{"id":1163,"date":"2026-02-25T13:09:34","date_gmt":"2026-02-25T12:09:34","guid":{"rendered":"https:\/\/vraneseviclaw.com\/?p=1163"},"modified":"2026-02-25T13:16:43","modified_gmt":"2026-02-25T12:16:43","slug":"dora-unpacked-contractual-arrangements","status":"publish","type":"post","link":"https:\/\/vraneseviclaw.com\/en\/dora-unpacked-contractual-arrangements\/","title":{"rendered":"DORA unpacked: Contractual arrangements"},"content":{"rendered":"

What is DORA?<\/h3>\n

DORA is the EU\u2019s comprehensive regulation on digital operational resilience and cybersecurity for the financial sector, formally known as Regulation (EU) 2022\/2554. It becomes fully applicable on 17 January 2025 and introduces harmonized rules to ensure that financial entities\u2014and the ICT providers supporting them\u2014can withstand, respond to and recover from ICT-related disruptions.<\/p>\n

After setting the stage, this article focuses specifically on due\u2011diligence obligations and contractual requirements under the regulation. Other DORA topics will follow in the next installments.<\/p>\n

DORA\u2019s central mission is simple but ambitious: to make sure financial institutions can survive ICT incidents\u2014from system malfunctions and service outages to sophisticated cyberattacks. Beyond resilience, the regulation seeks to unify cybersecurity standards across the EU, reinforce ICT risk management practices, and enhance incident reporting and response frameworks throughout the sector.<\/p>\n

DORA applies to an extensive spectrum of financial entities: banks, credit and investment institutions, insurers, central securities depositories, and many others. It also directly targets ICT third\u2011party service providers such as cloud platforms, analytics tools, data centers and other digital infrastructure providers who play a crucial role in supporting financial operations.<\/p>\n

Paragraph 21 of the regulation underscores the need for a robust ICT risk management framework and clearly defined mechanisms for handling ICT-related incidents. Paragraph 64 goes even further: regardless of outsourcing arrangements, the financial entity always remains fully responsible for its compliance with DORA. Monitoring third-party risks must be proportionate but rigorous, taking into account the nature, scale, complexity and criticality of ICT dependencies and their potential impact on the continuity of financial services.<\/p>\n

First Things First: Due Diligence<\/h3>\n

This is where DORA doubles down on an issue we often return to\u2014thorough pre\u2011contracting due diligence. Before signing anything, financial entities must analyze the importance of the services involved, obtain relevant supervisory approvals, assess concentration risks, identify possible conflicts of interest, and evaluate the suitability of the ICT provider. This diligence isn\u2019t a formality; it is the foundation on which contractual engagement must be built.<\/p>\n

A Quick Guide to Contractual Arrangements<\/h3>\n

Under DORA, contractual arrangements must include complete and precise descriptions of the contracted functions and services, including the physical or digital locations where services are delivered and where data is processed. These contracts must also contain several mandatory elements.<\/p>\n

Exit strategies, for example, are not optional. Contracts must provide for transition periods to avoid service disruptions, enable orderly switching to another provider or reverting to in\u2011house solutions, and ensure resilience even in the event of a financial entity\u2019s resolution. To increase certainty, parties may also rely on standard contractual clauses issued by public authorities\u2014such as the Commission\u2019s model clauses for cloud computing.<\/p>\n

The Essentials: Contractual Obligations Under Article 30<\/h3>\n

Article 30 sets out the mandatory contractual clauses for ICT service arrangements. As expected, all rights and obligations must be clearly specified in writing, within a single accessible, durable document. Key elements include:<\/p>\n