Does DORA apply to a US software company?

Not directly, in the ordinary case. DORA places obligations on EU financial entities — banks, insurers, investment firms, payment institutions, crypto-asset service providers and others — and on ICT third-party service providers designated as critical. A typical non-EU SaaS vendor is neither. What reaches you is contractual: the financial entity cannot lawfully keep using your service unless the contract contains a specific set of terms, so those terms arrive in your next renewal whether or not any regulator has ever heard of you.

What contract terms does DORA require from an ICT provider?

Article 30 sets a baseline for every ICT contract and a longer list for services supporting critical or important functions. The baseline covers a clear description of the service, service locations and data processing locations, data protection and availability terms, assistance at no additional cost during an ICT incident, cooperation with competent authorities, and termination rights. For critical or important functions the contract additionally needs service level descriptions with precise quantitative targets, notice periods and reporting duties, incident support obligations, participation in the financial entity's security awareness and testing programmes, unrestricted audit and access rights, and documented exit strategies with transition assistance.

Does the AI model provider behind our feature have to be disclosed?

Yes, if the service supports a critical or important function. DORA treats subcontracting as part of the risk surface, so the financial entity has to know the chain, record it, and retain the ability to object to material changes in it. For AI features that means naming the model provider, the region the inference runs in, and any vector database, retrieval layer or evaluation vendor in the path. Vendors who describe this as 'proprietary infrastructure' are the ones who fail the review, because the answer the customer needs is a list of legal entities and locations, not an architecture diagram.

What is the register of information and why does it matter to a vendor?

Every financial entity maintains a register of all contractual arrangements for ICT services and reports it to its competent authority, which feeds supervisory analysis at EU level. Your company appears in that register as a named legal entity, with your LEI where you have one, the function you support, whether it is critical or important, and your subcontracting chain. The practical consequence is that vague answers no longer die inside a procurement thread — they become a blank field in a regulatory filing that someone at your customer has to explain.

Could an AI vendor be designated a critical ICT third-party provider?

It is possible but unlikely for most vendors. Designation by the European Supervisory Authorities targets providers whose failure would be systemic across the EU financial sector — the scale of a hyperscale cloud or a major core-banking platform, not a departmental SaaS tool. Designated providers fall under a direct EU oversight framework with a lead overseer. The realistic risk for a mid-size AI vendor is not designation; it is being a named subcontractor inside somebody else's designated chain, or being the reason a customer cannot complete its own register entry.

DORA and Your AI Feature: What EU Financial Customers Now Require of Software Vendors (2026)

The Transmission Mechanism

DORA is an EU regulation on digital operational resilience for the financial sector. It applies to a long list of regulated entities — credit institutions, insurers and reinsurers, investment firms, payment and e-money institutions, crypto-asset service providers, trading venues, fund managers — and it obliges each of them to manage ICT third-party risk as a supervised activity rather than as a procurement preference.

Nothing in that sentence mentions you. The mechanism that reaches you is that the regulated entity cannot satisfy its own obligations unless specific things are true about its contract with you. So the obligation arrives as a redline, an addendum, or a security questionnaire with a section nobody used to ask about — and the leverage behind it is not a fine you might pay, it is a renewal your customer is not permitted to sign.

Two Tiers, and Only One of Them Is Painful

The single most useful question to ask a financial customer early is whether your service is being classified as supporting a critical or important function. The answer determines which of these two lists you are negotiating against, and getting it settled in week one saves a quarter of contract cycles.

All ICT Contracts — Baseline

•Clear description of the functions and services provided
•The locations where services are provided and data is processed
•Data protection, availability, integrity and confidentiality terms
•Assistance during an ICT incident at no additional cost
•Cooperation with the customer's competent authorities
•Termination rights and notice periods

Critical or Important Functions — Additional

•Quantitative service level targets, not best-effort language
•Full audit, inspection and access rights, unrestricted
•Participation in the customer's testing and awareness programmes
•Incident reporting duties with defined timelines
•Conditions and approval gates for subcontracting
•A documented exit strategy with a transition period

Where AI Features Break the Template

Most of Article 30 is answerable by any competent SaaS vendor. The clauses that stall are the ones that assume you control your own stack — and an AI feature usually does not.

Your Subcontracting Chain Includes a Model Provider You Cannot Audit

DORA expects the financial entity to understand and record the chain of subcontractors supporting a critical or important function, and to retain rights when that chain changes. If your feature calls a third-party foundation model, that provider is in the chain. You will be asked to name the entity, the processing region, the retention posture, and what happens if that provider deprecates the model. 'We use a leading AI provider' is not an answer that fits in a register field.

Model Deprecation Is a Resilience Event, Not a Product Update

Upstream providers retire model versions on their own schedule. From the customer's side that is an unannounced change to a component supporting a regulated function, with different outputs and different failure modes. Vendors who commit to a pinned version, a deprecation notice period, and a documented revalidation path are answering a question their competitors are still treating as a roadmap detail.

