DORA obligations bearing on AI and ICT third-party service providers

The contract must set out the rights and obligations in one written document including the service level agreements, and must contain at least: a clear and complete description of all functions and ICT services, stating whether subcontracting of an ICT service supporting a critical or important function, or material parts of it, is permitted and on what conditions; the regions or countries where the contracted or subcontracted functions and services are provided and where data is processed and stored, with a requirement to notify the financial entity in advance of envisaged changes; provisions on availability, authenticity, integrity and confidentiality for the protection of data including personal data; provisions on access, recovery and return of personal and non-personal data in an easily accessible format on insolvency, resolution, discontinuation of business or termination; service level descriptions including updates and revisions; an obligation to assist the financial entity at no additional cost or at an ex-ante determined cost when an ICT incident related to the service occurs; an obligation to cooperate fully with the competent and resolution authorities of the financial entity including their appointees; termination rights and minimum notice periods; and the conditions for participating in the financial entity ICT security awareness programmes and digital operational resilience training.

Applies when

Chinese AI and SaaS providers supplying any ICT service to EU financial entities, and their contract negotiation teams.

Evidence to retain

• · Standard contract template mapped clause by clause to Article 30(2)
• · Inventory of functions and services, the subcontractor list and the subcontracting conditions
• · List of data processing and storage locations and the advance change notification process
• · Technical approach and drill records for data access, recovery and return
• · Incident assistance response process and the cost arrangement documentation

Estimated first-time effort: 15–45 person-days (estimate, not a commitment)

For ICT services supporting critical or important functions the contract must, in addition to the paragraph 2 elements, contain at least the six items in Article 30(3)(a) to (f): (a) full service level descriptions including updates and revisions with precise quantitative and qualitative performance targets allowing effective monitoring and corrective action without undue delay when agreed levels are not met; (b) notice periods and reporting obligations of the provider, including notification of any development that might have a material impact on its ability to provide the services supporting critical or important functions in line with agreed service levels; (c) requirements for the provider to implement and test business contingency plans and to have ICT security measures, tools and policies providing an appropriate level of security in line with the financial entity regulatory framework; (d) an obligation to participate and fully cooperate in the financial entity threat-led penetration testing under Articles 26 and 27; (e) the right to monitor the provider performance on an ongoing basis, comprising unrestricted rights of access, inspection and audit by the financial entity or an appointed third party and by the competent authority (including taking copies on site of documentation critical to the provider operations, a right that other contractual arrangements or implementation policies must not impede or limit), the right to agree alternative assurance levels where other clients rights are affected, an obligation to cooperate fully during on-site inspections and audits, and an obligation to give details of their scope, procedures and frequency; and (f) exit strategies, in particular a mandatory adequate transition period during which the provider keeps supplying the functions or ICT services and which lets the financial entity migrate to another provider or move in-house. For a financial entity that is a microenterprise the access, inspection and audit rights under (e) may be delegated by agreement to an independent third party appointed by the provider. AI providers should note two things: material model or dependency changes and supplier capacity or licensing changes typically qualify as developments with a material impact under (b); and items (e) and (f) drive audit cooperation cost and the room for negotiating exit terms, so they cannot be ignored at the quotation stage.

Applies when

AI providers whose service the financial customer classifies as supporting a critical or important function, such as real-time fraud decisioning, payment risk control or core risk models.

Evidence to retain

• · Definitions of quantitative and qualitative performance targets and monthly attainment reports
• · List of material-impact events, trigger criteria and the notification records
• · Business contingency plan and exercise reports
• · ICT security measures, tools and policies mapped to the customer regulatory framework
• · Ledger of corrective actions taken when service levels were not met
• · Audit and on-site inspection cooperation plan stating scope, procedures and frequency, including when alternative assurance levels apply
• · Records of participation and cooperation in threat-led penetration testing (TLPT)
• · Exit strategy and transition-period service commitments (migration plan, data return, minimum transition duration)

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)

Financial entities must maintain and update, at entity, sub-consolidated and consolidated level, a register of information on all contractual arrangements on the use of ICT services provided by ICT third-party service providers, and must make the full register or specified sections available to the competent authority on request, together with any information necessary for effective supervision. The practical obligation on the provider is to supply and keep current the fields needed for that filing — legal identification, service description, criticality of the supported function, subcontracting chain, locations, service levels — and to push updates when they change, since stale data directly causes customer reporting failures.

Applies when

All providers supplying ICT services to EU financial entities, including intra-group entities providing such services.

Evidence to retain

• · Register field list mapped to internal data sources
• · Records of register information provided to financial customers with update timestamps
• · Subcontracting chain information and subcontractor change notifications
• · Legal entity identification information and group structure description

Estimated first-time effort: 8–25 person-days (estimate, not a commitment)

Article 31(12) provides that financial entities may only use the services of an ICT third-party service provider established in a third country and designated as critical under Article 31(1)(a) if that provider has established a subsidiary in the Union within the 12 months following designation. The recitals note that the subsidiary requirement does not prevent a critical provider from supplying ICT services and related technical support from facilities and infrastructure located outside the Union, and that the Regulation imposes no data localisation obligation. Chinese providers with the scale and concentration profile that could attract designation should plan the EU entity, staffing and oversight cooperation in advance.

Applies when

Chinese cloud, compute or AI platform providers with significant scale and concentration in the EU financial sector; designation is determined by the ESAs under Article 31.

Deadline: Within 12 months following designation

Evidence to retain

• · Contingency plan for establishing the EU entity (form, location, timetable, cost)
• · Description of the EU entity functions, staffing and mandate
• · Named liaison, process and document set for cooperating with the oversight framework
• · Transition and cooperation clauses in customer contracts addressing designation

Estimated first-time effort: 30–120 person-days (estimate, not a commitment)