--- title: DORA Contract Review for ICT Third Party Risk | Aavenir url: https://aavenir.com/use-cases/third-party-risk-dora-contracts/ description: Check ICT contracts against the provisions DORA Article 30 requires, such as exit plans, audit rights and data locations, then track every fix to an owner. updated: 2026-11-07 --- [Home](https://aavenir.com/) / [Use cases](https://aavenir.com/use-cases/) / Third party risk and DORA Use case ยท Third party risk and DORA # Do our ICT contracts meet DORA and our third party rules? Aavenir screens each contract with an ICT provider against a checklist built from DORA Article 30 and your own third party policy, and cites the clause behind every result. Legal decides what each gap needs, and every fix gets an owner. Definition ## What is a DORA contract review? A DORA contract review checks each contract with an ICT third party service provider against the key contractual provisions in Article 30 of the Digital Operational Resilience Act, and records which provisions are present, weak or missing. DORA is [Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj), and it has applied to EU financial entities since 17 January 2025. Article 30 lists what every ICT services contract must contain, and adds further provisions where the service supports a critical or important function. Many of those contracts were signed years earlier, on the provider's paper. Aavenir reads them against the list, and your counsel decides what satisfies the regulation. - Checklist built from Article 30, with the extra terms for critical or important functions - Your own third party policy screened in the same pass - Each result cites the clause, or records that none was found - Legal confirms every finding before remediation starts - Fixes run as amendments and owned tasks, with evidence on the record Why it leaks ## Why ICT contracts fall short of what the regulation lists. ### Signed before the rules Many ICT contracts still in force were negotiated before DORA applied. ### Critical functions need more Exit strategies, audit rights and contingency testing apply on top of the base list. ### Terms spread across documents Data locations sit in a schedule, audit rights in the master, exit terms in a SOW. ### Remediation lives in email Gaps are found in a spreadsheet review, and the amendments are chased one by one. How it works ## From the regulation to a remediated contract. - Base provisions for every ICT services contract Additional provisions where a critical or important function is supported Your own third party requirements added alongside. - The Avy compliance screening agent checks each contract and scores the gaps Masters, schedules and SOWs read together Each result cites the clause, or records that none was found. - Plain language questions across the screened contracts Answers ranked by the criticality of the function supported The next best question narrows a gap to a fix. - Amendments drafted and negotiated in Contractflow, redlined in Word Recurring duties, such as contingency plan tests, become Obligationflow tasks Evidence files to the task, ready for the supervisor or the auditor. Watch ## See it in the product. [0:49 Demo Connected use case: contract management and ServiceNow GRC](https://www.youtube.com/watch?v=z3S5uqa-Q10) Questions ## Talk to a contract expert Bring a few sample agreements. We will show you Aavenir AI reading them, on ServiceNow or standalone. Schedule a demo ## Third party risk, by product and team [Aavenir Atlas The product behind this use case Learn more](https://aavenir.com/solutions/ai-contract-intelligence/)[Legal Playbook review and remediation Learn more](https://aavenir.com/solutions/legal-contract-management/)[IT ICT vendors, SLAs and security evidence Learn more](https://aavenir.com/solutions/it-contract-management/) Frequently asked questions (FAQ) ## Common questions ### ### What does DORA require in ICT contracts? Article 30 of DORA lists provisions every ICT services contract must include, such as service descriptions, data locations, data return on exit, service levels and termination rights. Contracts supporting critical or important functions also need audit rights, contingency testing and exit strategies. [See the financial services page](https://aavenir.com/industries/financial-services/). ### ### How do you review contracts for DORA compliance? Build a checklist from Article 30, mark which contracts support critical or important functions, screen each contract against the list, and record the clause or the gap. Aavenir runs the screening with Avy, cites each result, and tracks every remediation to an owner. Your counsel decides what satisfies the regulation. [Explore Atlas](https://aavenir.com/solutions/ai-contract-intelligence/). ### ### Can Aavenir screen contracts against our own third party policy too? Yes. The Avy compliance screening agent checks a set of contracts against any written policy and scores the gaps, so your internal requirements run in the same pass as the Article 30 checklist. Every result cites the clause and waits for a person to confirm it. [Meet Avy](https://aavenir.com/platform/avy-ai-assistant/). ### ### How are DORA gaps fixed and evidenced? Missing terms are negotiated as amendments in Contractflow, with counterparties redlining in Word. Recurring duties, such as contingency plan tests or reporting, become Obligationflow tasks with owners, and the evidence files to the task, so the record is ready when a supervisor asks. [See obligation tracking](https://aavenir.com/use-cases/contract-obligation-tracking/). Have a question we have not answered? [Ask the Expert](https://aavenir.com/contact/) Schedule a demo ## See your contracts run on one record. - **1****A 30 minute walkthrough**Built around your team, whether that is procurement, legal, IT or finance. - **2****Your contracts, not ours**Bring a few sample agreements and watch Aavenir AI extract and review them. - **3****ServiceNow or standalone**We show the deployment that fits the systems you already run. Prefer to talk first? [Contact the team](https://aavenir.com/contact/). The form did not load. [Contact the team](https://aavenir.com/contact/) instead, or refresh the page.