Explainer · DORA
How do you keep a register of technology providers and their subcontractors current?
Under the EU’s DORA, a financial entity keeps a register of its technology contracts. When a provider lists its subcontractors on its website, that page is where they change.
The register covers every contract for ICT services, and the subcontractors behind services that support critical or important functions.
Every passage below is quoted from the official text, with the date we read it.
In force
17 January 2025
The day DORA began to apply, in the words of its Article 64: “It shall apply from 17 January 2025.”
It applies to the financial entities in its Article 2(1): among them banks, investment firms, payment institutions and insurers. Article 2(3) and (4) leave some out.
official text · read November 1, 2026
The register
What is the register of information?
It covers all ICT services contracts, critical or not.
DORA, Regulation (EU) 2022/2554, Article 28(3)
As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.
DORA, Regulation (EU) 2022/2554, Article 28(3), fourth subparagraph
Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity.
The same paragraph asks for a report to the competent authorities at least yearly: the number of new arrangements, the categories of provider, the type of contract and the services provided.
The subcontracting chain
Your provider is rank 1. Its subcontractors come after.
The register's templates come from Implementing Regulation (EU) 2024/2956, published on 2 December 2024. It records the chain by rank.
1
Your direct provider.
The company that signed the ICT services contract with you.
2+
Its subcontractors.
The companies your provider relies on to deliver that service, and theirs in turn.
Commission Implementing Regulation (EU) 2024/2956, Article 2
The rank of the direct ICT third-party service provider in the ICT service supply chain shall always be ‘1’. The rank of the subcontractor in the ICT service supply chain shall always be higher than ‘1’.
Commission Implementing Regulation (EU) 2024/2956, Article 1(2)
‘ICT service supply chain’ means a sequence of contractual arrangements connected with the ICT service being provided by the direct ICT third-party service provider to the financial entity, starting with the direct ICT third-party service provider which has one or multiple other ICT third-party service providers as counterparties (subcontractors);
Which subcontractors
Only the ones behind critical or important functions.
Not every name on a provider's sub-processor list belongs in the register.
Commission Implementing Regulation (EU) 2024/2956, Article 3(2)
Financial entities shall ensure that the templates referred to in paragraph 1 include all of the following: (a) the relevant information in relation to all the ICT services provided by direct ICT third-party providers; (b) information on all subcontractors that effectively underpin ICT services supporting critical or important functions or material parts thereof.
Deciding which entries qualify is your firm’s call. The standard’s recital says the chain is yours to watch:
Commission Implementing Regulation (EU) 2024/2956, recital 6
The provision of ICT services to financial entities may rely on potentially long or complex chains of subcontracting which should be monitored by the financial entities.
Current
Review it regularly. Correct it promptly.
The register is not filed once. It has to stay accurate.
Commission Implementing Regulation (EU) 2024/2956, Article 3(3)
Financial entities shall ensure that the information contained in the templates referred to in paragraph 1 is accurate and consistent. Financial entities shall review the information contained in the templates regularly and shall promptly correct any errors or discrepancies detected.
The practical problem
The chain changes on someone else’s web page.
Where a provider publishes its subcontractors as a list on its site, it edits them there.
Your provider adds or drops a subcontractor.
It updates the list on its own web page.
Your register shows the old chain until someone reads that page again.
Where we fit
Know the day the list changes.
We read 118 sub-processor lists published by the AI vendors we watch, every day, and keep a dated copy of each reading.
When a list changes, you get the names added or removed and the date we read it. What goes in your register stays your decision.
Banks and insurers can start with a free vendor-change audit. For the monitoring side, who is expected to notice a change.
Common questions.
- What is the DORA register of information?
- A record each EU financial entity keeps of all its contracts for ICT services from third-party providers. Article 28(3) of Regulation (EU) 2022/2554 requires it; Implementing Regulation (EU) 2024/2956 sets its templates.
- Does the register list subcontractors?
- Some. Article 3(2)(b) of Implementing Regulation (EU) 2024/2956 asks for all subcontractors that effectively underpin ICT services supporting critical or important functions or material parts thereof.
- Since when does DORA apply?
- Article 64 of the regulation says it applies from 17 January 2025.
- Who has to keep the register?
- The financial entities listed in DORA Article 2(1), points (a) to (t), among them credit institutions, investment firms, payment institutions, and insurance and reinsurance undertakings. Article 2(3) and (4) leave some out.
- Is an AI vendor an ICT third-party service provider?
- DORA Article 3 defines one as an undertaking providing ICT services: digital and data services provided through ICT systems on an ongoing basis. Whether a given AI contract fits is for your firm to decide.
Not legal advice.
This page quotes DORA and its register standards. It does not say whether they apply to your firm or how to fill in your register. Your counsel and your supervisor do.
Xither Staff Writer · reviewed November 1, 2026. Regulatory passages are quoted from the official texts on the date shown. Counts come from the record when the page is served.
Hear the morning we read a change to your vendor’s sub-processor list or DPA.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.
Try it free for 14 daysNo card. Nothing to cancel.