DORA · apply · about 10 minutes

The cloud contract that predates the regulation

A mid-sized insurer runs its policy administration — unambiguously a critical function — on a SaaS platform. The contract was signed in 2021: no audit rights, no named data-processing locations, a 90-day termination-for-convenience clause and nothing else. The provider's account manager says their standard terms are non-negotiable and points out that forty other insurers are on the same platform. The insurer's COO asks you for a one-page position before the board meeting.

Write the page. Say what is non-compliant, what the realistic routes are, and what you would tell the board it is actually exposed to.

Write your answer somewhere else — on paper, in a mail draft, out loud to someone. Then come back and mark it against the rubric. The rubric is disputable: if you think a line is wrong for your situation, you are probably right, and noticing that is worth more than the tick.

Mark it against the rubric

Names the missing Article 30 clauses — audit rights and data locations are required, not negotiable Clauses the contract has to contain
Separates the termination clause from an exit strategy, and says why 90 days' notice is not one You have to be able to leave
Puts the contract in the register of information, flagged as supporting a critical function The register of information
Reads "forty other insurers" as concentration — the thing that gets a provider designated The EU supervises your cloud provider directly
Takes it to the management body: this is their final responsibility and their budget decision Ultimate responsibility has a name
Does not propose simply accepting the risk, and does not propose migrating by Friday Proportionate, not optional

Read against Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2), Commission Delegated Regulation (EU) 2025/301 — RTS on major ICT-related incident reporting on 2026-10-16. Regulations and frameworks change; the date is there so you can tell whether this has kept up.