Who is this relevant to?
DORA has applied since 17 January 2025 to financial entities within its scope. DNB explains the start of supervision. A supplier to a financial institution does not automatically have the same obligations as that institution.
The register concerns contractual arrangements for ICT services provided by third parties. It is not limited to the largest suppliers or critical contracts. DNB also describes technical and data quality checks and expects identified errors to be corrected. Read the data quality notice.
Make every contract change part of a process
Decide which source is authoritative for each field. Supplier identity may come from procurement, while a service owner is maintained elsewhere. Make those decisions explicit. The newest spreadsheet must not automatically become the source of truth.
Use recognisable references for entities, suppliers, contracts and services. Similar names do not prove that two records identify the same legal entity. Have uncertain matches checked before merging them.
- Detect a change. A new contract, renewal, changed service or notified subcontractor creates a review task.
- Collect supported facts. Record where each value came from and which contract version supports it.
- Check consistency. Flag missing references, invalid values and conflicting dates.
- Obtain owner review. Present a proposed change instead of silently overwriting the register.
- Create an agreed snapshot. Preserve which data and validation rules supported a submission.
What can software check?
On a narrow screen, scroll the table sideways. With a keyboard, focus the table and use the arrow keys.
| Check | Example | What it does not prove |
|---|---|---|
| Completeness | A required reference is missing. | That every relevant contract has been identified. |
| Consistency | A service points to an unknown supplier. | That the supplier is the correct legal entity. |
| Changes | A replacement agreement differs from the previous version. | That the change is acceptable. |
| Format | An export passes configured technical rules. | That a supervisor has approved its substance. |
Use the current specifications of the relevant supervisor. DNB explains templates and conversion to the xBRL-CSV reporting format. Changes to a standard workbook can break that conversion. Do not assume a custom spreadsheet is directly usable. Check the DORA FAQ and reporting instructions.
Fictional example: a renewal adds a service
A fictional financial institution renews an agreement. Procurement registers the renewal, but the supplier now also provides an additional service. An integration detects the changed document and assigns a task to the contract owner, who confirms which fields change and what information is still missing.
The earlier snapshot remains available under agreed retention requirements. The new service is not marked as fully reviewed while evidence is missing. The result is a visible queue of work rather than a silently ‘complete’ register.
Submission, validation and acceptance are separate
Keep distinct statuses for prepared, substantively reviewed, submitted and feedback received. Store the submission reference and relevant validation results with the correct snapshot. A successful transfer does not prove that the content is correct. If receipt is uncertain, the responsible person checks the status before resubmitting.
Give staff access only to the contract data they need. AI might propose fields but must not invent missing contract terms. Fictional agreements and existing import functions may be sufficient for an initial trial.
A register does not replace risk management
Zeliha Keskin of PwC discusses why supplier dependencies and management decisions extend beyond documentation. The boundary applies here too: an organised register exposes risks but does not negotiate contracts or test recovery arrangements.
Frequently asked questions
Must we buy a new platform?
Not necessarily. Investigate existing contract management, exports and approval functions. Add an integration only where repeated manual work or errors justify it.
Can submission be automated?
That is not the starting assumption. First establish a supported submission method, authority and final review. A prepared file is not a submitted report.
How do we assess the result?
Measure collection effort, unexplained discrepancies and correction rounds. Include maintenance and substantive review in the total effort. A business case separates capacity from avoided expenditure.
Discuss a concrete process?
Want to explore simpler ways to collect, check or transfer information? Describe one process and the systems you already use. A new tool is not always necessary. Introductory conversations are free and without obligation. Further advice and implementation are agreed separately through Korper, including scope and costs.