DORA and your ICT suppliers: what Irish banks, insurers and funds need from them

01DORA as of autumn 2026

Since 17 January 2025 every bank, insurer, fund manager and payment firm in Ireland has worked under the Digital Operational Resilience Act (opens external site), Regulation (EU) 2022/2554. No Irish Act was needed to bring it in: an EU regulation binds directly, and the Member State’s part is mostly to name supervisors and fix penalties. The practical rules come from a set of Commission standards. They cover the ICT risk framework, how incidents are classified and reported, the register of information, contract policies, subcontracting and threat-led testing.

DORA is also the sector-specific act that displaces the NIS2 rules on ICT risk, incident reporting and supervision for the financial sector. In Ireland, where the National Cyber Security Bill has not yet been enacted, that gives regulated firms one settled text to work to while other sectors wait for the Act. One milestone since then: in November 2025 the EBA, EIOPA and ESMA named (opens external site) the first providers they oversee directly as critical. In what follows we shorten critical or important functions to CIFs, the term the regulation uses for the activities a firm cannot do without.

02Who is covered: financial entities and their ICT suppliers

Twenty categories of financial entity are listed. For Ireland that means, among others, credit institutions, payment and e-money firms, investment firms, UCITS management companies and AIFMs, insurers, insurance brokers, occupational pension schemes, trading venues, crypto-asset service providers, rating agencies and crowdfunding platforms. The rules scale: Article 4 ties them to size, risk profile and complexity, and Article 16 offers a lighter framework to some smaller firms.

On the supplier side the net is wide. Anyone delivering digital or data services through ICT systems to internal or external users, on an ongoing basis, counts as an ICT third-party service provider. Hosting, managed services, SaaS, application support and data services almost always do, and so does the firm that maintains a fund administrator’s transfer agency platform. DORA does not supervise those suppliers unless they are designated critical. Their customers, though, carry every relevant duty into the contract.

03ICT risk sits with the board

Responsibility for ICT risk ends with the management body (Article 5). The board signs off the risk framework and keeps it under review, chooses the resilience strategy and the level of risk it will tolerate, approves continuity policy and recovery plans, and owns the policy on buying ICT services from third parties. Directors are expected to keep their own knowledge current through regular training.

04Major incidents: 4 hours, 72 hours, one month

Classification follows Article 18 and the detailed criteria of Delegated Regulation (EU) 2024/1772 (opens external site). The questions are how many clients and transactions were hit, for how long, across which countries, what data was lost, how important the services are and what it costs. An incident that crosses the major threshold is reported in three stages, with deadlines from Delegated Regulation (EU) 2025/301 (opens external site):

Clients whose financial interests are hit must be told without undue delay. An entity may hand the reporting itself to a third party but keeps full responsibility for it (Article 19(5)).

This lands on suppliers directly. Article 30(2)(f) makes every ICT provider commit to help with incidents linked to its service, free or at a price fixed up front. Four hours is short: a fund administrator can only meet it if its supplier already has alerting, usable logs and a named contact at two in the morning.

05Testing, up to threat-led penetration tests

Article 24 asks for a programme of risk-based tests, carried out by independent testers inside or outside the firm, with each system that supports a CIF tested at least once a year. Firms that their supervisor selects must also run threat-led penetration tests against live production every three years at least, following Delegated Regulation (EU) 2025/1190 (opens external site) and the TIBER-EU approach.

If a supplier’s services fall within a TLPT, the entity must make sure the supplier participates (Article 26(3)), and contracts for critical or important functions must say so (Article 30(3)(d)). Where taking part could harm the supplier’s other clients, DORA permits pooled testing: the supplier engages an external tester directly for several financial entities at once (Article 26(4)).

06Third-party risk: strategy, register, exit

Article 28 folds ICT third-party risk into the risk-management framework and leaves the entity fully responsible for compliance, whatever it outsources. The core duties:

• A third-party risk strategy, with a policy on ICT services behind critical or important functions, reviewed regularly by the board.
• A register of information on every ICT arrangement, at solo and group level, marking those that support CIFs, in the templates of Implementing Regulation (EU) 2024/2956 (opens external site). It goes to the supervisor at least once a year, and in full whenever asked.
• Checks before signing: does the service support a CIF, what risks come with it (concentration among them), is the supplier fit for the job, are there conflicts of interest. Suppliers must follow suitable information security standards; for CIFs, the most current and strongest ones.
• Termination rights, for instance after a significant breach by the supplier, proven weaknesses in its ICT risk management, or circumstances that block effective supervision.
• Exit strategies for services behind critical or important functions, written down and tested, so the entity can leave without disrupting its business, weakening its compliance or harming its clients.

Mandatory contract content

Article 30 sets the minimum. Each ICT contract must be written, in a single document that includes the service levels, and must cover at least:

• a full description of the functions and services, and whether subcontracting is permitted and on what terms;
• where services are delivered and data processed and stored, with prior notice of any change;
• availability, authenticity, integrity and confidentiality of data, personal data included;
• getting data back, recovered and in an accessible format if the supplier becomes insolvent, stops the service or the contract ends;
• descriptions of the service levels;
• help during ICT incidents linked to the service, free of charge or at a cost agreed beforehand;
• full cooperation with the competent and resolution authorities;
• termination rights and minimum notice periods;
• taking part in the firm’s security awareness and resilience training.

