Contract review is a quality assurance problem
DORA, the EU Digital Operational Resilience Act, has applied since January 17, 2025 (William Fry). Article 30 sets the terms that must appear in contracts for ICT services. For a firm with hundreds of ICT contracts, checking that every one contains the right clauses is a classic quality assurance task: a defined standard, a large population of documents, sampling, findings and remediation.
QA managers in financial institutions and in ICT providers serving them are well placed to run that review.
The Article 30 standard
The Dutch Authority for the Financial Markets (AFM) summarizes the required provisions (AFM):
| All ICT services contracts | Additional terms for critical or important functions |
|---|---|
| Both parties’ rights and obligations | Provider reporting obligations |
| Full description of the services | Implementing and testing business contingency plans |
| Regions or countries where services are provided and data is processed | Cooperation in threat-led penetration testing (TLPT) |
| Service levels | Rights of inspection and audit by the financial entity or an appointed third party |
| Data protection: availability, authenticity, integrity, confidentiality | More detailed subcontracting provisions, including accurate KPIs |
| Support in case of incidents | |
| Termination rights and minimum notice periods |
William Fry adds that contracts for critical or important functions also need exit strategies and unrestricted access, inspection and audit rights.
A QA method for contract review
1. Define the population
Start from the register of information, which must record every ICT services contract and flag those supporting critical or important functions. Reconcile it against procurement and legal records so nothing is missed.
2. Build the checklist
Turn each Article 30 provision into a check item with an acceptance criterion, for example: “Data processing locations named at country level.”
3. Prioritize
Review every contract supporting critical or important functions. Sample the rest, weighted by spend, data sensitivity and provider concentration.
4. Record findings consistently
For each contract: provision present, partially present or missing; clause reference; comment. Consistent findings make remediation and reporting possible.
5. Remediate and verify
Track amendments with providers and verify the updated contract, not just the promise to update.
Why the register’s quality matters more now
The European Supervisory Authorities used data from financial entities’ registers of information to designate critical ICT third-party providers, publishing the list on November 18, 2025 (EIOPA). Register data are therefore used by supervisors, not just filed. Inaccurate function flags or missing contracts are quality defects with supervisory consequences.
Who you work with
- Legal: contract language and amendments.
- Procurement / vendor management: contract inventory and provider relationships.
- ICT risk: criticality assessment and security requirements.
- Compliance: supervisory reporting and the register.
- Internal audit: independent assurance over the process.
Common weaknesses
- Review limited to new contracts; legacy contracts never checked.
- Critical or important function flags inconsistent with business impact assessments.
- Clauses present in master agreements but overridden in schedules or order forms.
- Subcontracting terms missing for critical services.
- Findings tracked by email, not in a controlled log.
Checklist
- Contract population reconciled to the register of information
- Article 30 checklist with acceptance criteria
- All critical or important function contracts reviewed
- Risk-based sample of other contracts reviewed
- Findings log with remediation owners
- Amended contracts verified
How AskDona helps
Reading hundreds of ICT contracts, including schedules and order forms, against Article 30 takes weeks. AskDona reads each contract against your Article 30 checklist, shows whether each provision is present, partly present or missing, and cites the clause and page. Run a sample DORA contract review on five contracts for critical functions. AskDona shows the evidence; your legal and compliance teams decide.
Editor’s note: Article 30 provisions are summarized from the Dutch AFM and William Fry; check the regulation and related technical standards for exact wording. Not legal advice. The LinkedIn count was supplied by the client.
FAQ
What is DORA Article 30? The article setting key contractual provisions for ICT services contracts.
Do all ICT contracts need the same terms? No. All need a base set; contracts supporting critical or important functions need additional terms.
Where should a review start? With the register of information, reconciled to contract records.
Why does register quality matter? Supervisors used register data to designate critical ICT third-party providers in November 2025.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| AFM: DORA third-party providers | Supervisor guidance | Article 30 provisions |
| William Fry: DORA management of ICT third-party risk | Law firm analysis | Application date, Article 30(3), register |
| EIOPA: ESAs designate critical ICT third-party providers (Nov 18, 2025) | Supervisor press release | Register use in CTPP designation |