# DORA AI contract gap exercise

Synthetic contract positions and review findings. No actual vendor clause, negotiated right or legal approval is represented.

Invented supplier clauses illustrate how a financial entity separates general requirements from additional critical-function provisions.

| DORA requirement | Invented supplier position | Gap or question |
| --- | --- | --- |
| 30(2): service and locations | “Processing may occur wherever we choose.” | Identify service/data locations and the required advance change notice. |
| 30(2): incident assistance | “Emergency support is charged at our future rate.” | How will the no-additional-cost or ex-ante cost condition be addressed? |
| 30(2): data access and return | “Access ends immediately on termination.” | What arrangements support required access, recovery and return in an accessible format? |
| 30(3): critical-function performance | “We aim to provide a reliable service.” | Where are the necessary quantitative/qualitative targets and material-development reporting? |
| 30(3): critical-function monitoring | “A marketing certificate is our only assurance.” | How do the applicable access, inspection, audit and cooperation provisions operate? |
| 30(3): critical-function exit | “No transition service is available.” | What adequate transition period and migration support are required for this function? |
| Scope and qualifications | The fictional function classification has not been decided. | Resolve applicability before treating every additional provision as mandatory for this case. |

## Review steps

- Resolve the applicable layer: Connect the ICT service to the documented function assessment and relevant Article 30 provisions.
- Keep the contractual evidence: Record actual clause references, incorporated documents, gaps and negotiated changes.
- Check the operational handoff: Assign owners for notices, incidents, evidence access and exit rather than relying on contract labels alone.

## Fictional negotiation note

Arrangement: CONTRACT-EX-21, invented AI drafting service.
Observed example gaps: undefined processing locations, unspecified incident-support charges and no transition assistance.
Next review: establish actual function criticality and compare the complete agreement with the applicable Article 30 layer.

The quoted positions are invented teaching clauses, not statements about Aona or any named AI vendor. They are not proposed final legal language.

## Source and scope

Guide: https://aona.ai/resources/guides/dora-ai-saas-contract-checklist/

Source check: 21 September 2026. General information, not professional approval or a completed control test.

- DORA Article 30: Key contractual provisions: https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng