/2554; Commission de Surveillance du Secteur Financier (CSSF), “Entry into application of DORA on 17 January 2025” — https://www.cssf.lu/en/2025/01/entry-in-application-of-dora-regulation-on-17-january-2025/. ↩
ReviewPro is not legal or compliance advice. Confirm your positions with your counsel and your compliance team.