Guide · DORA
DORA register of information: what Article 28 requires
Under DORA Article 28(3), every financial entity keeps a register of information covering all its contractual arrangements for ICT services from third-party providers, at entity level and at sub-consolidated and consolidated levels, and marks which of them support critical or important functions. It reports on new arrangements at least once a year and hands over the full register when its competent authority asks.
As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.
The figure behind it
Article 30(2) lists 9 elements every ICT contract must contain, and Article 30(3) adds 6 more for services supporting critical or important functions; DORA has applied since 17 January 2025. Source: Regulation (EU) 2022/2554, Articles 30 and 64, EUR-Lex text as held by Rekvira (corpus of 2 September 2026)
A register entry is only as good as the contract behind it. This page takes Article 28 and Article 30 as Rekvira returned them on 24 September 2026, from the EUR-Lex text of Regulation (EU) 2022/2554.
What does Article 28(3) require?
Five duties sit in one paragraph. They are easy to blur together, so here they are one per row.
| Duty | Article 28(3) wording |
|---|---|
| Keep the register | "maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services" |
| Classify each entry | "appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not" |
| Report yearly | "at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided" |
| Hand it over on request | "the full register of information or, as requested, specified sections thereof" |
| Warn in advance | "inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important" |
read_unit on 24 September 2026.The last row has a timing consequence. The notice concerns a planned arrangement, so it comes before the signature, and it applies again when an existing function becomes critical or important.
What must you check before an arrangement goes into the register?
Article 28(4) sets five checks before any ICT contract is concluded, critical or not:
- Whether the arrangement covers ICT services supporting a critical or important function (point (a)).
- Whether the supervisory conditions for contracting are met (point (b)).
- All relevant risks, including whether the arrangement adds to ICT concentration risk under Article 29 (point (c)).
- Due diligence on the prospective provider, through the whole selection (point (d)).
- Conflicts of interest the arrangement may cause (point (e)).
The answer to check 1 is also the classification the register needs, so record it with its reasons.
What must the contract itself say?
A register entry points at a contract, and Article 30 decides what that contract contains. The whole contract, including the service level agreements, has to be "documented in one written document" (Article 30(1)).
| Point | Every ICT contract, Article 30(2) |
|---|---|
| (a) | Description of all functions and services, and whether and on what conditions subcontracting of a critical or important function is permitted |
| (b) | Locations where services are provided and data processed, and advance notice of any change |
| (c) | Availability, authenticity, integrity and confidentiality of data, including personal data |
| (d) | Access, recovery and return of data on insolvency, resolution, discontinuation or termination |
| (e) | Service level descriptions |
| (f) | Help with ICT incidents at no additional cost, or at a cost fixed in advance |
| (g) | Full cooperation with competent and resolution authorities |
| (h) | Termination rights and minimum notice periods |
| (i) | Participation in the entity's security awareness and resilience training |
For services that support critical or important functions, Article 30(3) adds six more: full service levels with "precise quantitative and qualitative performance targets", notice and reporting duties, business contingency plans and security measures, participation in the entity's threat-led penetration testing, unrestricted rights of access, inspection and audit, and exit strategies with "a mandatory adequate transition period".
9
elements every ICT contract needs (Article 30(2))
+6
more for critical or important functions (Article 30(3))
4
circumstances in which the contract must be terminable (Article 28(7))
read_unit on 24 September 2026.What does a real review find?
We asked an assistant connected to Rekvira to review an invented contract: a small Lithuanian bank signing a three-year hosted core-banking deal whose draft lets the vendor subcontract hosting without notice, allows termination only for material breach, gives no audit right beyond an annual SOC 2 report and has no exit plan. The companies are illustrative; the tool calls and the text are real. The recorded run made 55 tool calls in 2.1 minutes and verified 32 citations. Against Article 28(3) it produced the register entry and flagged that the planned arrangement has to be notified to the competent authority before signing. It also noted what it could not do, because the register templates in the technical standards are not in the corpus.
When can you walk away from the contract?
Article 28(7) requires that every ICT contract "may be terminated" in four circumstances: a significant breach of law or contract by the provider; circumstances found in monitoring that could alter the performance of the functions; evidenced weaknesses in the provider's ICT risk management; and conditions under which the competent authority "can no longer effectively supervise the financial entity". A draft that allows termination only for material breach covers the first of the four.
For critical or important functions, Article 28(8) adds exit strategies and exit plans that are "comprehensive, documented" and "sufficiently tested and reviewed periodically".
Recorded run
The question:What does DORA's register of information have to contain, who keeps it, and what must the ICT contracts in it say?
get_workflow(workflow_id="dora-ict-third-party")Load the ICT third-party playbook.
search_regulation(regulation="dora", query="register of information contractual arrangements ICT third-party service providers")Let the corpus rank the passages for the question as a risk lead types it.
"Article 28(3)" ranked first of 25 passages for the question as a risk lead would type it.
read_unit(regulation="dora", kind="article", number="28")Article 28 whole: the general principles and the register.
Article 28 whole, 10 paragraph pinpoints, including "Financial entities shall report at least yearly to the competent authorities"
read_unit(regulation="dora", kind="article", number="30")Article 30 whole: the key contractual provisions.
Article 30 whole, including "documented in one written document" and "a mandatory adequate transition period"
verify_citation(regulation="dora", citation="Article 28(3)", quote="financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information")Check the register sentence before quoting it.
Quote found for the Article 28(3) sentence quoted at the top of this page.
read_unit(regulation="dora", kind="article", number="64")The date DORA applies from.
"It shall apply from 17 January 2025."
Real calls to Rekvira’s production server, captured 24 September 2026. Corpus as of 2 September 2026.
Limits
Rekvira holds the text of DORA itself. It does not hold the regulatory and implementing technical standards (including the register templates) or national guidance from your competent authority, so field lists and reporting channels have to come from those sources. Whether a function is critical or important, and whether a contract is acceptable, stays the financial entity's decision.
Do this in your assistant
Use Rekvira to review this ICT contract against DORA. Read Articles 28 and 30. For each point of
Article 30(2), and of Article 30(3) if the service supports a critical or important function,
quote the requirement and say whether the draft covers it, partly covers it or is silent.
Then draft the register-of-information entry under Article 28(3).Paste this into Claude, ChatGPT, Cursor or any MCP client connected to https://mcp.rekvira.com/mcp. Sign in once with your email to start (free).Install steps for each client
Start with a free account.
One email to sign in, no API key, and free during the beta.
https://mcp.rekvira.com/mcp