An EU financial institution sends a supplier agreement with DORA clauses, audit rights and detailed questions about cloud and model providers. Before signing, the supplier needs to establish which terms the law requires, which requests reflect the customer's procurement policy, and which promises depend on upstream contracts.
Licentium's supplier-side review turns that assessment into contract redlines, a subcontractor schedule, an evidence request pack and defined exit assistance. The scope suits fintech, AI and SaaS businesses negotiating a new agreement, a renewal or a DORA addendum.
ICT services covered by the review
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. Its ICT definition covers ongoing digital and data services delivered through ICT systems. Hosted software, cloud infrastructure and model APIs can fall within that definition. The review starts with the service actually supplied and the customer's regulatory status. Calling an arrangement a software licence does not resolve its treatment. (DORA, Arts. 2, 3(21), 64.)
Where a fintech supplies a regulated financial service, classify that activity and its ICT components separately. The Commission distinguishes connected regulated financial services from unrelated or independent ICT services; a financial licence alone does not settle the distinction. (Commission answer, Q&A DORA030–2999.)
For the customer's wider obligations, see DORA compliance in practice.
The customer's classification determines the contract
Ask the financial institution which function the service supports and for its criticality assessment. A function is critical or important where disruption or defective performance would cause the material impairment specified by DORA. The test concerns financial performance, service soundness or continuity, or continuing compliance with authorisation conditions or financial-services law. (DORA, Arts. 3(22), 28(4)(a).)
All covered ICT arrangements need the Article 30(1)–(2) terms. Services supporting critical or important functions require the additional Article 30(3) provisions. The customer retains responsibility for its classification, diligence, register and regulatory notifications. The supplier provides accurate service information and agrees obligations it can perform. (DORA, Art. 28(1), (3)–(5).)
Supporting a critical function does not itself make the supplier a designated critical ICT provider. Direct oversight by the European Supervisory Authorities follows the separate designation process. For a designated third-country provider, DORA conditions the customer's use on the provider establishing an EU subsidiary within 12 months following designation. Check the relevant legal entity and designation decision. (DORA, Arts. 31(1), (3), (12), 33, 35.) The distinction is explained in DORA accountability across firms, providers and supervisors.
Terms that must work across the supplier chain
Service scope and data locations
The complete written agreement must include service levels and remain available in a durable, accessible format. The baseline covers service descriptions, applicable subcontracting conditions, delivery and data locations, data protection, recovery and return, incident assistance, authority cooperation, termination and training-participation conditions. Identify hosting, support and processing countries, including storage, and provide advance notice of planned location changes. DORA does not impose a general EU-only hosting rule. (DORA, Art. 30(1)–(2), recital 82.)
Audit access and regulatory cooperation
For critical-function arrangements, preserve the required access, inspection and audit rights, including cooperation with the customer's competent and resolution authorities. Negotiate procedures, confidentiality protections and risk-based audit frequency without obstructing those rights. Pooled audits can support the process. Certificates and audit reports cannot become the sole assurance method over time where the contractual-policy rules apply. (DORA, Arts. 28(6), 30(2)(g), 30(3)(e); Delegated Regulation (EU) 2024/1773, Art. 8.)
DORA permits alternative assurance where other clients' rights are affected. It also permits a microenterprise customer to agree delegation to an independent third party appointed by the provider, with information and assurance available at any time. Those conditions must be preserved in the drafting. (DORA, Art. 30(3)(e)(ii) and final subparagraph.)
Cloud and model subcontractors
Identify the chain supporting critical or important functions, including material parts of the service. The customer needs enough information to assess locations, concentration, continuity and obstacles to supervision. The supplier's upstream terms must support the required monitoring, security, continuity and access rights. Check the executed upstream terms and the arrangements for exercising those rights. (Delegated Regulation (EU) 2025/532, Arts. 3–4.)
For relevant material subcontracting changes, agree sufficient advance information and a reasonable period for approval or objection. Implement the change only after approval or expiry without objection. Preserve the required termination rights for unauthorised subcontracting and specified changes implemented against an objection or prematurely. DORA does not set one universal notice period or require automatic termination whenever a subcontractor changes. (Delegated Regulation (EU) 2025/532, Arts. 5–6.)
These subcontracting rules entered into force on 22 July 2025. Necessary amendments to existing agreements must be implemented in a timely manner and as soon as possible, with a documented timetable. (Delegated Regulation (EU) 2025/532, Arts. 4(2), 7.)
Incidents and service levels
Incident assistance must be provided without additional charge or at a cost determined in advance. Agree escalation contacts, information flows and supplier notification times that support the customer's reporting duties. The financial institution retains responsibility for regulatory reporting, including where reporting is outsourced. (DORA, Arts. 19(5), 30(2)(f).)
Critical-function terms also require precise performance targets, relevant reporting, tested contingency plans and cooperation with applicable threat-led penetration testing. Match those commitments to the actual service and upstream support. (DORA, Art. 30(3)(a)–(d).)
Termination and exit assistance
Preserve the required termination grounds and usable data recovery and return rights. For critical-function services, define an adequate transition period with continued service to support migration or reintegration. Specify export formats, responsibilities, upstream access and the licences needed to operate during transition. (DORA, Arts. 28(7)–(8), 30(2)(d), (h), 30(3)(f).)
Liability caps, indemnities and additional commercial protections need separate negotiation. Exit charges also require a check against any applicable Data Act switching restrictions. A DORA review should identify that dependency before pricing the exit schedule. (Regulation (EU) 2023/2854, Arts. 23, 29, 31.)
What the review produces
The review comprises five connected deliverables:
- A clause gap review linking each relevant request to its legal trigger, the contract wording and the required action. It distinguishes statutory requirements, supervisory material and customer commercial positions.
- Contract redlines covering the agreement, DORA rider and relevant schedules, with proposed negotiation positions and upstream dependencies identified.
- A subcontractor information schedule recording legal entities, services, chain relationships, locations and required identifiers, with information needed for the customer's register.
- An evidence request pack assigning requests for security, audit, incident, continuity and recovery records to the supplier or relevant upstream provider.
- An exit-assistance schedule specifying transition services, data exports, permissions, responsibilities, dependencies and the basis for charges.
The work starts with service classification and dependency mapping. Clause review then tests the customer's requests against the applicable duties and upstream terms. The handoff identifies proposed positions, outstanding evidence and conditions for onboarding or continued delivery.
Information needed for the review
Provide the customer agreement and DORA addendum, service description, proposed service levels and security schedules. Include the customer's legal entity, Member State, regulatory status and criticality assessment. Supply the cloud and model contracts, subcontractor list, delivery locations, incident procedures and available continuity or recovery evidence.
The supplier identifies what it controls and what requires an upstream amendment. The customer completes its own risk assessment and any required notification or approval process. Where a required right cannot be secured, the parties must change the terms, dependency or delivery model before proceeding with that arrangement. (DORA, Arts. 28(4)–(5), 29(2); Delegated Regulation (EU) 2025/532, Art. 3.)
The engagement should identify the supplier's origin country and every relevant delivery jurisdiction. Local restrictions on disclosure, audit access, data transfers and recovery require assessment where they affect performance. Financial-services permissions, AI classification, data protection and technical testing need separately agreed scope when the product or deployment raises those issues. (DORA, Arts. 1–2, 29(2).)
Request a DORA contract review
Review a bank's supplier agreement. Describe the service, the EU customer and its criticality assessment, and the cloud or model dependencies. Licentium can scope the agreement, subcontractor terms and evidence package that need review before the proposed commitments are accepted.