Financial Services
AI Contract Review for Financial Services
Commercial risk and DORA gaps, flagged on every contract
ReviewPro evaluates your vendor agreements against your own positions, and your ICT contracts against DORA’s Article 30 requirements, in minutes, inside Microsoft Word.
On this page
A financial firm’s contract function has two jobs, and they land on the same desk. The first is the everyday estate: the SaaS subscription, the data processing agreement, the mutual non-disclosure agreement, the services agreement, most of them on the vendor’s paper.
The second is regulatory. Since January 2025, DORA requires a specific set of terms in every contract a firm holds with a provider of information and communication technology. Both jobs are the same review across dozens or hundreds of agreements, plus every renewal and every new provider.
LegalSifter ReviewPro
The everyday estate, reviewed against your positions
A bank, an insurer or a payment firm signs the same commercial agreements over and over. ReviewPro applies your playbook to the SaaS subscription, the data processing agreement, the mutual non-disclosure agreement and the services agreement.
Each is evaluated for the terms that carry risk: a liability cap with consequential damages excluded, indemnity scoped to fault, risk-based security obligations, data and intellectual property rights, auto-renewal, and payment.
DORA makes a set of contract terms mandatory
The EU’s Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It requires a specific set of terms in every contract a financial entity holds with a third-party provider of information and communication technology. It also reaches providers outside the EU that serve EU financial customers.
Article 30 names those terms, from the description of the services and the location of the data to the audit right and the exit plan. For the ICT services supporting a critical or important function, the bar is higher.
Every ICT agreement in the estate has to carry them, and so does every renewal.
ReviewPro evaluates each ICT contract and DORA addendum against those requirements and flags where a required term is missing or too weak.
ReviewPro is not legal or compliance advice. It flags gaps against defined positions; your counsel and compliance function own the compliance determination.
Article 30 · ICT third-party contracts
The DORA Contract Checklist
When a vendor agreement or a DORA addendum lands on your desk, these are the terms to confirm, the article each one comes from, and the weak versions that leave you out of compliance.
Scope, definitions and interpretation
Description of services
A clear, complete description of every function and ICT service, in the contract or a referenced schedule (Art. 30(2)(a)).
Watch for: No description, or a vague pointer that leaves the scope of the arrangement undefined.
Key definitions
“DORA” and “ICT-related incident” are defined, or tied to the Regulation.
Watch for: Terms used but undefined, so the obligations they trigger are unclear.
Order of precedence
The DORA addendum prevails over the master agreement for the ICT services.
Watch for: Master agreement controls, or no precedence stated, so the DORA terms get overridden.
Amendments
Changes are made in writing and signed, except where DORA compliance requires otherwise.
Watch for: Oral or unilateral amendment allowed.
Data: access, location and protection
Art. 30(2)(b)–(d)
Data location
The regions and countries where services are provided and data is processed and stored are named, with advance notice of any change (Art. 30(2)(b)).
Watch for: Location unstated, or the vendor can move data with no notice.
Data protection
Provisions on the availability, authenticity, integrity, and confidentiality of your data, including personal data (Art. 30(2)(c)).
Watch for: Generic “reasonable security” with none of the four properties named.
Access and return
Access, recovery, and return of your data in an easily accessible format on termination or the vendor’s insolvency (Art. 30(2)(d)).
Watch for: No return right; data effectively trapped when the contract ends.
Resilience and security
Art. 30(2)(i), 30(3)(c)
Business continuity
The vendor implements and tests business contingency plans and can restore the service after a disruption (Art. 30(3)(c)).
Watch for: “Reasonable efforts” to keep a plan, with no commitment to test it or restore service.
Security measures
ICT security measures, tools, and policies giving an appropriate level of security, kept current through the term (Art. 30(3)(c)).
Watch for: Absent, or frozen at signing with no upkeep obligation.
Resilience training
The contract sets how the vendor’s staff take part in your security-awareness and resilience training (Art. 30(2)(i)).
Watch for: No participation obligation on the vendor’s people.
Incidents, audit and testing
Art. 30(2)(f)–(g), 30(3)(b),(d),(e)
Incident assistance
The vendor assists you when an ICT incident related to the service occurs, at no additional cost or a cost set in advance (Art. 30(2)(f)).
Watch for: Assistance optional or discretionary, or billed at an open-ended, undefined cost.
Notice and reporting
Notice periods and a duty to report any development that could materially affect delivery of the service (Art. 30(3)(b)).
Watch for: No reporting duty, or notice only if you ask.
Right to monitor and audit
Unrestricted access, inspection, and audit for you, an appointee, and the competent authority, not curbed by other clauses (Art. 30(3)(e)).
Watch for: Audit capped, fee-gated, or subject to the vendor’s prior approval.
Cooperation and testing
Full cooperation with the competent and resolution authorities (Art. 30(2)(g)); participation in threat-led penetration testing where in scope (Art. 30(3)(d); Arts. 26–27).
Watch for: Cooperation “commercially reasonable” or approval-gated; testing left unaddressed.
