Compliance decisions
DORA AI supplier contracts: what to check
Start with the ICT service and the function it supports. DORA Article 30 specifies general contract terms and additional requirements where a service supports a critical or important function. Compare the actual agreement with the applicable layer; a supplier’s “DORA-ready” statement is not a contractual right.
For Financial-entity legal, procurement and ICT risk teams
The function assessment determines which additional contract questions matter.
Synthetic contract positions and review findings. No actual vendor clause, negotiated right or legal approval is represented.01
Identify the service and contractual documents
Article 30 requires clear written rights and obligations, with the full contract including service-level agreements in a durable, accessible format. Identify the agreement, order, service description and incorporated terms for the exact AI service. A sales presentation is not the complete contractual record.
Confirm the using and contracting entities and the supported function. Keep the register-of-information entry connected to the same arrangement. This guide reviews contract requirements; it does not determine a financial entity’s scope or classify every employee AI tool as critical.
Source context: DORA Article 30: Key contractual provisions
02
Check the general ICT contract provisions
The general layer includes the service description, relevant subcontracting conditions, service and data locations with advance change notification, data protection, access and return, service levels, incident assistance, authority cooperation, termination and relevant training conditions.
For AI use, separate the backend, model-processing location and onward recipients rather than accepting a cloud-region label as the complete answer. Ask how the contract covers the actual service. Article 30 also addresses incident assistance at no additional cost or at a cost determined in advance, not an undefined emergency charge.
Source context: DORA Article 30: Key contractual provisions
03
Apply the additional layer where required
For ICT services supporting critical or important functions, Article 30 adds requirements including detailed performance targets, material-development reporting, contingency and security measures, threat-led penetration-testing cooperation where applicable, ongoing monitoring rights and exit transition arrangements.
Do not present all of those provisions as interchangeable with the general layer. The article also contains specific qualifications, including alternative assurance where other clients’ rights are affected and a microenterprise provision concerning delegated access, inspection and audit rights. Review the actual conditions rather than describing a generic unlimited audit entitlement.
Source context: DORA Article 30: Key contractual provisions
04
Compare an actual clause with the required outcome
The fictional matrix below uses invented supplier positions to show the review method. A clause saying “locations may change at any time” raises a different question from one specifying locations and advance notice. A downloadable usage report does not necessarily provide the relevant access, inspection or audit right.
Record the contractual source, gap and question for counsel or procurement. Proposed wording in an exercise is not an enforceable promise from a real supplier. Keep operational feasibility in view: the team must be able to receive notices, use evidence and execute a transition, not merely collect contract language.
Source context: DORA Article 30: Key contractual provisions
05
Make the exit and change process usable
For a critical or important function, the mandatory adequate transition-period requirement addresses continuity and migration to another provider or an in-house solution. Determine what data, configuration and service support the entity would need to leave the arrangement without the relevant disruption.
Keep the approved contract review with the function assessment, register entry and responsible owners. Reassess material service, subcontracting or location changes under the applicable requirements. Neither this worksheet nor an Aona control evaluation supplies legal contract approval.
Source context: DORA Article 30: Key contractual provisions
Put it into practice
DORA AI contract gap exercise
Invented supplier clauses illustrate how a financial entity separates general requirements from additional critical-function provisions.
Synthetic contract positions and review findings. No actual vendor clause, negotiated right or legal approval is represented.
General ICT arrangement
Service, locations, data, incident help and termination
Critical or important function
Additional performance, monitoring, testing and transition provisions
Actual agreement
Clause references, qualifications and unresolved gaps
| DORA requirement | Invented supplier position | Gap or question |
|---|---|---|
| 30(2): service and locations | “Processing may occur wherever we choose.” | Identify service/data locations and the required advance change notice. |
| 30(2): incident assistance | “Emergency support is charged at our future rate.” | How will the no-additional-cost or ex-ante cost condition be addressed? |
| 30(2): data access and return | “Access ends immediately on termination.” | What arrangements support required access, recovery and return in an accessible format? |
| 30(3): critical-function performance | “We aim to provide a reliable service.” | Where are the necessary quantitative/qualitative targets and material-development reporting? |
| 30(3): critical-function monitoring | “A marketing certificate is our only assurance.” | How do the applicable access, inspection, audit and cooperation provisions operate? |
| 30(3): critical-function exit | “No transition service is available.” | What adequate transition period and migration support are required for this function? |
| Scope and qualifications | The fictional function classification has not been decided. | Resolve applicability before treating every additional provision as mandatory for this case. |
Work through your review
Use the checks to organise the evidence you need. Your selections stay in this tab.
