DORA’s two-year runway, measured in contract renewals

The week

On January 16, 2023, the EU’s Digital Operational Resilience Act, Regulation (EU) 2022/2554, entered into force, with its requirements applying from January 17, 2025. DORA covers a wide range of EU financial entities, including banks, investment firms, payment and e-money institutions, insurers and crypto-asset service providers. It sets requirements for ICT risk management, ICT incident classification and reporting, resilience testing including threat-led penetration testing for significant firms, management of ICT third-party risk, and information sharing. Article 30 lists key provisions that contracts with ICT providers must contain, with more for services supporting critical or important functions. DORA also created an EU framework for designating and directly overseeing critical ICT third-party providers. The NIS2 Directive on network and information security entered into force the same day.

Most early DORA programs started with policies and gap assessments. Those were necessary, but they were not where the schedule broke. DORA applied to every ICT contract from January 2025, including agreements signed years earlier, and a firm cannot rewrite a contract on its own. The two-year window was really a negotiating window, and it raised three questions: what the contracts must say, which contracts are in scope, and when each one can actually be changed. Earlier and later articles in this series cover the register of information. This one is about the agreements behind it.

What the contracts must say

Article 30 sets minimum contents for every contractual arrangement for ICT services. They include a clear description of the services, the locations where services are provided and data processed, provisions on data availability, integrity and confidentiality, and the firm’s ability to recover and return its data if the provider fails or the contract ends. They also require service level descriptions, provider assistance during ICT incidents at no cost or a cost set in advance, cooperation with the firm’s regulators, and defined termination rights.

Contracts for services supporting critical or important functions need more. They must carry precise quantitative and qualitative performance targets and notice and reporting duties. They need provider business contingency plans that are tested, participation in the firm’s threat-led penetration testing where relevant, unrestricted rights of access, inspection and audit, and exit strategies with a mandatory transition period.

Few legacy agreements met all of this. Older outsourcing contracts often had audit rights limited to pooled reports, incident clauses written for availability rather than security, and exit terms that said little about transition support. Standard cloud and software terms were frequently silent on cooperation with a customer’s regulator. Each gap had to be closed by amendment, addendum or replacement. Exit terms were often the hardest. A provider can accept an audit clause at little cost, but a commitment to support a transition to a competitor for a defined period, at defined rates, has a price. Firms that asked for exit support only after deciding to leave found it was no longer available on reasonable terms.

Which contracts are in scope

The basic requirements applied to all ICT services, which in a mid-sized bank can mean hundreds of agreements: software licenses, cloud subscriptions, data feeds, managed security services and network carriers. Intra-group arrangements count too, so a US parent providing technology to its EU subsidiary needed compliant intra-group agreements.

The heavier requirements depended on whether a service supports a critical or important function. That classification had to come first, because it determined which contracts needed the full set of clauses and which could be handled with a standard addendum. Firms that classified late spent their negotiating capacity on the wrong agreements. Classification also had to be defensible to supervisors, so the reasoning for each function needed to be written down, not just the result.

Subcontracting widened the scope. A provider supporting a critical function may rely on a cloud platform, an offshore support center and embedded third-party components. DORA required firms to address material subcontracting, and the detailed technical standards were still being written in 2023. Contracts negotiated early needed language flexible enough to absorb standards not yet final.

When the contracts can be changed

This was the binding constraint. A firm’s contract portfolio has its own calendar. Some agreements renew within the window and can be renegotiated in the normal course. Others run past January 2025 and need an amendment the provider must agree to mid-term. Some auto-renew with notice periods that pass unnoticed if nobody is tracking them.

Bargaining power varied sharply. A large bank negotiating with a niche vendor could insist on its own clauses. A small payment institution facing a hyperscale cloud provider or a dominant core banking vendor usually could not. Large providers responded by publishing standard DORA addenda, which saved time but meant accepting the provider’s interpretation. Firms had to decide where a standard addendum was good enough and where to spend scarce negotiating time.

The practical tool was a contract remediation plan built from the portfolio itself. Each agreement got a criticality rating, a gap score against Article 30, a renewal or amendment date and a negotiation owner. Critical services whose contracts did not renew before January 2025 went to the top, because they required providers’ cooperation outside the normal cycle. Procurement, legal, the business owner and the risk function had to work from the same list. In many firms that was the first time those teams had shared a single view of the vendor base.

The economics deserved attention. Remediation consumed legal and procurement capacity for two years. Providers sometimes priced new audit or exit commitments into renewals. Firms that consolidated overlapping vendors during remediation reduced both the negotiating load and the ongoing oversight burden. Firms that patched every contract separately paid for the same clauses many times.

With hindsight

DORA applied on schedule in January 2025, and many firms were still finalizing contract amendments with smaller providers well into that year. The subcontracting standards took a detour. The European Commission rejected the authorities’ draft in January 2025 and adopted a revised version in March 2025 without the article that would have imposed detailed monitoring clauses across subcontracting chains. Supervisors collected the first registers of information in spring 2025. On November 18, 2025, the European Supervisory Authorities published a list of 19 designated critical ICT third-party providers, including the largest cloud providers and financial-sector technology firms. Direct oversight of those providers does not relieve firms of their own contractual duties. The firms that built a single remediation plan in 2023 and 2024 have kept it as a living contract register, which also serves US third-party risk expectations.