DORA for the general counsel: negotiating Article 30 contracts, audit rights and exit

Are we regulated directly by DORA, or do we take on obligations only through contracts?

The first list of 19 critical ICT third-party service providers, published on 18 November 2025, includes no Taiwanese company. Customers' registers of information identify providers outside the EU by LEI; legal should confirm that the company has an LEI and designate who supplies the information for the register.

Which clauses will customers ask us to sign under Article 30, and which apply only when we support critical or important functions?

What the general counsel reviews:

• Data processing locations: which countries are listed; whether they restrict later changes of data centre or subcontracting
• Cooperation with authorities: how you respond from Taiwan to requests from EU authorities, and who handles them
• Function classification: whether the customer treats your service as supporting a critical or important function determines how many clauses apply; the customer decides this, so ask before signing
• Subcontracting: whether your cloud or downstream supplier contracts can support what you promise the customer

Timeline (as listed on the service page): preparing an ICT supplier's contractual obligations typically takes 2–3 months.

A financial customer demands unrestricted audit rights. Can we limit the frequency or substitute an ISO 27001 certificate?

When you support critical or important functions, Article 30(3)(e)(i) requires unrestricted rights of access, inspection and audit by the financial entity or an appointed third party (as quoted in an EIOPA Q&A). In Q&A 2646 (18 September 2025), ESMA explains that:

• DORA does not limit financial entities in how they implement the audit requirements
• The audit frequency is agreed by the financial entity, not imposed by the ICT provider
• Even where a frequency is agreed, the financial entity must still be able to carry out ad hoc audits

So the general counsel negotiates how audits happen, not whether they happen: advance notice, scope, confidentiality (so auditors do not see other customers' data), cost allocation, and using ISO 27001 certificates and audit reports as routine evidence while preserving ad hoc audits. Whether a certificate replaces any given audit is the financial entity's decision.

Termination and exit clauses: when can the customer terminate, and how much transition support must we commit to?

Article 30 requires every contract to set out termination rights; when you support critical or important functions, exit strategies are also required. Customers will ask how data and services are transferred on termination or switching, and how long the transition period is. The general counsel's framework:

The legal effect of each clause should be assessed case by case by a lawyer.

What if home-country law restricts data access or disclosure and conflicts with the DORA contract clauses?

This is a real cross-border conflict for ICT providers. The European Insurance and Occupational Pensions Authority (EIOPA) received a DORA Q&A stating that Finland's Act on electronic communication services does not allow access to a telecom operator's data, which conflicts with the unrestricted rights of access, inspection and audit in Article 30(3)(e)(i). EIOPA rejected the question on the ground that the Q&A tool does not answer questions that put into doubt the correctness of the legal framework, and gave no answer.

DORA will not resolve the conflict for you, so settle the clauses first:

• Before signing: list provisions in Taiwanese or other laws that restrict data export, access or disclosure, and compare them with the contract's data locations, audit and authority-cooperation clauses
• In the contract: set out notification, negotiation of alternatives and termination procedures if a conflict arises
• Who decides: whether a conflict exists and how to draft around it should be assessed by a lawyer familiar with both jurisdictions

When a major ICT-related incident occurs, what are our notification and assistance obligations to the financial customer?

The financial entity, not you, reports to the authority; but your assistance determines whether it meets the deadlines. Under Delegated Regulation (EU) 2025/301:

• Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it
• Intermediate report: within 72 hours of the initial notification
• Final report: within one month of the latest intermediate report

Whether an incident is major is determined under Delegated Regulation (EU) 2024/1772. Every contract must include assistance with ICT incidents; the general counsel confirms how quickly you notify the customer, what information you provide, whether assistance is charged separately, and how your incident records are preserved to support the customer's final report. For EU financial entities that are also NIS2 entities, cybersecurity risk management and reporting follow DORA instead (DORA Article 1(2); Commission Guidelines C/2023/6068).

How does Winners Consulting help a general counsel with DORA?

• Status determination: confirm whether you are a type of financial entity covered by DORA or an ICT provider to financial entities, and assess the scope of direct and contractual obligations
• ICT third-party risk management: build a supplier risk assessment method, the mandatory contract clauses (audit rights, data portability, exit strategies) and maintenance of the register of information
• Incident reporting: design severity criteria and the reporting process for major incidents
• Resilience testing: plan the annual testing programme and assess whether TLPT applies
• Integration with existing systems: reuse documents and controls for organisations with ISO 27001 or business continuity management in place
• Who leads: VP- and director-level consultants lead the work end to end, never outsourced

Legal opinions on contractual liability or jurisdiction should come from a lawyer. More: DORA consulting, How to choose a DORA consultant in Taiwan, NIS2 consulting. Request a free mechanism diagnosis