0 of 3 reviewed
Example files for this task
Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.
dora-ai-contract-gap-review.mdInspect
# DORA AI contract gap exercise
Synthetic contract positions and review findings. No actual vendor clause, negotiated right or legal approval is represented.
Invented supplier clauses illustrate how a financial entity separates general requirements from additional critical-function provisions.
| DORA requirement | Invented supplier position | Gap or question |
| --- | --- | --- |
| 30(2): service and locations | “Processing may occur wherever we choose.” | Identify service/data locations and the required advance change notice. |
| 30(2): incident assistance | “Emergency support is charged at our future rate.” | How will the no-additional-cost or ex-ante cost condition be addressed? |
| 30(2): data access and return | “Access ends immediately on termination.” | What arrangements support required access, recovery and return in an accessible format? |
| 30(3): critical-function performance | “We aim to provide a reliable service.” | Where are the necessary quantitative/qualitative targets and material-development reporting? |
| 30(3): critical-function monitoring | “A marketing certificate is our only assurance.” | How do the applicable access, inspection, audit and cooperation provisions operate? |
| 30(3): critical-function exit | “No transition service is available.” | What adequate transition period and migration support are required for this function? |
| Scope and qualifications | The fictional function classification has not been decided. | Resolve applicability before treating every additional provision as mandatory for this case. |
## Review steps
- Resolve the applicable layer: Connect the ICT service to the documented function assessment and relevant Article 30 provisions.
- Keep the contractual evidence: Record actual clause references, incorporated documents, gaps and negotiated changes.
- Check the operational handoff: Assign owners for notices, incidents, evidence access and exit rather than relying on contract labels alone.
## Fictional negotiation note
Arrangement: CONTRACT-EX-21, invented AI drafting service.
Observed example gaps: undefined processing locations, unspecified incident-support charges and no transition assistance.
Next review: establish actual function criticality and compare the complete agreement with the applicable Article 30 layer.
The quoted positions are invented teaching clauses, not statements about Aona or any named AI vendor. They are not proposed final legal language.
## Source and scope
Guide: https://aona.ai/resources/guides/dora-ai-saas-contract-checklist/
Source check: 21 September 2026. General information, not professional approval or a completed control test.
- DORA Article 30: Key contractual provisions: https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng
dora-ai-contract-gap-review.csvInspect
DORA requirement,Invented supplier position,Gap or question
30(2): service and locations,“Processing may occur wherever we choose.”,Identify service/data locations and the required advance change notice.
30(2): incident assistance,“Emergency support is charged at our future rate.”,How will the no-additional-cost or ex-ante cost condition be addressed?
30(2): data access and return,“Access ends immediately on termination.”,"What arrangements support required access, recovery and return in an accessible format?"
30(3): critical-function performance,“We aim to provide a reliable service.”,Where are the necessary quantitative/qualitative targets and material-development reporting?
30(3): critical-function monitoring,“A marketing certificate is our only assurance.”,"How do the applicable access, inspection, audit and cooperation provisions operate?"
30(3): critical-function exit,“No transition service is available.”,What adequate transition period and migration support are required for this function?
Scope and qualifications,The fictional function classification has not been decided.,Resolve applicability before treating every additional provision as mandatory for this case.
Before you proceed
Keep these distinctions clear
- Marketing is not a contractual right
- Review the binding agreement and incorporated documents.
- Criticality changes the required review
- Do not apply or omit the additional layer without the function assessment.
Apply it to employee AI use
Bring your actual data path.
Aona can contribute scoped information about employee AI use and sensitive-input controls during a service review.
It does not negotiate DORA clauses, classify critical functions or guarantee regulatory compliance.
Use a supported-path security evaluation as one evidence input alongside the actual contract and operational review.
Review your use caseFAQ
Questions for this decision
Do all AI contracts need every critical-function clause?
Does a DORA statement replace contract review?
Can an audit certificate replace all access and audit rights?
Is the example supplier wording real?
Evidence behind the guide
Sources and scope
Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.
- DORA Article 30: Key contractual provisions
General ICT contract requirements and the additional obligations for services supporting critical or important functions, including audit and transition provisions.
law · checked 2026-09-21