DORA Contractual Requirements: Article 30 Clause Checklist

Video transcript

If you sell ICT services to EU financial entities, DORA Article 30 sets your minimum contract terms. Here is the vendor-side checklist.

Your client stays fully responsible for its duties, but the clauses land on you. The whole contract, service levels included, must sit in one written document.

Every ICT contract needs nine minimum terms. They include service descriptions, data locations and data return, service levels, incident help, termination rights and security training.

Critical or important functions add six more. Precise performance targets, reporting duties and tested contingency plans. Cooperation in threat-led penetration testing, unrestricted audit rights, and an exit strategy with a mandatory transition period.

Certifications and audit reports help, but clients cannot rely on them alone over time. You must cooperate fully in inspections, including by the Lead Overseer.

For critical functions, you stay responsible for subcontractors. Material changes need notice well in time, so the client can approve or object. Act only after approval or no objection, or risk termination.

Guardian's practical checklist, not a legal requirement, starts with one contract with service levels, a data location map, a data return procedure, a threat-led testing process, a subcontractor register and an exit plan.

Guardian's Technical Evidence service answers due diligence questionnaires once, from one body of evidence. Read the full checklist, or talk to Guardian.

DORA has applied since January 17, 2025. Its Article 30 sets the minimum terms of every contract an EU financial entity signs for ICT services.

DORA covers 20 kinds of financial entity, from banks and insurers to crypto-asset service providers (Article 2). If you sell them ICT services, expect these clauses.

This checklist reads Article 30 from the vendor side: what each clause asks, and what you will need ready.

This article explains the technical and security side of Article 30 of the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It is not legal advice; confirm how it applies to you with counsel.

Who Article 30 Binds

The obligation sits with the financial entity. It remains "fully responsible" for its DORA duties when it uses ICT providers (Article 28(1)).

The clauses still land on the vendor. Two definitions decide which ones apply:

• ICT services: "digital and data services provided through ICT systems" to users "on an ongoing basis" (Article 3(21)).
• Critical or important function: one whose disruption would materially impair the entity's performance, services or compliance (Article 3(22)).

Your client records your contract in its register of information, marked by whether it supports a critical or important function (Article 28(3)).

It may only contract with providers that "comply with appropriate information security standards" (Article 28(5)).

Rights and obligations must be in writing. The full contract, service levels included, must sit in one written document (Article 30(1)).

Article 30(2): Every ICT Contract

These nine elements apply to every contract for ICT services, critical or not. The last column is Guardian's suggestion, not part of the text.

Article 30(3): Critical or Important Functions

Six more terms apply where your service supports a critical or important function.

1. Full service levels with "precise quantitative and qualitative performance targets", so the client can monitor and correct.
2. Notice and reporting of any development that might materially affect your ability to deliver.
3. Contingency and security: implement and test business contingency plans; keep appropriate ICT security measures, tools and policies.
4. TLPT: "participate and fully cooperate" in the client's threat-led penetration testing (Articles 26 and 27).
5. Monitoring rights: unrestricted access, inspection and audit by the client, its appointee and the competent authority.
6. Exit strategies: a "mandatory adequate transition period" in which you keep serving while the client moves elsewhere or in-house.

TLPT and audit cooperation

Monitoring rights include taking copies of relevant documents on-site and full cooperation during inspections, including by the Lead Overseer (Article 30(3)(e)).

Where other clients' rights are affected, the parties may agree alternative assurance levels. You must give details of the scope, procedures and frequency of inspections and audits.

A microenterprise client may let you appoint an independent third party to exercise those rights instead.

Your reports help, but they are not the end of it. Under Delegated Regulation (EU) 2024/1773, the client "shall not over time rely solely" on certifications or audit reports (Article 8(3)).

The same article allows pooled audits and pooled ICT testing, including TLPT, run jointly by clients of the same provider.

