The situation
The firm’s ICT vendor contracts and its list of critical or important functions, uploaded
Your e-money institution in Dublin has 43 ICT contracts, from the core banking platform and the cloud provider to a small firm that runs the customer chatbot. DORA has applied since January 2025 and the register of information is filed, but internal audit found that the contracts were never checked against the required terms. The audit committee meets in six weeks.
The list of terms is in one article. The hours go on reading 43 contracts against it: finding where each term sits, judging whether vague wording meets it, identifying which vendors support critical or important functions and so need the longer list, and drafting amendments the vendors will actually sign.
What the research has to settle
The rules behind the answer
- A required minimum for every ICT contract
- DORA requires every contract for ICT services to cover, among other things, a clear description of the services, where data is processed, the availability, integrity and confidentiality of data, access to and return of data on exit, service levels, assistance with ICT incidents, cooperation with the competent authority and termination rights.
- More for critical or important functions
- Where the service supports a critical or important function, the contract also needs full service-level descriptions with precise performance targets, notice and reporting duties, business contingency plans, participation in threat-led penetration testing, unrestricted access, inspection and audit rights, and exit strategies with a transition period.
- The register follows the contracts
- Financial entities keep a register of information on all their ICT third-party contractual arrangements. A contract reclassified as supporting a critical function changes both the register and the terms it must contain.
- Data protection terms overlap
- Where the vendor processes personal data, the GDPR’s processor terms apply alongside DORA. The two lists overlap in places but neither replaces the other, so the check covers both.
How it runs in azta
From the question to the document
The question, as you would type it
Attached are our contracts with the core banking provider and the cloud host, both supporting critical functions. Check each against the contract terms DORA requires, including the additional terms for critical or important functions, and list what is missing or too vague.
You start with
The firm’s ICT vendor contracts and its list of critical or important functions, uploaded
- 01
Upload the contracts
Add the ICT contracts and your list of critical or important functions. azta reads each contract and refers back to the clause it relied on.
File upload· Pro - 02
Check each contract against DORA
Ask for a check against the required terms. azta cites DORA, the delegated and implementing acts published in EUR-Lex and the EDPB material on processor terms.
Cited research· Free - 03
Draft the gap list and amendments
Ask for a gap list per vendor with proposed amendment wording. Edit it in Canvas.
Canvas · Ask azta· Pro - 04
Export for the audit committee
Export the gap list to Word for the audit committee and the vendor negotiations.
Word export· Pro You send
A gap list per vendor with proposed amendment wording
What you get
A gap list per vendor with proposed amendment wording
Gap list · draft
DORA contract terms: core banking provider
Present and adequate. The contract describes the services, states where data is processed and stored, and gives us termination rights on the grounds DORA requires. The data return clause covers both exit and insolvency.
Present but too vague. Service levels are described in qualitative terms only. For a critical function, DORA requires precise quantitative and qualitative performance targets. We propose replacing schedule 3 with the attached service-level annex.
Missing. There is no obligation to take part in our threat-led penetration testing and no exit strategy with a mandatory transition period, and the audit clause limits inspections to once a year on 60 days’ notice. Proposed amendments for each are in Annex A.
Outcomes on your numbers
What azta is worth on this task
Pro pays for itself after
16 minutes a month
At €105 an hour, that is all the time Pro (€27 a month) has to take off your desk to cover its price.
Example figures. Replace them with your own.
- Hours back a year
- 54
- Capacity at your rate
- €5,670
- More ICT contract reviews a quarter
- 3.9
- Return on Pro
- 17.5×
- Research
- Drafting
- Your review
A scenario you set, not a promise. The hours that come back go to another client, or deeper into this one.
Want these numbers on your team’s real workload?
Book a demoWhat stays with you
- Which functions are critical or important, which is your own assessment.
- The negotiation with each vendor.
- Guidance from your competent authority and the European supervisory authorities, which azta does not hold.
Frequently asked questions
- Does azta hold the supervisory authorities’ DORA guidance?
- It holds DORA and the delegated and implementing acts published in EUR-Lex. Guidelines and Q&As of the European supervisory authorities and national regulators are not in the corpus.
- Can it check 40 contracts?
- Upload them in batches and ask for the same check on each. azta refers back to the clause behind each finding, so you can verify it.
- Do our contracts stay in the EU?
- Yes. Client documents stay in the EU/EEA and are never used for training on any plan. On Enterprise, a sealed tenant and SSO are available.
