# DORA AI contract gap exercise

Invented supplier clauses illustrate how a financial entity separates general requirements from additional critical-function provisions.

Synthetic contract positions and review findings. No actual vendor clause, negotiated right or legal approval is represented.

Source: https://aona.ai/resources/guides/dora-ai-saas-contract-checklist/
Sources checked: 2026-09-21

## Match the clause to the layer

### General ICT arrangement

Service, locations, data, incident help and termination

### Critical or important function

Additional performance, monitoring, testing and transition provisions

### Actual agreement

Clause references, qualifications and unresolved gaps

| DORA requirement | Invented supplier position | Gap or question |
| --- | --- | --- |
| 30(2): service and locations | “Processing may occur wherever we choose.” | Identify service/data locations and the required advance change notice. |
| 30(2): incident assistance | “Emergency support is charged at our future rate.” | How will the no-additional-cost or ex-ante cost condition be addressed? |
| 30(2): data access and return | “Access ends immediately on termination.” | What arrangements support required access, recovery and return in an accessible format? |
| 30(3): critical-function performance | “We aim to provide a reliable service.” | Where are the necessary quantitative/qualitative targets and material-development reporting? |
| 30(3): critical-function monitoring | “A marketing certificate is our only assurance.” | How do the applicable access, inspection, audit and cooperation provisions operate? |
| 30(3): critical-function exit | “No transition service is available.” | What adequate transition period and migration support are required for this function? |
| Scope and qualifications | The fictional function classification has not been decided. | Resolve applicability before treating every additional provision as mandatory for this case. |

## Review checklist

- [ ] Resolve the applicable layer
  Connect the ICT service to the documented function assessment and relevant Article 30 provisions.
- [ ] Keep the contractual evidence
  Record actual clause references, incorporated documents, gaps and negotiated changes.
- [ ] Check the operational handoff
  Assign owners for notices, incidents, evidence access and exit rather than relying on contract labels alone.

## Included example files

- dora-ai-contract-gap-review.md
- dora-ai-contract-gap-review.csv

## Source references

- DORA Article 30: Key contractual provisions: https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.