Exit and termination

Article 28(7) lists when the client must be able to terminate:

• A significant breach of laws, regulations or contract terms.
• Changes found in monitoring that could alter how the service performs.
• Evidenced weaknesses in your ICT risk management, especially around data.
• The authority can no longer effectively supervise the client because of the contract.

For critical services, the client's exit plans must be "sufficiently tested and reviewed periodically" (Article 28(8)).

The Subcontracting RTS

Article 30(5) called for technical standards on subcontracting. They became Commission Delegated Regulation (EU) 2025/532 of March 24, 2025, published on July 2, 2025 and in force 20 days later.

It applies to ICT services supporting critical or important functions. The contract must specify, among other things (Article 4):

• You remain responsible for services your subcontractors provide.
• You monitor every subcontracted service and report on it.
• Your subcontracts carry the contingency, security and service level terms.
• Subcontractors grant the same access, inspection and audit rights.
• You notify the client of any material change to subcontracting.

Material changes need notice "well in time", and a reasonable period for the client to approve or object. You may implement them only after approval or no objection (Article 5).

The client may write in termination if you subcontract without permission, or push a change through despite an objection or before the notice period ends (Article 6).

Guardian's Vendor Checklist

Guardian's checklist for a security or ICT vendor preparing to sign. It is our practical reading, not a legal requirement:

1. One contract document, with service levels attached.
2. A service catalog that flags critical support and subcontracting terms.
3. Every region and country where you serve and store data.
4. A data return procedure for exit, insolvency or wind-down.
5. Incident assistance terms: included, or priced in advance.
6. A regulator cooperation clause and a named contact.
7. Quantitative service targets, and the reports that prove them.
8. Tested contingency plans and a current security controls summary.
9. A TLPT process: who joins, and how production access works.
10. Audit terms that protect your other clients' data.
11. A subcontractor register with flow-down clauses and change notices.
12. An exit plan: transition period, data handover and migration support.

For the client side, see our DORA guide for crypto companies and how MiCA and DORA work together.

Buyers turn these clauses into questions. Our vendor due diligence questionnaire shows how.

How Guardian Helps

Guardian's Operational Resilience Assessment covers your register of ICT third parties, the contract terms regulators require, concentration risk, and an exit plan tested against the vendor you depend on most.

Its Technical Evidence service answers due diligence questionnaires once, from one body of evidence.

That evidence is delivered as a pack or a trust center page, scoped to its reader: a supervisor, a bank partner or an allocator.

Frequently Asked Questions

What does DORA Article 30 require in every ICT contract?

Nine elements. They cover the service description, service and data locations, data protection, and data return on exit or insolvency. Then service levels, incident help, cooperation with authorities, termination rights and the client's security training.

What extra terms apply to critical or important functions?

Article 30(3) adds precise performance targets, notice and reporting duties, tested contingency plans and security measures, TLPT cooperation, unrestricted access, inspection and audit rights, and exit strategies with a mandatory transition period.

Does DORA require vendors to take part in threat-led penetration testing?

For ICT services supporting critical or important functions, yes. The contract must oblige the provider to participate and fully cooperate in the financial entity's TLPT under Articles 26 and 27 (Article 30(3)(d)).

Are there DORA standard contractual clauses?

Article 30(4) asks both parties to consider standard contractual clauses developed by public authorities for specific services. It does not prescribe a template: the contract must still contain every applicable Article 30 element.

Sources

• EUR-Lex: Regulation (EU) 2022/2554 (DORA), Articles 2, 3, 28, 30 and 64 (December 14, 2022)
• EUR-Lex: Commission Delegated Regulation (EU) 2025/532, RTS on subcontracting ICT services supporting critical or important functions (March 24, 2025; OJ July 2, 2025)
• EUR-Lex: Commission Delegated Regulation (EU) 2024/1773, RTS on the policy for contractual arrangements on ICT services supporting critical or important functions (March 13, 2024; OJ June 25, 2024)
• Guardian: Regulatory and Compliance Assessment