DORA · ICT third-party risk
Third-party risk under DORA.
Handled without a bigger team.
DORA asks financial entities to manage ICT third-party risk, keep a register of every ICT arrangement, put specific terms in contracts and plan how to exit critical providers. Your AI colleague does that work across every supplier. Your people make the decisions, and every decision becomes a receipt.
What it asks of you
- 01
A strategy and a register.
Manage ICT third-party risk as part of your ICT risk framework, and keep a register of information on all contractual arrangements with ICT providers. (Art. 28)
- 02
Exit strategies for critical services.
For ICT services that support critical or important functions, have exit strategies that are documented and tested. (Art. 28(8))
- 03
The right contract terms.
Contracts must contain key provisions, including access, audit and inspection rights and termination rights. (Art. 30)
How Proofbacked helps
- 01
Register of information, from your data.
Shaped to the EU templates and filled from the same supplier, service and contract data your decisions use. What is missing is shown, not invented.
- 02
Contracts read clause by clause.
Your AI colleague extracts obligations and flags missing Article 30 terms. A person approves every clause before it is recorded.
- 03
Exit plans that exist.
When a critical service is approved, an exit plan is drafted and the missing exit terms are listed, signed off by the mandate holder.
Source Regulation (EU) 2022/2554 (DORA), Articles 28-30; Commission Implementing Regulation (EU) 2024/2956 (register of information templates). Summarised for orientation; not legal advice.