Subcontracting and service levels
Art. 30(2)(a),(e), 30(3)(a)
Subcontracting
The contract states whether subcontracting of a critical or important function is permitted and, if so, the conditions that apply (Art. 30(2)(a); RTS (EU) 2025/532).
Watch for: Silent on subcontracting, or unconditional subcontracting with no stated conditions.
Service levels
Service level descriptions with updates and revisions; for critical functions, precise quantitative and qualitative targets you can monitor (Art. 30(2)(e), 30(3)(a)).
Watch for: Qualitative or “best efforts” service levels; no way to keep them current.
Exit and termination
Art. 28(7)–(8), 30(3)(f)
Exit strategy
A tested exit plan: the vendor keeps the service running through an adequate transition period so you can migrate to another provider or bring it in-house (Art. 30(3)(f); Art. 28(8)).
Watch for: No exit strategy; the service simply stops at termination.
Termination rights
You may terminate on the DORA grounds: significant vendor breach; changes that impair the service; evidenced weaknesses in the vendor’s ICT risk management; or the competent authority no longer being able to supervise you (Art. 28(7); Art. 30(2)(h)).
Watch for: Termination weighted to the vendor, or the DORA grounds missing.
A clean exit
You can exit without disrupting your business; transition assistance is defined and any termination charges do not trap you (Art. 28(8)).
Watch for: Exit penalties or fees steep enough to lock you in.
Two things to get right first
- Know your critical or important functions. DORA’s enhanced Article 30(3) terms (full service-level detail, notice and reporting, tested business-continuity plans, threat-led penetration testing, unrestricted audit, and exit plans) apply to the ICT services supporting those functions. Identify them first; the bar is higher there.
- The vendor reads the same list. An ICT provider handed this addendum works the mirror image, confirming each obligation is bounded, funded, and operationally achievable before it signs.
Firm-side and vendor-side DORA playbooks
Both DORA playbooks ship: one applies the Article 30 terms from the financial firm’s position, the other from the ICT provider’s. The four commercial agreement types run against your own playbook. Playbook Customization builds your firm’s positions into either.
ReviewPro is not legal advice. Confirm positions with your counsel and your organization’s contracting policies.
What changes for your team
One standard across the estate
Your playbook applies the same commercial positions and the same Article 30 test to every agreement. The standard stops depending on which reviewer got which contract.
The DORA terms on every ICT contract
ReviewPro flags a missing description of the functions, an undisclosed data location, an audit right narrowed so it cannot be exercised, and a contract with no exit plan.
A record you can show a regulator
Each review leaves a consistent, explainable account of what was checked, flagged and changed. It supports the register of information, an examination, and the next reviewer.
Coverage that grows with the vendor list
New providers, renewals and re-papered addenda arrive continuously. ReviewPro absorbs the first pass, so a lean legal or vendor-risk team covers more of the estate without a matching hire.
Contracts the provider will not change
A hyperscaler’s standard cloud terms and a core platform’s master agreement often arrive on paper that does not move.
ReviewPro still shows which Article 30 requirements the contract does not carry. You can document the gap, seek the term through an addendum, or take it to your risk committee.
The addendum read from the provider’s side
A software company selling into EU banks and insurers receives DORA addenda to sign. Each one hands over obligations on incident assistance, audit access, subcontracting and exit.
The vendor-side DORA playbook applies the same terms from the provider’s position. You see what you are committing to, and where an obligation is not operationally achievable, before you sign.
Proven contract AI, inside Microsoft Word
ReviewPro runs where your team already works, with no separate application and nothing to upload. Every redline includes the reasoning behind it.
- 95%+ first-pass redline accuracy
- Under 5 min per first-pass review
- Firm-side and vendor-side DORA playbooks
Financial Services and DORA Contract FAQ
Does ReviewPro make us DORA-compliant?
No. It runs a first pass against the Article 30 requirements and flags where a term is missing or too weak. Your counsel and compliance function own the compliance determination.
Can we run contracts signed before DORA applied?
Yes. The legacy estate goes through the same pass as new paper, which turns a re-papering backlog into a queue you can work through.
Does it handle the enhanced terms for critical or important functions?
Yes. The Article 30(3) terms are in the playbook. Identifying which of your functions are critical or important is your firm’s determination, and the review applies the higher bar to the contracts you designate.
Can a vendor-risk analyst use this without a lawyer?
Yes. Each flagged provision explains what the term does, which article it comes from, and what position to hold, so the review can start before the contract reaches counsel.
We already have a third-party risk platform. Does this replace it?
No. That platform manages the provider register, the questionnaires and the risk ratings. ReviewPro reviews the words of the contract, and the two run alongside each other.
We are the ICT provider, not the financial firm. Does this work for us?
Yes. The vendor-side playbook applies the same Article 30 terms from the provider’s position, on the addenda your financial customers send you.
See ReviewPro on your next ICT contract
Bring a vendor agreement or a DORA addendum your team is reviewing and we will run it against the Article 30 playbook.
ReviewPro is not legal or compliance advice. Confirm positions with your counsel.