DORA does not regulate most UK technology suppliers directly, but it requires your EU bank clients to control you. Expect mandatory contract clauses, requests for data for their register of information, a Legal Entity Identifier, and limits on how you subcontract. Only providers designated as critical face direct oversight by the EU supervisory authorities.
Our DORA service page explains what the Digital Operational Resilience Act is and how it reaches UK firms. This guide goes a level deeper for the supplier: what the contract will actually say, what your client has to record about you, what subcontracting controls mean for your own supply chain, and where the critical provider regime fits.
Executive Summary & Key Takeaways
- Your EU clients stay fully responsible for DORA compliance, so they must push its requirements into your contract.
- Every ICT contract needs a baseline set of clauses. Services supporting a client’s “critical or important functions” need a much longer list, including unrestricted audit rights and a mandatory exit transition period.
- Clients must record you in a register of information. Suppliers established outside the EU, including UK companies, must be identified by a Legal Entity Identifier (LEI).
- If you subcontract any part of a critical service, you will need to flow obligations down and give advance notice of material changes, which the client can object to.
- 19 providers were designated as critical in November 2025. A third-country critical provider must set up an EU subsidiary within 12 months of designation.
Why it lands on you
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. Article 28 says financial entities that use ICT services “remain fully responsible” for complying with DORA. Before signing, they must assess whether your service supports a critical or important function, carry out due diligence on you and assess concentration risk. They may only contract with providers that “comply with appropriate information security standards” (EUR-Lex, retrieved 20 October 2026).
The phrase that matters most is “critical or important function”. Your client decides whether your service supports one, not you. The answer drives almost everything else, so ask early and get it in writing.
What your contract will contain
Article 30 requires the rights and obligations of both parties to be set out in writing, in one document including the service levels. It then sets two tiers of mandatory content.
| model | All ICT services | Services supporting critical or important functions |
|---|---|---|
| Full description of services, and whether and how subcontracting is allowed | Yes | Yes |
| Where services are provided and data processed, with advance notice of changes | Yes | Yes |
| Data availability, authenticity, integrity and confidentiality | Yes | Yes |
| Access to and return of data on insolvency, discontinuation or termination | Yes | Yes |
| Incident assistance at no extra cost, or at a cost agreed in advance | Yes | Yes |
| Full cooperation with the client’s competent and resolution authorities | Yes | Yes |
| Termination rights and minimum notice periods | Yes | Yes |
| Taking part in the client’s security awareness and resilience training | Yes | Yes |
| Full service levels with precise quantitative and qualitative targets | Yes | |
| Notice of developments that could affect your ability to deliver | Yes | |
| Implementing and testing business contingency plans; appropriate security measures | Yes | |
| Participating in the client’s threat-led penetration testing (TLPT) | Yes | |
| Unrestricted access, inspection and audit rights for the client and its regulator | Yes | |
| Exit strategy with a mandatory adequate transition period | Yes |
Source: DORA Article 30 (EUR-Lex, retrieved 20 October 2026).
Article 28(7) adds the circumstances in which the client must be able to terminate, including a significant breach by you, evidenced weaknesses in your ICT risk management, and situations where the regulator can no longer effectively supervise the client because of the arrangement. Clients must also have tested exit plans for critical services.
Three have the most commercial impact. Incident assistance must be free or priced in advance. Audit rights must be “unrestricted”, although the contract can provide for alternative assurance levels where other clients’ rights would be affected, and Article 28(6) allows the use of a pool of auditors. And the exit transition period means you must keep delivering for an agreed period after notice, so the contract should say how long and on what terms.
The client’s own policy on these contracts is specified further in Commission Delegated Regulation (EU) 2024/1773, which covers due diligence, monitoring and exit throughout the contract lifecycle (EUR-Lex, retrieved 20 October 2026).
The register of information
Every financial entity must keep a register of information covering all its ICT contracts, distinguish those supporting critical or important functions, report on it to its regulator at least yearly and hand over the full register on request. It must also tell its regulator in good time about any planned contract for a critical or important function (DORA Article 28(3)).
The register uses standard templates set by Commission Implementing Regulation (EU) 2024/2956. Two details matter for UK suppliers. First, legal persons must be identified by an LEI or a European Unique Identifier, and providers that are not established in the EU must use an LEI only. Second, the register records the ICT service supply chain, including subcontractors supporting critical or important functions and the ultimate parent of each provider (EUR-Lex, retrieved 20 October 2026).
