The Digital Operational Resilience Act applies to banks, insurers, investment firms, payment institutions and crypto-asset service providers since 17 January 2025. You are none of these. Yet if you sell them software, cloud, data or managed services, DORA has reached you through Article 30: financial entities must include a prescribed set of contractual provisions in every agreement with an ICT third-party provider, and must keep a register of those arrangements that supervisors inspect. Procurement teams at banks have spent 2025 and 2026 re-papering suppliers. If your contract has not been opened yet, it will be. This note explains what you will be asked to sign and how to prepare.
The clauses you will see
Description of services and data. A clear description of all functions and services, whether they support critical or important functions, and the locations, including regions, where data is processed and stored, with advance notice of changes. Service levels. Quantitative and qualitative performance targets, with remedies. Data protection and availability. Provisions on availability, authenticity, integrity and confidentiality, and on access, recovery and return of data on insolvency, resolution or termination. Incident assistance. An obligation to assist the financial entity with ICT incidents at no additional cost or at a pre-agreed cost. Cooperation with authorities. You must cooperate with the client's regulators and resolution authorities. Termination rights. The client must be able to terminate for breaches of law, for impediments to its ability to monitor you, for weaknesses in your ICT risk management, and when the regulator says so. Exit strategy. Transition periods during which you continue to provide services, and support for migration to another provider.
For services supporting critical or important functions there is more: full service-level descriptions with monitoring, incident notification deadlines, participation in the client's security testing, including threat-led penetration testing, and unrestricted rights of access, inspection and audit for the client and its regulator, with a plan for how audits are conducted. Subcontracting of critical services is regulated separately: the client must approve material subcontractors and you must flow the clauses down the chain.
What to accept, and what to negotiate
Most of the list is mandatory for your client; refusing it means losing the deal. The negotiation is about how. Audit rights can be satisfied in part through pooled audits and third-party certifications, with on-site access reserved for defined triggers. Incident assistance can be priced at a pre-agreed rate rather than free. Exit transition periods can be bounded and paid. Data-location notice periods can be realistic for a multi-tenant platform. Termination for "weaknesses in ICT risk management" can be tied to a documented finding and a cure period. Subcontractor approval can be a notification-and-objection process rather than prior consent, for non-critical subprocessors.
How to be ready before procurement asks
Build a DORA annex to your standard MSA that contains all Article 30 provisions in your preferred wording, so the client starts from your paper. Prepare an evidence pack: ISO 27001 or SOC 2 report, penetration test summary, business continuity plan, subprocessor list, data-location map. Set up an incident process that can notify a client within hours, because their own deadline to the regulator is four hours for initial notification of a major incident. Decide your position on critical third-party designation: if you serve many financial entities, the European supervisory authorities may designate you as critical and oversee you directly.
Vendors that arrive with a DORA annex and an evidence pack close faster and give away less. If you want our model annex and the negotiation playbook, send us a note.