DORA register of information: linking vendors to the projects they carry

What the register contains

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) has applied since January 17, 2025. Its Article 28(3) requires keeping a register of all contracts for information and communication technology (ICT) services, at entity and consolidated level, distinguishing those that support critical or important functions.

The format is set by Implementing Regulation (EU) 2024/2956: fifteen table templates. The most useful ones for understanding a dependency:

• contracts and vendors, with the entities that use each service;
• the ICT subcontracting chain (template B_05.02), limited to subcontractors that effectively support a critical function;
• the identification of functions and their criticality (template B_06.01);
• the assessment of each service (template B_07.01): substitutability, existence of an exit plan, difficulty of reintegration.

The reporting calendar

• 2025 : first submission, on the situation at March 31, 2025, sent to the ACPR by April 15, 2025 at the latest.
• From 2026 : annual submission. According to the ACPR, the situation at December 31 of the previous year is submitted by March 31 at the latest, as CSV files uploaded to the OneGate portal.

The registers also serve the European authorities. On November 18, 2025, they used them to designate a first list of nineteen critical ICT third-party providers, including AWS, Google Cloud, Microsoft, Oracle, SAP, IBM, Capgemini, Accenture, Orange and Deutsche Telekom.

What the register does not say

The register is built around contracts and functions. Yet a change at a vendor often plays out at the level of projects : a migration under way, an application being built, a team that depends on a shared platform.

DORA does provide for situations where this link becomes essential:

• Article 28(8) requires documented and tested exit strategies for services that support critical functions;
• Article 30 requires contracts to describe the services, the processing locations with an obligation to give notice before any change, termination rights, and a transition period for critical functions.

When a vendor announces a change of processing location, subcontractor or terms, the question becomes: which projects are hit, which of them support a critical function, and was the exit plan designed with them in mind?

What this touches in a project portfolio

Questions to ask yourself

• For each vendor in the register, which ongoing projects depend on it, directly or through a shared platform?
• Which of these projects support a critical or important function?
• Do our projects this year increase concentration on one of the vendors designated as critical?
• Do the exit plans cover the applications put into service since they were written?
• Who is notified, and within what time, when a vendor announces a change of processing location or subcontractor?

This analysis presents the state of the texts and public sources at the date indicated. It does not constitute legal advice.

Read also

AI vendors · model lifecycle

End of support for an AI model: what needs requalifying?

Read the analysis →Regulation · EU AI Act

AI Act Article 50: which projects are concerned?

Read the analysis →