Skip to main content
Audact
See the offer

In force · 17 January 2025

DORA: what a financial client has to be able to say about its suppliers.

In force since 17 January 2025

Last reviewed: 6 October 2026

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025 to banks, insurers, payment and e-money institutions, investment firms, crypto-asset service providers and the other financial entities listed in Article 2. Almost every duty it creates sits on the financial entity, not on its suppliers. If you run AI conversations for a financial client, DORA reaches you through their contract, their register and their incident reporting.

What the law requires

DORA applies to the financial entities listed in Article 2 and, through them, to the ICT third-party service providers they use.
Regulation (EU) 2022/2554, Art. 2; applicable since 17 January 2025 (Art. 64)
A financial entity keeps a register of information on all contractual arrangements for the use of ICT services, at entity, sub-consolidated and consolidated level.
Regulation (EU) 2022/2554, Art. 28(3)
Contracts for ICT services must contain a fixed set of provisions, including service level descriptions, assistance at no additional cost on an ICT incident, audit and access rights, and exit strategies.
Regulation (EU) 2022/2554, Art. 30
Major ICT-related incidents must be classified and reported to the competent authority within the deadlines set by the regulatory technical standards.
Regulation (EU) 2022/2554, Art. 18 and Art. 19
Designation as a critical ICT third-party provider is made by the European Supervisory Authorities and brings direct oversight; every other supplier is governed through the financial entity's own contract.
Regulation (EU) 2022/2554, Art. 31
For a designated critical provider, the Lead Overseer can impose periodic penalty payments of 1% of the average daily worldwide turnover.
Regulation (EU) 2022/2554, Art. 35(8)

What Audact supplies into that

A receipt is visible in the product for governed calls: the input hash, the output hash, the link to the receipt before it, and Merkle inclusion, so a change or reordering after the fact is detectable. The first three recompute without a key; the fourth, inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report.
Visible in product · Merkle roots published
The Article 50 disclosure spoken in the flow and recorded per interaction.
In controlled testing
Primary application hosting: Frankfurt. The full subprocessor list and the transfer basis are in the Trust Center.
Working today
Incident records with timestamps and the call context they belong to, exportable into your client's incident report.
In development

Whose duty

DORA is written at your client, and reaches you through their contract.

This is the distinction that decides how much of DORA is your problem. The register of information, the incident classification and the reporting deadlines are duties of the financial entity. What Article 30 does is push a fixed list of provisions into the contract that entity signs with you: service levels, assistance during an ICT incident, audit and access rights, exit strategies, and the locations where data is processed.

The practical consequence is that a supplier is rarely asked to comply with DORA. A supplier is asked whether its contract can carry Article 30, and whether it can hand over evidence quickly enough for the entity to meet Article 19. Those are answerable questions, and the answer is a better one when the record was made during the call rather than reconstructed after the questionnaire arrived.

The critical designation

Critical ICT third-party provider is a status, not a description.

The phrase appears in every DORA conversation and is often used loosely. Under Article 31 it is a formal designation made by the European Supervisory Authorities, on criteria including systemic impact and substitutability, and it brings a Lead Overseer and the enforcement powers in Article 35 with it. It covers a short list of very large providers.

Every other supplier is an ordinary ICT third-party service provider. Its obligations are contractual: what Article 30 requires the financial entity to put in the agreement, and what the entity needs back from you to satisfy its own reporting.

Note

Information, not legal advice.

This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.

Questions

Does DORA apply to my agency?
Not directly, unless your agency is itself a financial entity listed in Article 2. It reaches you through the contract with a financial client: Article 30 requires that agreement to carry a fixed set of provisions, and the client needs evidence from you to meet its own register and reporting duties.
Who decides that a provider is critical under DORA?
The European Supervisory Authorities, under Article 31, on criteria including systemic impact and how substitutable the provider is. A designated provider gets a Lead Overseer and falls under the oversight powers in Articles 33 to 35.
Does DORA replace the AI Act for a financial client?
No. They govern different things: DORA governs operational resilience and ICT third-party risk, Article 50 of the AI Act governs telling a person they are speaking to an AI. A financial client running AI conversations sits under both.

The record is made while the call runs

What a financial entity needs from a supplier is a record of what actually happened. Audact makes that during the call and shows it in the product. Production export worked when it was retested on 26 August 2026 after the deploy, measured on browser calls rather than over a telephone line. The monthly evidence package is not in the offer; it is Under validation.

See a receipt

Related