OperationalResilience.help
The Continuity Desk - important services, kept running
Home / Line 12 - Register of information / Guide

Register Contractual Arrangements

Contractual arrangements in the DORA register turn provider relationships into checkable facts: the agreement, its parties, its scope, and the terms that shape continuity and exit.

Published 26 October 2026Checked against the regulation text on 26 October 2026European Union (financial entities in scope of DORA)

The short answer

The contractual part of the register records the agreement behind each ICT arrangement. It identifies the parties, the service covered, and the terms that matter for continuity, such as duration, the conditions for change, and the arrangements for ending the relationship. The purpose is not to reproduce the contract in the register. It is to give a reader enough contractual fact to understand the arrangement without opening the full agreement, and to know exactly which agreement to open when a question arises. A register entry that names a provider but not the governing agreement leaves the most practical question unanswered: on what terms is this service actually supplied.

Contractual accuracy matters because contracts are where many register entries go stale. Services evolve informally, side letters amend scope, and renewals roll forward with changed terms, while the register keeps quoting the original deal. This guide explains which contractual facts deserve recording, how to handle amendments and renewals, and how to keep the register aligned with the agreements that a firm would actually rely on in a dispute or an exit.

Why does the agreement anchor the entry?

An arrangement without an identified agreement is hard to govern. Staff may know a provider delivers a service, but without a contract reference they cannot say what level of service was promised, what happens on failure, how data is handled, or how the relationship can be ended. The register solves that by anchoring each arrangement to its agreement. That anchor also helps during incidents, when speed matters and nobody should have to search shared drives for the relevant contract. A clear reference, held in the register, points the incident team to the right document at once.

Which contractual terms deserve recording?

The terms that deserve recording are those that change what happens when things go wrong or when the relationship ends. Duration and renewal mechanics matter, because they set the window for exit planning. Scope matters, because a service that has grown beyond its original description may no longer be fully covered. Subcontracting arrangements matter, because the firm that delivers a service may not be the firm that signed the contract. Data handling, security expectations, audit and access rights, and termination provisions all shape the practical options available to the entity, and each should be reflected in a way a reader can grasp without legal training.

Recording these terms does not mean the register becomes a legal summary. The register owner should work with the team that owns the contract, and should record what that team confirms, rather than paraphrasing complex provisions from a quick read. Where a term is genuinely unclear, the register should say so, or point to the clause that needs legal review, rather than presenting a confident summary that later proves wrong. Honest gaps are easier to fix than confident errors, and supervisors tend to trust a register that marks its uncertainties.

How are amendments and renewals handled?

Amendments and renewals are the moments when drift enters the contractual record. A renewal may change price, scope, or service levels. An amendment may add a new service, move a workload, or change a subcontractor. If the register is only updated at the original signing, it will describe a deal that has been superseded. The remedy is procedural: every amendment and renewal should pass through the register owner before it is treated as complete. That step need not be slow, but it must be required, so the register and the contract move together.

How is the register reconciled with the contracts?

Reconciliation is the quality discipline for this part of the register. It means comparing register entries against the contract repository for a sample of arrangements, checking that each entry points to a real agreement, that the agreement is the current version, and that the recorded scope and terms still match. Discrepancies should be logged, assigned, and corrected, not merely noted. Over time, the pattern of discrepancies also tells the register owner where the update process is weak, whether renewals, amendments, or new services are the main source of drift.

A useful habit is to review contractual entries whenever a contract event occurs, rather than waiting for a reporting cycle. Contract events are natural review points, and using them spreads the work across the year instead of concentrating it into a frantic period before reporting. When the register, the contract repository, and the service in use all tell the same story, the contractual part of the register has done its job. It has turned a set of agreements into a map a firm can act on, and a supervisor can trust.

Primary sources on the record

Legal status: Regulation (EU) 2022/2554 in force; applies from 17 January 2025, with technical standards applying on the dates stated in each standard. Application position for this topic: Applies from 17 January 2025. Technical standards apply on their own stated dates.

Follow the service map

Line 12 - Register of information DORA Register of Information The DORA register of information maps ICT third-party arrangements at entity level, so supervisors can see the dependencies behind a financial entity and the entity can keep that picture current. Line 12 - Register of information Register ICT Services and Functions ICT services and functions are the heart of the DORA register: what each provider actually does, and which business functions would feel it if that service stopped. Line 12 - Register of information Register Data and Locations Data and locations in the DORA register show what information each ICT arrangement touches and where the related activity takes place, giving supervisors a view of movement and concentration.