Audit Rights Have to Survive Two Hops

For critical or important functions, the customer and its regulator need meaningful access. You cannot grant access to infrastructure you do not own, so the workable answer is a layered one: your own audit rights and reports, plus the upstream provider's independent assurance artefacts, plus a contractual commitment to pass through information requests. Say this explicitly. Silence reads as a refusal.

The Exit Strategy Has to Address the Data You Generated

Exit planning assumes the customer can move to another provider or bring the function in-house without disruption. For AI features the awkward part is derived data — embeddings, fine-tuning artefacts, evaluation histories, prompt libraries the customer's staff wrote inside your product. Decide in advance what is exportable and in what format, because the first time you think about it should not be during a termination.

The Register Entry Is the Real Deadline

Financial entities keep a register of information covering every ICT contractual arrangement and report it to their supervisor. Your company sits in that register as a named counterparty, with the function you support, its criticality classification, the countries where processing happens, and the subcontractors behind you.

This changes the character of vendor diligence. A procurement questionnaire can be answered approximately and filed. A register entry cannot — it either has the field populated or it does not, and the person chasing you for it is being chased by their own compliance function against a reporting cycle. Vendors who can return a clean, structured answer inside a day become materially easier to buy than vendors who route the question to an account manager.

What to Prepare Before the Next Redline

Have This Written Down Already

☐Legal entity name, LEI if you have one, and country of incorporation
☐Every processing and storage location, by region and provider
☐Named subcontractors, including model and infrastructure providers
☐Quantitative availability and support-response commitments
☐Incident notification timelines and the channel you will use
☐Exit and data-export procedure with formats and timeframes

Decide Your Position on These

☐Whether you will pin model versions for regulated customers
☐Notice period before changing a subcontractor in the chain
☐Scope of audit and access rights you can actually grant
☐Whether incident assistance is genuinely at no extra cost
☐Which of your tiers can support critical-function commitments
☐Who signs off when a customer asks for a bespoke deviation

This Is a Commercial Advantage, Briefly

Right now most AI vendors selling into European financial services are answering these questions improvised, per-deal, by whoever picks up the thread. The requirements are public and finite, and the artefacts they need are a page of text each. A vendor who has them ready wins on cycle time against competitors with a better product and a worse answer — which is the kind of advantage that lasts until everyone else notices.

Frequently Asked Questions

Our EU customer says our tool is not a critical or important function. Are we done?

You still owe the baseline Article 30 terms, and the classification is the customer's to make and to revisit. Tools tend to drift upward in criticality as usage spreads — a reporting assistant that three analysts trialled becomes a dependency of a regulated process without anyone re-running the assessment. Ask to be told if the classification changes, and price the heavier commitments into a tier rather than granting them by accident.

Can we satisfy this with our SOC 2 report and a DPA?

They help and they are not sufficient. A SOC 2 report speaks to control design and operation; DORA's contract requirements are about specific rights and commitments that either appear in the agreement or do not — audit access, incident assistance at no cost, subcontracting conditions, exit assistance. A data processing addendum addresses personal data, not operational resilience. Expect to add a resilience addendum alongside both.

What if we refuse the unrestricted audit clause?

Then the customer cannot use you for a critical or important function, and the honest move is to say so early and scope the deal accordingly. Some vendors legitimately cannot grant physical inspection rights over infrastructure they rent. What loses deals is not the limitation itself but discovering it in month three of a negotiation, after the customer has already told its risk committee the vendor was compliant.

Does DORA overlap with the EU AI Act for our product?

They stack rather than substitute. DORA governs the operational resilience of the ICT service and the contractual relationship. The EU AI Act governs the AI system itself — its risk classification, documentation, transparency and oversight duties. A credit-decisioning feature sold to an EU bank plausibly sits inside both, and the financial regulator has separate expectations about model risk management on top. Map the three separately; the artefacts overlap more than the obligations do.

We are a small vendor. Will a bank actually enforce this on us?

The bank's supervisor enforces it on the bank, and the bank's only instrument against you is the contract. That instrument is decisive in practice: the register entry has to be completed, the clause list has to be present, and internal audit will eventually sample the arrangements. Small vendors do not get an exemption; they get less negotiating room, because the requirements are non-negotiable for the customer and the alternative is not using you.

The Answer Is a Document, Not a Meeting

Every question in this article resolves to a short written artefact: where you process, who is in your chain, what you commit to numerically, how a customer leaves. None of it requires a lawyer to draft the first version, and all of it is currently being reinvented per-deal by vendors who will answer it worse than you do.

Write it once. The next European financial prospect will ask for exactly this, and the speed of your answer is a signal they read as competence about everything else.

This article is general information about EU financial regulation, not legal advice. Classification of critical or important functions, contract terms, and supervisory expectations vary by entity and by national competent authority — confirm specifics with counsel before committing contractually.