DORA Contractual Requirements: Article 30 Explained

Last updated: 26 October 2026

Quick answer: DORA contractual requirements are set out mainly in Article 30 of Regulation (EU) 2022/2554. Every ICT services contract must include nine baseline provisions, such as service descriptions, data locations, incident assistance and termination rights. Contracts for ICT services supporting critical or important functions need six more, including audit rights, contingency testing and exit strategies.

DORA has applied since 17 January 2025, and most financial entities ran a contract remediation programme to get there. The work is now business as usual: new contracts, renewals and subcontracting changes.

This guide walks through each Article 30 requirement, explains the extra rules that apply to critical or important functions, covers the two delegated regulations that add detail, and ends with a clause checklist you can use in contract reviews.

What are the DORA contractual requirements?

The DORA contractual requirements are the minimum terms that financial entities must have in their written agreements with ICT third-party service providers. They sit in Article 30 of DORA, supported by the wider ICT third-party risk rules in Article 28.

Article 30(1) requires that the rights and obligations of both parties are clearly allocated and set out in writing. The full contract, including service level agreements, must be documented in one written document available on paper or in another downloadable, durable and accessible format.

The requirements apply to all ICT services, not only outsourcing. That is a major difference from the older EBA outsourcing guidelines: a SaaS subscription, a data feed or a managed security service can all be an ICT service under DORA.

Common mistake: Assuming standard vendor terms already cover DORA because the provider “works with banks”. Many large providers now offer a DORA addendum, but you still need to check it against your own classification of the service and your policy on critical or important functions.

Which clauses must every ICT contract include under Article 30(2)?

Every contract for ICT services must contain at least nine elements, whatever the criticality of the service. These are listed in Article 30(2), points (a) to (i).

In practice: Point (b) is often the weakest clause in older contracts. “EU data centres” is rarely enough; supervisors expect to see which countries, and your register of information needs that detail too.

What extra DORA contract terms apply to critical or important functions?

Where the ICT service supports a critical or important function, Article 30(3) adds six further requirements on top of the nine baseline clauses. These are the terms that usually take longest to negotiate.

1. Full service level descriptions with precise quantitative and qualitative performance targets, so you can monitor the service and take corrective action.
2. Notice periods and reporting obligations, including notification of any development that might materially affect the provider’s ability to deliver the service.
3. Business contingency plans and security measures: the provider must implement and test contingency plans and maintain security measures, tools and policies that give an appropriate level of security.
4. Participation in threat-led penetration testing (TLPT): an obligation to take part and cooperate fully in your TLPT under Articles 26 and 27.
5. Unrestricted rights of access, inspection and audit for you, an appointed third party and the competent authority, including the right to take copies of relevant documents on-site where they are critical to the provider’s operations.
6. Exit strategies, in particular a mandatory adequate transition period during which the provider continues the service, so you can migrate to another provider or bring it in-house.

Article 3(22) defines a critical or important function by reference to whether its disruption would materially impair the entity’s financial performance, the soundness or continuity of its services, or its continuing compliance with its authorisation and financial services obligations. Getting that classification right decides which contracts need the full set of clauses, which is why it should feed directly into your vendor and third-party risk management process.

How does Article 28 connect to the contract?

Article 28 sets the risk management rules that surround the contract: strategy, register, pre-contract assessment and termination rights. Article 30 is where those rules become enforceable terms.

Pre-contract assessment

Before entering an arrangement, Article 28(4) requires you to assess whether it covers a critical or important function, whether supervisory conditions are met, identify the relevant risks including concentration risk, carry out due diligence on the provider and identify conflicts of interest. Article 28(5) adds that you may only enter arrangements with providers that comply with appropriate information security standards.

Termination triggers

Article 28(7) requires contracts to allow termination in at least four situations:

• a significant breach by the provider of laws, regulations or contract terms;
• circumstances found during monitoring that could alter the performance of the service, including material changes to the arrangement or the provider’s situation;
• evidenced weaknesses in the provider’s overall ICT risk management, in particular around data availability, authenticity, integrity and confidentiality;
• where the competent authority can no longer effectively supervise the entity as a result of the arrangement.

Exit strategies

For ICT services supporting critical or important functions, Article 28(8) requires exit strategies that are documented and tested, taking into account provider failure, deterioration of service quality, and termination of the contract. The contractual transition period in Article 30(3) is what makes those plans workable.

If you are tracking clauses, gaps and renegotiation tasks across dozens of providers, you can start your 14-day free trial of Enactia’s AI-powered GRC platform and map each contract to the DORA requirements it satisfies.

What do the DORA technical standards add?

