Most of the conversation about the Digital Operational Resilience Act (DORA) has focused on the organizations it names: banks, insurers, investment firms, payment institutions and asset managers. The software and IT companies behind them got far less attention, although they run much of the technology DORA is about. Many of the DORA questions we hear now come from exactly these companies. Usually they aren't regulated under DORA themselves. Instead, a client has sent them a contract addendum, a supplier questionnaire or a request to describe their exit support, and it expects answers it can show its own supervisor. Most of what these clients ask for builds on security work that many providers already do.

Why does DORA reach ICT providers that aren't regulated?

DORA, formally Regulation (EU) 2022/2554, has applied since 17 January 2025. Its obligations fall on the financial entities listed in Article 2. ICT third-party service providers appear in that list too, but the rules that apply to them directly, the EU oversight framework, only take effect once the European Supervisory Authorities (ESAs) designate a provider as critical. All other providers meet DORA through their clients, for three reasons:

• Responsibility stays with the client. Under Article 28(1)(a), a financial entity that uses ICT services "remains fully responsible" for complying with DORA. It can outsource the service but not the obligation, so it needs you to support it.

• Due diligence comes before the contract. Article 28(4) requires the client to assess you before signing. Under Article 28(5), it may only contract with providers that "comply with appropriate information security standards", and for critical or important functions it has to consider whether you use the most up-to-date and highest quality standards. Delegated Regulation (EU) 2024/1773 lists what the client checks for those services: your reputation, skills, resources, security standards and governance, your use of subcontractors, any data storage or processing in a third country, and whether you accept audits.

• Your data goes to the supervisor. Each contract with an ICT provider is recorded in the client's Register of Information under Article 28(3), and supervisors collect the full register once a year.

That makes you part of your client's compliance. If you can't support these requirements, you become a risk the client has to assess, document and, if necessary, exit.

Which contract clauses will financial clients ask for?

Article 30 sets the minimum content of every contract between a financial entity and an ICT provider. Rights and obligations have to be set out in one written document that includes the service level agreements. These clauses apply to all ICT services (Art. 30(2)):

For services supporting critical or important functions, Article 30(3) adds six more:

Two clauses deserve extra attention. Your client's reporting deadlines run from the moment it becomes aware of an incident and classifies it as major, so expect incident clauses to ask for fast notification and the details it needs for its reports. And it pays to prepare your own DORA addendum, reviewed by your legal team and mapped clause by clause to Article 30. You then negotiate from a complete text instead of reconciling a different version from every client.

Does your service support a critical or important function?

Under Article 3(22), a function is critical or important if its disruption would materially impair the client's financial performance, the soundness or continuity of its services, or its ability to meet its regulatory obligations. Your client makes that call in its own assessment, and the answer changes how much it needs from you. A core banking system or an insurer's policy administration platform usually supports a critical function, while a meeting room booking tool usually doesn't. Many services sit in between, so ask each client how it has classified yours.

Your subcontractors become part of your client's chain

Since 22 July 2025, Delegated Regulation (EU) 2025/532 has set out what financial entities must check when ICT services supporting critical or important functions are subcontracted. For you as the provider, it means:

• Clients check how you manage subcontractors. Before signing, they assess whether you can select and assess potential subcontractors, identify all relevant ones and monitor ICT risk at their level, and what risks their locations bring.

• The contract sets the conditions. It names which services you may subcontract and under which conditions. You stay responsible for what your subcontractors deliver, and you monitor them and report on them to the client.

• Rights flow down. Your subcontractors have to grant the client and the competent authorities the same access, inspection and audit rights that you grant, and your contracts with them need continuity plans and security standards.

• Material changes need the client's clearance. You announce them well in advance, and you may only implement them once the client has approved them or hasn't objected by the end of the notice period.

• Breaches can end the contract. The client can terminate if you implement a change it objected to, implement one before the notice period ends without its approval, or subcontract a service the contract doesn't explicitly allow.

In practice, keep a current list of the subcontractors behind each service, such as hosting, support, monitoring and AI model providers, with their locations, and add these requirements to your own contracts with them.