In practice, expect requests for your LEI, legal entity details, ultimate parent, the countries where you provide services and store data, and the subcontractors behind the service. If you do not have an LEI, getting one removes a common blocker.
Subcontracting
Article 29 asks clients to weigh the risks of you subcontracting critical services, especially to subcontractors outside the EU, and to consider whether long or complex chains would stop them or their regulator monitoring the service. Commission Delegated Regulation (EU) 2025/532, in force since 22 July 2025, turns that into contract terms (EUR-Lex, retrieved 20 October 2026). Where a critical service can be subcontracted, the contract must specify that:
- you remain responsible for the services your subcontractors provide, and must monitor them;
- your contracts with subcontractors carry the contingency planning, security standards and service levels your client requires;
- subcontractors give the client and its authorities the same access, inspection and audit rights you do;
- you notify the client of material changes to subcontracting well in time, and allow a reasonable notice period for the client to approve or object;
- you only implement the change once the client has approved it or not objected by the end of that period.
The client can terminate if you go ahead despite an objection, or before the notice period ends. Changing your hosting provider, moving support offshore or bringing in a new data processor could all count. A current inventory of subcontractors, mapped to the services each one supports, is the single most useful document you can hold.
The critical ICT third-party provider framework
DORA also creates direct EU oversight for the most systemically important providers. The European Supervisory Authorities (EBA, EIOPA and ESMA) designate critical ICT third-party providers based on systemic impact, the importance of the financial entities that rely on them, how much they support critical or important functions and how substitutable they are (DORA Article 31). Each critical provider gets a Lead Overseer with powers to request information, investigate and inspect, and periodic penalty payments of up to 1% of average daily worldwide turnover (Article 35).
The ESAs published the first list on 18 November 2025: 19 providers, largely global cloud, data centre, telecoms, market data and IT services groups (ESMA, retrieved 20 October 2026). The list is updated annually, and 2026 is the first full cycle of oversight activity.
For a UK provider, Article 31(12) is the key line: EU financial entities may only use a critical provider established in a third country if it has set up an EU subsidiary within 12 months of designation. Providers serving clients in only one member state, where those clients are only active there, are excluded from designation, and a provider not on the list can apply to be designated.
Most mid-sized UK suppliers will not be designated. You are more likely to depend on a designated provider, such as a hyperscale cloud platform, which your clients will treat as a concentration risk question.
How to prepare as a supplier
Suppliers who handle DORA well treat it as a sales asset: a standard addendum answering Article 30 clause by clause, a clear position on audit and incident assistance pricing, a subcontractor inventory, an LEI, and evidence such as ISO 27001 certification, penetration test summaries and tested continuity plans.
Common mistakes
- Waiting for the client to say whether you are critical. Ask at the start. It decides which half of Article 30 applies.
- Treating “unrestricted audit rights” as negotiable away. You can shape how audits happen, such as pooled audits or alternative assurance, but not remove the right.
- Forgetting your own suppliers. Your client’s subcontracting rights reach into your supply chain. Changes you make there can trigger notice periods and termination rights.
- Leaving incident support unpriced. DORA requires it to be free or priced in advance, so an open-ended clause is a commercial risk.
Frequently asked questions
Can we use our own standard terms?
You can, provided they contain the Article 30 elements. Many suppliers keep their standard terms and add a DORA addendum mapped to each clause. Article 30(4) also asks both sides to consider standard contractual clauses developed by public authorities where they exist.
Do we need a Legal Entity Identifier?
If you are a company established outside the EU, your clients must identify you in their register of information using an LEI. Without one, your client cannot complete its register entry for you correctly.
Do we have to tell clients about every new subcontractor?
For services supporting critical or important functions, you must notify material changes to subcontracting in advance and allow the client time to object. For all ICT services, you must give advance notice if you plan to change the regions or countries where services are provided or data is processed.
Will we have to run threat-led penetration tests?
Not on your own account. Where your service supports a critical or important function, you must participate and cooperate fully in your client’s TLPT, which can mean your systems are in scope of a test your client commissions.
Getting started
DORA turns your EU clients’ regulatory duties into your contractual ones. The supplier that arrives with answers on clauses, register data and subcontracting wins the renewal. Our DORA team helps UK suppliers map contracts and evidence to Article 30, and our assurance service builds the evidence pack clients ask for. For wider supplier risk, see what is third-party cyber risk. To discuss your EU contracts, talk to our team.
Ashley Argyle
Writing about cyber security and technology at Falx.
