The Digital Operational Resilience Act (DORA) is the European Union regulation that sets common rules for how financial entities manage technology risk. It has applied since January 2025. Banks, insurers, investment firms, payment institutions and many other financial entities must show they can withstand, respond to and recover from disruption to their information and communication technology, and that includes the services they buy from third parties.
That makes contracts central. The act sets out what agreements with technology providers must contain, and supervisors expect firms to know exactly which contracts support critical functions. This guide, first published before the act applied and updated for 2026, explains the requirements and gives a practical path to compliant contracts. It is general guidance, not legal advice.
What is compliance with the act?
Compliance means meeting the act's requirements for technology risk across the organization. Its scope covers financial institutions such as banks, insurers and investment firms, and it reaches technology service providers such as cloud platforms, software vendors and managed service providers through their contracts with those institutions. Providers designated as critical come under direct oversight.
The act rests on five pillars:
- Technology risk management: a governance framework for identifying, protecting against and recovering from technology risk
- Incident reporting: classifying major incidents and reporting them to supervisors on set timelines
- Resilience testing: regular testing of systems and, for some firms, threat led penetration testing
- Third party risk management: managing the risk that comes from technology providers, including through contract terms
- Information sharing: voluntary exchange of threat intelligence among financial entities
Building a compliant supply chain
Identify technology services and providers
Start by listing every technology service you buy and assessing how important it is to your operations. Services that support critical or important functions carry stricter requirements. Evaluate providers on security controls, incident response, governance and their own reliance on subcontractors.
Keep the register of information
The act requires a register of all contractual arrangements with technology providers. The register depends on accurate contract data: provider, services, functions supported, dates, locations of data and subcontractors. A searchable contract repository makes it far easier to build and maintain.
Terms technology contracts must cover
- A clear description of the services and service levels
- Where services are provided and where data is processed and stored
- Data protection, availability, integrity and confidentiality commitments
- Assistance during technology incidents, and incident notification
- Cooperation with supervisors and resolution authorities
- Termination rights and minimum notice periods
- For critical or important functions: detailed service levels, notice and reporting duties, business continuity plans, participation in testing, audit and access rights, conditions on subcontracting and exit strategies with transition periods
Steps to manage compliance in contracts
- Understand the five pillars and which of your functions are critical or important.
- Review existing contracts and record the gaps against the required terms, starting with providers that support critical functions.
- Add compliant clauses to new and renewing contracts, using approved templates.
- Onboard and monitor providers with risk assessments, evidence collection and regular reviews.
- Connect governance, risk and compliance processes so contract obligations, incidents and risk ratings sit together.
A checklist for compliant technology contracts
| Area | What to check |
|---|---|
| Contract review | Each agreement against the required terms, with gaps recorded and owned |
| Templates | Standard clauses for incident notification, audit, exit and subcontracting |
| Register | Every technology arrangement listed with the required data |
| Obligations | Testing, reporting and notice duties assigned to owners with dates |
| Training | Procurement, legal and business owners understand the requirements |
| Monitoring | Regular reviews of provider performance, incidents and changes |
How Aavenir helps
Aavenir AI reviews technology contracts against the terms the act requires and flags gaps, and a person approves every finding. Aavenir Atlas answers portfolio questions, such as which contracts supporting critical functions lack an exit plan, which helps build the register. ComplianceNext maps regulatory duties to contracts, owners and evidence, and Obligationflow tracks the commitments after signature. See third party risk under the Digital Operational Resilience Act.
Common pitfalls
- Treating the register as a one off spreadsheet rather than a living record tied to contracts
- Reviewing only new contracts and leaving legacy agreements untouched until renewal
- Missing subcontractors that support critical services
- Writing audit and testing rights into contracts without a plan to use them
- Leaving exit strategies vague, with no realistic transition period
Questions supervisors may ask
- Which of your technology contracts support critical or important functions?
- Do those contracts include every term the act requires, and where are the gaps?
- How do you know your providers' subcontractors meet the same standards?
- When did you last test an exit plan for a critical provider?
- How quickly could you produce the register of information, and how current is it?
Being able to answer these from the contract system, rather than from a project team assembled for the occasion, is the clearest sign that compliance has become routine.
The bottom line
The Digital Operational Resilience Act makes technology contracts part of operational resilience. Know which providers support critical functions, write the required terms into every agreement, keep the register current and track the obligations that follow. That is what supervisors will look for.