The data your clients report about you

Clients record you in their Register of Information using the templates of Implementing Regulation (EU) 2024/2956, and supervisors check every entry against validation rules. Expect requests for:

• Your identifier: under Article 3(5), clients must identify you by a valid and active Legal Entity Identifier (LEI) or your European Unique Identifier (EUID), and by both where available. Companies outside the EU and EEA, including Swiss providers, have no EUID, so their clients need an LEI.

• Your group: your legal name, headquarters country and ultimate parent company.

• Your services and data: the type of ICT service, and where data is stored and processed.

• Your supply chain: if your service supports a critical or important function, the relevant subcontractors in your chain, identified in the same way (Article 3(6)).

These details are where registers often fail. In the ESAs' 2024 dry run, only 6.5% of registers passed all data quality checks, and 86% of the failed checks concerned missing mandatory information. Among the fields most often left empty were the provider's identification code, its headquarters country and its ultimate parent company. A short data sheet with these details, kept current and sent to every client, closes those gaps at the source.

The CTPP list: who is supervised directly

On 18 November 2025, the ESAs designated the first critical ICT third-party providers (CTPPs) under Article 31. The list names 19 providers, mostly large cloud, data center, telecom and IT services groups, among them Amazon Web Services, Microsoft, Google Cloud, SAP, Oracle, IBM and Deutsche Telekom.

• Criteria: under Article 31(2), the ESAs look at the impact on the financial sector if the provider failed, how systemically important its clients are, how much they rely on it, and how easily it could be replaced.

• Data: the assessment draws on the Registers of Information that financial entities submit.

• Oversight: each CTPP has a Lead Overseer (the EBA, EIOPA or ESMA) that can request information, run investigations and inspections, and issue recommendations. If a CTPP doesn't cooperate, the Lead Overseer can impose daily penalty payments of up to 1% of its average daily worldwide turnover, for up to six months (Art. 35).

• EU presence: financial entities can only keep using a CTPP from a third country if it sets up a subsidiary in the EU within 12 months of designation (Art. 31(12)).

• Opt-in: a provider that isn't designated can apply to be, with a reasoned application, and the ESAs decide within six months (Art. 31(11)).

For providers left off the list, nothing changes: the contractual requirements described above apply to every ICT provider. Designation doesn't change the client's side either, since financial entities stay responsible for managing their CTPPs too. The ESAs update the list every year, so more providers can be added.

Check whether NIS2 applies to you directly

DORA isn't the only EU law to check. NIS2 applies in its own right to cloud computing, data center, managed service and managed security service providers, among others, subject to size thresholds and national law. In Germany, the NIS2 rules in the BSI Act (BSIG) have applied since 6 December 2025. For financial entities, DORA takes priority over NIS2, but that priority doesn't extend to their providers. An ICT provider can therefore be subject to NIS2 directly and to DORA through its clients, and both build on the same security program.

How Formalize helps ICT providers meet their clients' DORA requirements

Formalize works on both sides of this chain. Financial entities use it for DORA: their Register of Information, major incident reporting, ICT risk and third-party oversight. As an ICT provider to financial entities ourselves, we go through the same due diligence and contract reviews.

ICT providers don't need to run DORA's full framework. What your clients need is a security program they can verify and a working process behind every clause you sign. In Formalize, you can:

• Build the ISMS clients assess: run ISO 27001 with official ISO content, risk assessments, a Statement of Applicability and evidence for each control.

• Share your security documents: publish them in your Trust Center, a page you share by link with your clients' due diligence teams.

• Oversee your subcontractors: classify them by criticality and data location in Third-Party Management, send risk questionnaires and repeat the review every year.

• Handle incidents and continuity: log every step of an incident to give clients the details they need, with continuity plans and test results alongside.

• Keep policies current: manage security, continuity and exit policies with owners, versions and approvals.

• Add NIS2 where it applies: run it in the same system as ISO 27001, with owners, tasks and evidence in one place.

Formalize structures the work. Your legal team still decides which clauses you accept, and each client decides how it classifies your service. Formalize is used by 8,000+ organizations, hosted in the EU (AWS Frankfurt), and holds ISO 27001 certification and an ISAE 3000 Type 2 report.

This article is for information only and doesn't constitute legal advice.