Contracts behind CIFs go further under Article 30(3): measurable service targets, duties to notify and report, contingency plans that the supplier runs and tests, a role in TLPT, full rights of access, inspection and audit for the firm and its supervisor, and an exit strategy with a compulsory transition period. When such a service is subcontracted, Delegated Regulation (EU) 2025/532 (opens external site) sets what the firm must assess.

07Critical ICT third-party providers

Under Article 31 the three European authorities can declare an ICT provider critical for the financial system, weighing how much disruption its failure would cause, how important its customers are, how many CIFs depend on it and how easily it could be swapped out. A critical provider is assigned one of the three as Lead Overseer, which may demand information, investigate, inspect and make recommendations.

That first list (opens external site) from November 2025 contains 19 names: cloud and data centre operators, telecoms carriers, IT service firms, market data vendors and enterprise software houses. None of this relieves an Irish bank or insurer of anything. Each designated provider still needs its line in the register, compliant contract terms and an exit strategy.

08What an ICT supplier should have ready

Few suppliers to Irish financial entities will ever be designated critical, yet all of them meet DORA through contracts, due diligence and audits. A supplier with the following ready shortens procurement and eases its customer’s dealings with the supervisor:

• Register data. Everything the customer’s register of information needs: legal entity and identifiers, services delivered and the functions they support, locations, and the subcontractors in the chain.
• Contract terms aligned with Article 30. Preferably a standard DORA addendum covering both lists, so clauses are not negotiated one by one.
• Incident support. Alerting and timestamped logs, plus a notification routine fast enough for the customer to classify and report inside its window.
• Continuity that has been tested. Contingency plans and restore tests, with dates and outcomes.
• Security you can demonstrate. Information security standards, access control, secure development and vulnerability handling, independently evidenced where possible.
• Readiness for audits and tests. A workable way to host audits and inspections and to join a TLPT, pooled testing included where it fits.
• An exit plan. Data returned in usable formats, documentation and transition support for an agreed period.

We work this way as a supplier to banks, insurers and fund managers: the DORA clauses agreed in the contract, incidents reported through the channel we set together, exit plans on paper, participation in resilience tests and the data your register needs, with data hosted in the EU. The trust and compliance page describes our approach, ISO/IEC 27001 certification of our information security management system included.

09An illustrative case: an Irish fund administrator

Picture a fund administrator serving Irish-domiciled funds, with its transfer agency platform hosted and maintained by an outside software firm (an illustrative example, not a client). For the administrator, that platform supports a CIF. Its register entry names the supplier, the hosting locations in the EU and the two subcontractors behind it. The contract carries the Article 30(3) clauses, including the right for the administrator and its supervisor to audit. Every quarter the supplier restores a full backup into a clean environment and sends the result. An alert at the supplier reaches the administrator’s incident lead within the hour, so the four-hour clock is not spent waiting for an email. And the exit plan names a second platform, a data export format both sides have tested, and six months of transition support. None of this is exotic; most of it is ordinary engineering, written down and rehearsed.

10Steps for both sides

1. 01Finish the register. Tie each ICT contract to the functions it supports and flag the critical or important ones.
2. 02Close contract gaps. Check every contract against Article 30 and agree an addendum where terms are missing.
3. 03Align incident handling. Agree classification inputs, contacts and notification times with each critical supplier, then test them.
4. 04Plan tests with suppliers. Bring them into the test programme and, where relevant, into scoping a TLPT.
5. 05Write and test exits. For each critical or important function: alternatives, data return and transition period.
6. 06Watch concentration. Several critical functions resting on one provider is a risk to document and manage (Article 29).

11Which authority supervises you

The text reads the same in every Member State, yet day-to-day supervision is national for most firms, with the ECB directly supervising significant banks. In Ireland, the Central Bank of Ireland supervises the financial entities it regulates under DORA, and they report major ICT-related incidents to it. National arrangements decide the format and channel for the register and for incident reports, and which authority runs TLPT. Check with your own supervisor what applies to your firm. One related Irish point: firms using AI in regulated activities should know that S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, names the Central Bank of Ireland among the sector authorities for the AI Act.

12Points to follow

• Your supervisor’s priorities and findings on the register of information and incident reporting.
• The Lead Overseers’ work on critical ICT third-party providers, and recommendations touching services you rely on.
• The Digital Omnibus proposal (opens external site) of the Commission, COM(2025) 837, under which DORA major incident reports would pass through one ENISA-run entry point. As of October 2026 the Parliament had not finished with it, so the present channels and deadlines remain in force.

For Irish firms outside financial services, similar supplier duties will follow from NIS2 once the Oireachtas passes the Bill; see NIS2 in Ireland and your suppliers. The ESAs keep the standards and the oversight framework together on their DORA pages (opens external site).