How to Audit DORA Article 30 Clauses in an ICT Services Contract

On one ICT arrangement, name the column before you mark a letter. Article 30(2)(a) to (i) of Regulation (EU) 2022/2554 is the baseline on every ICT contract. Article 30(3)(a) to (f) applies only where that service supports a critical or important function. Mark each letter present, partial, or absent. A SOC 2 report, or a signature from before 17 January 2025, does not mark a letter.

Write the choice on the draft before any row: baseline letters only, or baseline plus the extra letters. A critical or important function needs both columns: fifteen lettered items, not a sixteenth baseline point. A report pack, a short termination, and a claimed grace period are rows you mark once the columns are named.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Is this an ICT service for an in-scope entity, and is the function critical?

Stop if either answer is no. The Commission’s Article 3(21) answer treats ICT services as ongoing digital and data services through ICT systems. The financial entity makes that assessment. A regulated financial service from a regulated financial entity is not an ICT service when both tests are met. Only the Court of Justice interprets Union law.

Article 2 sets entity scope. The Central Bank of Ireland FAQ, updated 12 February 2026, says a national-only authorisation can fall outside, so a UK firm outside that list does not complete this log. Article 28(4)(a) is the critical-or-important test before you open the longer list. Write yes or no from that test, not from the fee.

Which baseline letters do you mark on every ICT arrangement?

Article 30(1) is one written document the parties can keep, with service levels inside it. Then mark Article 30(2)(a) to (i) on every ICT arrangement, critical or not.

On this renewal, “hosting and related services” with subcontracting “in our discretion” is partial on (a). “EU or other locations” is partial on (b). Then-current rates are partial on (f). A 30-day convenience termination marks (h): the notice, not the exit.

Also mark (c) data integrity, (d) return, (e) service-level descriptions, (g) authority cooperation, and (i) training under Article 13(6). “99.9% commercially reasonable efforts” is not a 30(3)(a) target. A residency pin that omits subcontracted locations is a data-residency review. A processor breach clock in a data processing agreement (DPA — the contract that sets how a processor handles personal data) is a breach-notification review.

When do you mark the extra letters, and when is the row “not this contract”?

Mark Article 30(3)(a) to (f) only for a critical or important function. Otherwise write “not this contract” on those six rows. The baseline still applies. Count fifteen lettered items, not a sixteenth baseline letter, and leave the audit right in Article 30(3)(e), not in Article 30(2).

Those extra letters cover precise targets, notice if levels may be missed, tested contingency plans, and cooperation in threat-led penetration testing under Articles 26 and 27. Only a small subset of firms must run advanced testing. A recovery-time pair is a separate recovery review.

Who agreed the audit cap, and can you still audit ad hoc?

On a critical or important function, Article 30(3)(e)(i) requires unrestricted access, inspection, and audit by the entity, an appointee, and the competent authority. Other clauses must not impede it. A non-critical arrangement still needs Article 30(2)(g). It does not need this access right.

ESMA Q&A 2646 of 18 September 2025 allows a cap only if the entity agreed it and can still audit ad hoc, for example if performance is in doubt. A yearly SOC 2 with no on-site access is a cap the provider set, so mark 30(3)(e) absent. Typical mistake: treating the report as the audit right. 30(3)(e)(ii) applies only if other clients’ rights are affected. See the customer-audit review. A SOC 2 report used as the control set is a security-addendum checklist.

Why are notice, continued service, and your own exit plan three rows?

A 30-day convenience termination is Article 30(2)(h), a minimum notice, not an exit strategy. Article 30(3)(f) requires a mandatory adequate transition while the provider keeps providing the service, long enough to migrate or bring it in-house. The Regulation states no number of months. Do not invent one.

Article 28(7) also requires termination for breach, a change that can alter performance, weaknesses in the data, and a loss of effective supervision. Article 28(8) is the entity’s own tested exit plan. A 30-day notice and a proprietary export leave the transition row absent.

When must the contract name the subcontractor’s data location?

Subcontracting permission is a baseline mark. Article 30(2)(a) must say whether critical subcontracting is permitted, and on what conditions. If it is forbidden, say so. “In our discretion” is partial. Mark the extra chain only when the answer is yes.

Commission Delegated Regulation (EU) 2025/532 of 2 July 2025 supplements Article 30(5). Article 4 names the services, the data location, and flow-down audit rights. Article 5 is the objection notice, and Article 6 is the right to terminate if the provider proceeds anyway. If subcontracting is forbidden, write “not this contract”.

Who owns each partial or absent row before signature?

Name an owner on every partial or absent row before signature, including a master services agreement (MSA — the framework contract an order form is issued under) signed before the application date. Article 64 applies from 17 January 2025. It sets no grandfathering rule. The 4 December 2024 statement says there is no transitional period.

“Grandfathered until 2027” is not a row status. Article 4(2) of Delegated Regulation (EU) 2025/532 is a documented timeline, not a pause until 2027.

Stop when the log shows ICT yes or no, critical or important yes or no, each baseline letter, each extra letter or “not this contract”, and an owner on every gap. If a gap has no owner, do not countersign. Hand the log to counsel — a qualified lawyer, not the chatbot. A first-pass — a machine pass that flags clauses before a person reads every page — is not that decision.