DORA, the EU Digital Operational Resilience Act, applies directly to financial entities, not to software vendors. But it has applied since 17 January 2025, and it forces your bank and insurer customers to put specific terms in contracts with you. Preparing means knowing those terms and being able to evidence them.
Does DORA apply to a software company?
Indirectly, yes. The regulation defines ICT third-party service providers broadly. Its recitals say the scope covers providers of cloud computing, software, data analytics and data centre services. Your customer carries the legal duty, and passes requirements to you through the contract and through due diligence.
A small number of providers can be designated as critical by the European Supervisory Authorities under Article 31, which brings direct oversight. Whether a vendor falls there is the authorities' decision, so do not assume either way.
What must the contract contain?
Article 30 lists the minimum. For any ICT service, the written contract has to cover, among other things:
- a clear description of the services, and whether and how subcontracting is allowed
- the regions or countries where services run and data is processed and stored, with advance notice of changes
- availability, authenticity, integrity and confidentiality of data
- access, recovery and return of data if you become insolvent or the contract ends
- service level descriptions
- assistance during an ICT incident at no extra cost, or at a cost fixed in advance
- cooperation with the customer's supervisors
- termination rights and minimum notice periods
For services supporting a critical or important function, Article 30 adds more: precise quantitative service targets, notice of developments that could affect delivery, business contingency plans that you test, participation in the customer's threat-led penetration testing, and audit and access rights for the customer and its authority.
Step by step
- Build a services map. List each product, the functions a bank could use it for, and which could be called critical or important. The customer decides, but your map speeds the conversation.
- Write down data locations and subprocessors. Article 30 asks for locations and the subcontracting conditions, so you need a current list and a notice process.
- Prepare a DORA addendum. Draft standard wording for the Article 30 items so each deal does not start from zero.
- Define exit support. Customers must have exit strategies for critical services under Article 28. Document data export formats and the transition period you can offer.
- Set incident assistance terms. Decide how fast you notify customers and what help is included.
- Prepare for audit rights. Decide what evidence you share, and how you handle on-site access without exposing other customers.
- Support the register of information. Customers must keep a register of contractual arrangements for ICT services, so give them the facts they need in a consistent format.
- Plan for resilience testing. Know how you would take part if a customer asks you to join a threat-led penetration test.
What about the software supply chain itself?
Your own dependencies are your subcontracting chain in practice. A current SBOM, dependency scanning and a record of how you respond to vulnerabilities make several of the answers above easier to give. Safeguard's CLI and platform generate SBOMs and scan dependencies, and its compliance automation can organise evidence, but DORA readiness remains a legal judgment for you and your customers.
Counsel should review contract language. This post explains the regulation text and does not give legal advice.
What should you not promise?
Do not promise outcomes that depend on the customer's own choices, such as classification of a function as critical. Do not offer unlimited audit access without limits that protect other customers. And do not describe yourself as DORA compliant, because the regulation places duties on financial entities. Describe instead which contract terms you support and what evidence you can provide.
Quick check
When did DORA start to apply?
Article 64 says it applies from 17 January 2025.
Does DORA make software vendors certify anything?
The regulation text does not create a vendor certificate. It sets contract and oversight requirements for financial entities and for designated critical providers.
Sources
Last reviewed: 18 October 2026.
