If you sell software or cloud services to EU banks, insurers or investment firms, DORA probably affects you even though it regulates them, not you. It has applied since 17 January 2025, and it pushes duties down to ICT providers through contract terms, audits and incident cooperation. Decide early how much of that you will accept.
Who does DORA actually regulate?
The Digital Operational Resilience Act is an EU regulation for the financial sector. The European Insurance and Occupational Pensions Authority describes it as covering 20 types of financial entities and also ICT third-party service providers. It entered into application on 17 January 2025.
The text groups its rules into ICT risk management, ICT third-party risk management, resilience testing and incident reporting. As a startup you mostly meet the third-party pillar, because your customer must manage you as a risk.
How does it reach a vendor that is not a bank?
Through paper. A financial entity has to keep a register of information on all its contractual arrangements with ICT third-party providers, and supervisors can ask for it. The regulation also lists key contractual provisions that those contracts must carry. Expect your customer to send an addendum that was not in your standard terms.
Some providers can be designated as critical by the European supervisory authorities and then face direct oversight. That is unlikely for an early stage company, but you should know the category exists.
What will a customer ask you for?
Constructed example: a seed stage company sells a document workflow tool to a mid-sized EU insurer. In the security review the insurer asks for six things.
- A description of which of your subcontractors process their data.
- Your incident notification commitment and who to call.
- Audit and access rights, including how they can examine you.
- Your exit plan if they leave or you shut down.
- Evidence that you test your own resilience.
- A list of the locations where data is processed and stored.
None of these is exotic. What hurts is answering them for the first time under deal pressure.
What should a founder decide now?
Three decisions are worth making before the first financial customer asks.
First, decide whether the financial sector is a market you want. The paper load is real, and it scales with each customer who has slightly different wording.
Second, decide your standard position. A prepared addendum that grants reasonable audit rights, names a notification window you can meet and describes an exit path will close faster than negotiating clause by clause.
Third, decide who owns it. A founder usually does this alone at the start, and that is fine, but it should be written down.
What does DORA not do?
It does not certify vendors. There is no DORA badge you can buy. It also does not give you a single technical checklist. The regulation sets duties for the financial entity, and technical standards fill in details such as incident reporting content and timelines. Check the current technical standards with your customer's compliance team before you promise a number of hours.
What to do
- Map your subcontractors and the data each one touches.
- Write a one page incident notification procedure and test it once.
- Draft an exit plan: data export format, retention, and a handover period.
- Prepare a standard DORA addendum with your lawyer rather than accepting each customer's version.
- Keep an inventory of your software dependencies so you can answer supply chain questions quickly. Safeguard can generate SBOMs and scan dependencies, and the free scan at gold.safeguard.sh/scan covers up to 100 dependencies.
- Ask each customer which technical standards they are applying, in writing.
Quick check
Does DORA apply to my startup directly?
Only if you are a financial entity or are designated as a critical ICT third-party provider. Otherwise it applies to you through your customers' contracts.
Is there a DORA certification I can get?
No. DORA places duties on financial entities and designated critical providers. Customers will ask for evidence, but no official DORA certificate exists for vendors.
Sources
Last reviewed: 18 October 2026.
