Art. 30 DORA: what goes into ICT vendor contracts (and the clause worth copying)
DORA (EU Reg. 2022/2554) does not apply to software houses: it applies to financial entities, from 17 January 2025. But Art. 30 lists the clauses that every contract with an ICT provider must contain data location, SLAs, incident assistance, and the guarantee of data return if the vendor fails or shuts down. The perspective of those who sign contracts on the other side: what to expect from a financial client, and why that clause is the lesson everyone should copy.
DORA doesn't apply to you. But it does apply to your contract.
The Digital Operational Resilience Act (EU 2022/2554) applies to banks, insurance companies and payment institutions not their software vendors. But Article 30 dictates what must be included in the contract you sign with them. Here's what to expect, clause by clause.
This is a technical read, not legal advice: every clause cited references the article of the regulation it comes from.
In summary: what it provides and who it affects
DORA is the European regulation on digital operational resilience for the financial sector (Reg. EU 2022/2554), and applies from 17 January 2025 (art. 64): it is not an upcoming deadline, it is the current regime. For software providers, the article that matters is 30: the list of clauses that the financial client is required to include in the contract with any ICT service provider, not just large providers.
- It applies to financial entities (art. 2): 21 types, from credit institutions to insurance companies to crypto-asset service providers. Not to software houses as such.
- The channel through which DORA reaches a supplier is the contract: the designation of "critical third-party provider" concerns large providers, not the ordinary supplier.
- Art. 30, para. 2 applies to any ICT service: data location, SLA, incident support, cooperation with authorities, termination rights.
- The most interesting clause: the guarantee of access, recovery and return of data "in an easily accessible format" if the provider becomes insolvent or ceases operations.
Who DORA Applies To (And Why You're Not Included)
Art. 2 lists twenty-one types of financial entities: credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, insurance undertakings and others. A software house is not on the list: DORA imposes no direct obligations on them, and the designation of "critical third-party provider" (Chapter V) is designed for large infrastructure providers, not for those who develop management software.
The mechanism by which the regulation still lands on your desk is the same one we saw for NIS2 and software suppliers: the obligation lies with the client, and the client passes it down through the contract. With one difference: where NIS2 leaves the regulated entity free to choose how to assess its suppliers, DORA spells out in black and white the minimum list of clauses that the contract must contain. If you work with a bank, an insurance company or a fintech, those clauses are non-negotiable in substance: you can only make sure you are prepared.
What must be included in the contract (art. 30, c. 2)
These clauses apply to any ICT service provided to a financial entity not only for critical functions:
-
Services described in full
Complete description of functions and services, including any authorisation for subcontracting and its conditions.
-
Where the data is located
Location of service delivery and data processing and storage, with advance notice in the event of any change.
-
Protected and recoverable data
Availability, authenticity, integrity and confidentiality — and the guarantee of access, recovery and return of data if the provider becomes insolvent, is dissolved or ceases operations.
-
SLA and incident support
Service levels with updates, and support in the event of an ICT incident «at no additional cost or at a cost established ex ante».
-
Cooperation with authorities
Full cooperation with the client's competent authorities — your contract commits you to their regulator.
-
Orderly exit
Termination rights with advance notice, and the provider's participation in the client's training programmes.
The clause every company should copy
Re-read the third card: if the supplier fails, dissolves or ceases to operate, the customer is entitled to access, recovery and return of their data «in an easily accessible format» (art. 30, c. 2). The European legislator has taken the question that every company should ask its supplier «what happens to my data if you disappear?» and turned it into a legal obligation for an entire sector.
This is the institutional validation of a principle we have always applied outside finance: in custom software development projects, the source code and intellectual property belong to the customer, and data export is not a premium feature it is the prerequisite for the customer to remain free. We cannot say we «are DORA compliant», because DORA does not apply to us: we can say that our contracts are ready for the DORA requirements that a financial customer must enforce. The difference between the two sentences is exactly the type of precision this regulation demands.
The direction is the same as the entire European regulatory package: as with product liability, software ceases to be a black box of which the supplier is the custodian and returns to being a customer asse with continuity, data and emergency exits written into the contract.
If your service is an essential function, the level rises (c. 3)
When the ICT service supports essential or important functions of the client, art. 30, para. 3 adds a higher level: service levels with quantitative, monitorable objectives (not «best effort»: numbers the client can measure), obligations to notify developments that may impact service capacity, tested contingency plans not written: tested and participation in the client's threat-led penetration tests (TLPT). This means that the supplier's systems may end up within the scope of an attack test commissioned by the bank.
Methodological note: the list in para. 3 is not exhaustive the rest of the text also covers audit rights and exit strategies, which we do not summarise here as they deserve dedicated reading. If you are negotiating a contract on essential functions, read the article in full.
Frequently asked questions about DORA and suppliers
It is the European regulation on digital operational resilience for the financial sector (Reg. EU 2022/2554). It has applied since 17 January 2025 (art. 64): this is the current regime, not a future deadline. Being a regulation, it does not require national transposition.
No: it applies to financial entities 21 types listed in art. 2, from credit institutions to insurance companies. A software company has no direct obligations; the designation of 'critical third-party provider' concerns large infrastructure providers. DORA reaches the ordinary supplier through the contract with the financial client, which must contain the clauses of art. 30.
The list of mandatory contractual clauses for any ICT service provided to a financial entity (para. 2): full description of services, data processing locations, guarantees on availability and confidentiality, return of data in the event of the provider's insolvency, SLAs, incident support, cooperation with authorities and termination rights. For essential functions, para. 3 adds quantitative SLAs, tested contingency plans and participation in TLPTs.
DORA contracts state: the client has the right to access, recovery and return of data 'in an easily accessible format' in the event of the provider's insolvency, termination or discontinuation of activity (art. 30, para. 2). Outside finance, this clause is not mandatory and that is exactly the reason why it is worth requesting it anyway.
This is an improper formula: DORA imposes obligations on financial entities, not on their providers. A serious provider says something different: that its contracts and practices are ready for the requirements that the financial client must enforce declared data locations, measurable SLAs, guaranteed data export.
Does your supply contract include data return?
In finance it's required by law. In our projects it's the norm: customer code, exportable data, no lock-in. If you're evaluating a vendor or want to understand how to secure what you already have let's talk.
Sources and methodological note
Primary source: Reg. (EU) 2022/2554 (DORA), text published on EUR-Lex; reference check carried out on 3 August 2026. Articles cited: 2, 30, 64. The regulation is directly applicable: no national transposition is required.
This article is the technical reading of a software provider, not legal advice: for the negotiation of a specific contract, the opinion of a professional is required. The list of clauses in para. 3 is not exhaustive (audit and exit strategy are covered later in the text, not summarised here). Information accurate as of the publication date.
