Outil gratuit

Outil d'analyse d'écarts des clauses DORA Article 30

Vérifiez chaque contrat de tiers ICT par rapport à DORA Article 30 — les dispositions obligatoires du socle 30(2) et les clauses renforcées 30(3) pour les fonctions critiques ou importantes — et exportez un rapport de couverture noté avec les écarts à corriger.

Vous gouvernez des fournisseurs d'IA sous DORA ? Lisez gouverner les agents AML et de paiement.

Clause coverage: 0%

Assessed 0/18 · 0 gaps

Baseline provisions — every ICT third-party contract (Article 30(2))

These clauses are mandatory in all ICT third-party arrangements, regardless of criticality.

Clear, complete description of all functions and ICT services, including subcontracting conditions

DORA Art 30(2)(a)

Locations (regions/countries) where services are provided and data is processed, with change notification

DORA Art 30(2)(b)

Provisions on availability, authenticity, integrity and confidentiality of data

DORA Art 30(2)(c)

Access, recovery and return of data on insolvency, resolution or termination

DORA Art 30(2)(d)

Service level descriptions, including updates and revisions

DORA Art 30(2)(e)

Provider assistance on ICT incidents at no additional or agreed cost

DORA Art 30(2)(f)

Obligation to fully cooperate with competent and resolution authorities

DORA Art 30(2)(g)

Termination rights and minimum notice periods

DORA Art 30(2)(h)

Conditions for participation in ICT security awareness programmes and training

DORA Art 30(2)(i)

Augmented provisions — critical or important functions (Article 30(3))

Where the arrangement supports a critical or important function, the contract must additionally contain these.

Full service level descriptions with precise quantitative and qualitative performance targets

DORA Art 30(3)(a)

Notice periods and provider reporting obligations, including developments that materially impact

DORA Art 30(3)(b)

Requirement to implement and test business contingency plans and ICT security measures

DORA Art 30(3)(c)

Participation and full cooperation in the financial entity’s threat-led penetration testing (TLPT)

DORA Art 30(3)(d)

Unrestricted rights of access, inspection and audit (entity, appointee, competent authority)

DORA Art 30(3)(e)

Exit strategies with mandatory adequate transition periods

DORA Art 30(3)(f)

Register and AI-vendor linkage

Arrangement recorded in the Register of Information

DORA Art 28(3)

Critical-or-important determination documented per ICT service

DORA Art 28

GenAI / LLM providers assessed and contracted as ICT third parties

Cloud-hosted model providers (e.g. OpenAI, Anthropic, Azure OpenAI) are ICT third parties; AML, fraud and chatbot use cases can be critical or important functions.

DORA Art 3(19)-(22)

Prioritised gaps

18 item(s) to address

Clear, complete description of all functions and ICT services, including subcontracting conditions — Not assessed
Locations (regions/countries) where services are provided and data is processed, with change notification — Not assessed
Provisions on availability, authenticity, integrity and confidentiality of data — Not assessed
Access, recovery and return of data on insolvency, resolution or termination — Not assessed
Service level descriptions, including updates and revisions — Not assessed
Provider assistance on ICT incidents at no additional or agreed cost — Not assessed
Obligation to fully cooperate with competent and resolution authorities — Not assessed
Termination rights and minimum notice periods — Not assessed
Conditions for participation in ICT security awareness programmes and training — Not assessed
Full service level descriptions with precise quantitative and qualitative performance targets — Not assessed
Notice periods and provider reporting obligations, including developments that materially impact — Not assessed
Requirement to implement and test business contingency plans and ICT security measures — Not assessed
+ 6 more in the export.

Export your scored assessment and prioritised gap list. Everything stays in your browser — nothing is uploaded.

Aucune période de grâce

DORA s'applique depuis le 17 janvier 2025 sans période transitoire pour l'article 30 — les contrats ICT antérieurs à 2025 dépourvus de ces clauses sont non conformes dès aujourd'hui.

Socle et renforcement

Sépare les clauses 30(2) dont tout contrat a besoin des clauses 30(3) requises lorsque l'arrangement soutient une fonction critique ou importante.

Votre fournisseur d'IA est un tiers ICT

Les fournisseurs de modèles hébergés dans le cloud sont des tiers ICT au sens de DORA ; les cas d'usage AML, de fraude et de chatbot peuvent constituer des fonctions critiques ou importantes qui déclenchent les clauses renforcées.

Avertissement : Cet outil vous aide à vérifier les contrats de tiers ICT par rapport à DORA Article 30. Il ne constitue pas un conseil juridique. Confirmez vos obligations contractuelles auprès d'un conseil qualifié connaissant vos arrangements.