--- title: "Decide whether DORA reaches you through ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/dora-ict-provider id: CMP-75 level: Recommended applies: eu-users region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 948 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Decide whether DORA reaches you through financial customers For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-75 - Level: Recommended - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: When you sell software or IT services to EU banks, insurers, payment firms or investment firms, record whether DORA applies to them. Keep a contract annex that covers each item in its Article 30. - Check: The facts file marks each customer that is an EU financial entity. For each, the obligations register holds a signed DORA annex with a row for every point of Article 30(2), or the check fails. - Applies when: The project has users in the EU. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It binds the financial entity, but every ICT service it buys falls under its Article 28 and 30. The written contract must list the services, the countries where data is processed and the service levels. It must also cover help during incidents, access for supervisors, exit and data return. Services that support a critical or important function need more, such as testing and an exit plan. Keep the annex next to your agreements, in the same register as [Keep one register of vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register.md). Customers also ask for the facts for their register of information, as [Give financial customers the facts for their DORA register](https://agentwranglers.se/playbook/compliance/security-laws/dora-register-facts.md) says. The European Supervisory Authorities designate critical ICT third-party providers under Article 31, and those face direct oversight. Map your incident reports to the customer's clock in [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md). ## Sources - [Regulation (EU) 2022/2554 (DORA), Articles 28, 30 and 31](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) ## Related rules - CMP-21 [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) in Compliance and governance - CMP-13 [Keep one register of vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register.md) in Compliance and governance - CMP-85 [Give financial customers the facts for their DORA register](https://agentwranglers.se/playbook/compliance/security-laws/dora-register-facts.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Register with MCF when the Swedish cybersecurity law covers you](https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration.md) - Next: [Give financial customers the facts for their DORA register](https://agentwranglers.se/playbook/compliance/security-laws/dora-register-facts.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)