The Digital Operational Resilience Act (DORA) Article 30 mandates specific contractual provisions that financial entities must embed in agreements with ICT third-party service providers to ensure operational resilience and risk management.1345
Key Features
Article 30 requires contracts for critical or important ICT functions to include over 15 mandatory clauses covering governance, risk mitigation, and operational resilience.245 Contracts must clearly define service descriptions, sub-contracting permissions, service locations, data-protection obligations, and incident-reporting duties.14
Risk Management and Compliance
The contracts must define each party's responsibilities, set service levels, and establish monitoring mechanisms for ICT risks.134 Financial entities retain audit rights — including direct access to provider premises — and termination rights with exit strategies that preserve business continuity.25
Why It Matters
Negotiating and enforcing these clauses is non-trivial with large ICT providers, but embedding them is the cornerstone of DORA compliance. The Register of Information cycle running through Q1 2026 makes contract gaps visible to supervisory authorities for the first time.56