Two Commission delegated regulations add detail to the contractual rules. Both are in force and should be reflected in your ICT third-party policy and contract templates.

Subcontracting in practice

The subcontracting standard matters because Article 30(2)(a) requires the contract to state whether subcontracting of services supporting critical or important functions is allowed and on what conditions. In practice, contracts for those services now usually include a list of material subcontractors, advance notice of changes, a right to object and, if the change is unacceptable, a right to terminate.

In practice: Align your subcontracting clause with the register of information. The register records the ICT supply chain for critical or important functions, so a contract that says nothing about subcontractors leaves a gap that supervisors can see. Our DORA register of information guide explains what that register must contain.

DORA contract review checklist

Use this checklist for new contracts, renewals and DORA addenda.

• Is the service classified (supports a critical or important function, or not), and is the rationale documented?
• Is the complete contract, including SLAs, in one written document in a durable format?
• Are all functions and services described, with subcontracting permissions and conditions?
• Are service and data locations named by country or region, with advance notice of changes?
• Do security terms cover availability, authenticity, integrity and confidentiality of data?
• Are data access, recovery and return rights clear on insolvency, resolution and termination?
• Is incident assistance free or priced in advance?
• Does the provider commit to cooperate with competent and resolution authorities?
• Are termination rights at least as broad as the Article 28(7) triggers, with minimum notice periods?
• Is the provider’s participation in your security awareness and resilience training addressed?
• For critical or important functions: quantitative SLAs, material change notice, contingency testing, TLPT cooperation, unrestricted audit rights and a transition period on exit?
• Is the contract recorded in the register of information with a linked exit plan?

How do DORA contract rules overlap with GDPR and NIS2?

Many ICT contracts also need a GDPR Article 28 data processing agreement, and some providers are themselves in scope of NIS2. The obligations overlap but are not identical, so one clause set rarely covers everything.

Mapping both sets of clauses to a single control library, as the Compliance Universe does, avoids negotiating the same topic twice. For how DORA fits alongside other EU rules, see our article on DORA, NIS2 and EU AI Act overlap, and the DORA framework page.

Key takeaways

• Article 30(2) sets nine clauses for every ICT services contract, not only outsourcing.
• Article 30(3) adds six more for critical or important functions, including audit rights, TLPT cooperation and exit transition periods.
• Article 28(7) termination triggers and Article 28(8) exit strategies should be reflected directly in the contract.
• Delegated Regulations 2024/1773 and 2025/532 add detail on contractual policy and subcontracting.
• Keep contracts, the register of information and your vendor tiering aligned.

Frequently asked questions

Does DORA Article 30 apply to all ICT contracts?
Yes. The nine provisions in Article 30(2) apply to every contractual arrangement for ICT services between a financial entity and an ICT third-party service provider, whatever its size or criticality. The six additional provisions in Article 30(3) apply only where the ICT service supports a critical or important function, so classification of each service is the first step in any contract review.

Do existing contracts signed before January 2025 need to comply?
Yes. DORA contains no grandfathering for existing ICT contracts, so arrangements in place on 17 January 2025 were expected to meet Article 30. Most financial entities handled this through addenda or amendment agreements. If any legacy contracts remain unremediated, record the gap, set a renegotiation date and consider whether it affects the risk assessment for that provider.

What is a critical or important function under DORA?
Article 3(22) defines it as a function whose disruption would materially impair the financial entity’s financial performance, the soundness or continuity of its services and activities, or its continuing compliance with its authorisation conditions and other financial services obligations. Each entity must assess its own functions; the same service can be critical for one firm and not for another.

Must providers give unrestricted audit rights?
For ICT services supporting critical or important functions, Article 30(3)(e) requires unrestricted rights of access, inspection and audit for the financial entity, an appointed third party and the competent authority. DORA allows alternative assurance levels to be agreed where other clients’ rights would be affected, but the underlying right must be in the contract.

Are there official DORA standard contractual clauses?
Article 30(4) says financial entities and providers should consider using standard contractual clauses developed by public authorities for specific services. Use of such clauses is voluntary. Many providers and industry groups have produced their own DORA addenda, but you remain responsible for checking that any template meets Article 30 and your own policy.

Conclusion: treat DORA contracts as a living control

DORA contractual requirements are not a one-time repapering task. Every new provider, renewal, subcontractor change or reclassification of a function can open a gap. Classify the service first, check the nine baseline clauses, add the six critical or important function clauses where needed, and keep the contract, the register of information and your exit plans in step. For the wider programme, our guide to DORA compliance in 2026 covers the other pillars.

If you would like help turning Article 30 into a repeatable contract review workflow, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.