ICT Third-Party Risk under DORA

The register of information

Entities must keep a structured register of every ICT third-party arrangement, distinguishing those that support critical or important functions, and report it to competent authorities. Getting that distinction right is its own exercise: see our guide to classifying critical or important functionsfor the statutory test, the EBA's supporting factors, and a practical checklist. Our TPP register generator produces a register in the EBA format, and our guide to building your first register walks through where to start and the most common mistakes.

Contractual requirements & oversight

Contracts must include specific provisions on access, audit, exit strategies, and sub-outsourcing. Critical ICT third-party providers are additionally subject to a new EU-level oversight framework led by a Lead Overseer from the European Supervisory Authorities, assisted by a Joint Examination Team and funded by an oversight fee charged to the provider itself, with Article 34 requiring multiple Lead Overseers on the same provider to coordinate through a shared oversight protocol. The sub-outsourcing provisions are not left to negotiation: the RTS on subcontracting sets out exactly what must be assessed before a critical or important function is subcontracted, a notice-and-objection mechanism the ICT provider must follow before making material changes to its subcontracting chain, and mandatory contract termination rights if it does not. See our guide to the DORA subcontracting RTS for the checklist to apply before signing off.

Concentration risk (Article 29)

Before and during outsourcing, entities must also assess ICT concentration risk, whether contracting a provider creates a heavy dependency on one supplier, and how easily the service could be moved if needed. For a practical walkthrough of what Article 29 requires and how the November 2025 critical-provider designations changed the reference point, see our guide to DORA concentration risk.

Article 30: what the contract itself must say

Article 28 sets the register and the process; Article 30 sets the actual contract terms the register is meant to reflect. Every ICT third-party arrangement needs baseline provisions covering service description, data location, availability commitments, and cooperation with supervisors. Arrangements supporting a critical or important function are held to a stricter tier: unrestricted access, inspection, and audit rights for the entity, its auditor, and the competent authority; termination rights the provider cannot contract away, including for failing to meet resilience or security standards, at a competent authority's request, or after a material breach; and exit assistance, a contractual duty on the provider to help the entity transition out, not just a right to leave. Contracts negotiated before Article 30 existed rarely include all of this by default, so the article most often shows up as a gap-remediation exercise on legacy paper rather than clean-slate drafting on new deals. See our Article 30 contractual provisions guide for the full clause-by-clause checklist.