Description

A focused course, tailored for you

DORA Contract Remediation for In-House Legal Counsel

Build the clause-by-clause DORA contract playbook that survives vendor pushback and satisfies your competent authority.

Your DORA contract addendum came back from the vendor's legal team with the Article 28 access and audit rights crossed out and flagged as commercially unacceptable. That is the third or fourth vendor this quarter to push back on the same clause. You have 19 mandatory provisions to embed across every covered contract. You have a legacy portfolio of agreements that predate the regulation entirely. And your competent authority has already signalled it will request the register of information.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

DORA's Articles 28 to 30 created a concrete legal drafting workload that most in-house teams underestimated during the implementation run-up. The mandatory contractual provisions go well beyond standard service-level language: enforceable access and audit rights, specific incident notification timelines with tight deadlines, detailed exit and migration obligations, cascaded sub-contractor requirements, and register maintenance that a regulator can inspect on short notice. Vendors with strong market positions push back on the clauses that constrain them most. Business lines want clearance on new vendors while existing contracts in the same relationship remain non-compliant. The remediation backlog grows while the regulatory clock has already started. This course cuts through the backlog by giving you a working clause library, a negotiation response for every standard vendor objection, a triage methodology for your legacy portfolio, and a register template your competent authority can examine.

What you walk away with

Draft each of DORA's 19 mandatory contractual provisions in enforceable language ready for your next vendor negotiation.
Respond to vendor pushback with a hierarchy of permissible concessions anchored to the regulatory text.
Build and prioritise a legacy-contract remediation register sequenced by function criticality and outstanding gap.
Negotiate access and audit rights clauses that survive the commercially unacceptable objection.
Produce the ICT third-party register your competent authority will request, with every required field populated.

The 12 modules

Module 1. DORA's Legal Architecture: What Articles 28 to 30 Require from Contracts

Before drafting a single clause you need to know which contracts DORA covers, how ICT third-party service providers is defined, and where the mandatory provisions sit in the regulation versus the implementing technical standards. This module maps the full legal landscape, including the distinction between contracts for critical or important functions and all other ICT contracts, so you know exactly where the most demanding requirements apply and where lighter obligations suffice.

Module 2. The 19 Mandatory Provisions: A Clause-by-Clause Drafting Guide

Article 30 specifies a list of elements that must appear in every contract for ICT services supporting critical or important functions. This module works through each element: the precise language required, the common drafting choices available to in-house counsel, the interpretive questions vendor lawyers will raise, and worked examples of how each provision looks in a finished contract. The output is a clause library you can paste and adapt to your own house style.

Module 3. Tiered Requirements: Critical Function Contracts Versus General ICT Agreements

Not every contract in your ICT portfolio requires the full Article 30 treatment. DORA creates a two-tier structure, and correctly classifying each contract is the first decision in your remediation programme. This module explains how to assess function criticality using an internal methodology your legal team can apply consistently, how to document the assessment in a defensible way, and what the lighter-touch requirements look like for contracts that fall outside the top tier.

Module 4. Sub-Contractor Cascade: Flowing DORA Obligations Downstream

When your ICT vendor sub-contracts part of the service, your DORA obligations do not stop at the first tier. The regulation requires your contracts to include provisions ensuring the vendor imposes appropriate obligations on its own material sub-contractors. This module covers how to draft the cascade clause, how to audit compliance with it, and what your rights are if a vendor sub-contracts without notifying you, including the contractual triggers that let you act.

Module 5. ICT Incident Notification: Drafting the Timeline Clause

DORA imposes strict timelines for reporting major incidents to your competent authority. Your contract must require the vendor to notify you fast enough for you to meet those timelines. This module covers the notification chain: what the vendor must report, by when, in what format, and through which channel. It includes a worked clause and a detailed discussion of how to handle the gap between a vendor's internal incident definition and the regulatory definition in DORA.

Module 6. Access, Audit, and Inspection Rights: Making the Clause Enforceable

The access and audit clause is the provision vendors fight hardest against. This module explains what the regulation requires, why it matters for your regulatory relationship, and how to draft language that is both compliant and achievable in a negotiation. It covers the distinction between the right to audit directly and the right to rely on pooled audits or third-party certifications, and the conditions under which each is acceptable under the implementing RTS on ICT third-party risk.

Module 7. Exit and Migration: Drafting a Workable Termination Clause

DORA requires contracts to include exit strategies and migration plans. Vendors resist language that makes migration easy because it reduces lock-in. This module covers how to draft an exit clause that satisfies the regulatory requirement, what a migration plan obligation should include in practical terms, and how to negotiate transition assistance provisions that are legally enforceable without being commercially unacceptable to a vendor that has no incentive to make leaving easy.

Module 8. Concentration Risk and the Supervisory Perspective

Competent authorities are watching for concentration risk in ICT supply chains, and your contracts are one of the places they will look. This module explains how concentration risk concerns affect your contract strategy: which vendors attract the most supervisory scrutiny, what disclosures are expected in the register of information, and how the legal framing of your contracts supports or undermines your firm's concentration risk narrative when your supervisor asks about it.

Module 9. Cross-Border ICT Services and Governing Law

DORA is an EU regulation, but many ICT vendors are headquartered outside the EU, governed by different law, and delivering services through a chain of entities spanning multiple jurisdictions. This module covers how to handle governing law choices in DORA contracts, what to do when a vendor's standard terms specify a non-EU jurisdiction, and how to ensure that access and audit rights are practically enforceable against entities operating outside the reach of European courts and regulators.

Module 10. Legacy Contract Remediation: Building Your Programme

Most firms entered DORA's application period with a portfolio of existing agreements not drafted with the regulation in mind. Remediation is the legal workload of this cycle. This module provides a methodology: how to triage your contract inventory by criticality and gap severity, how to sequence vendor outreach, what minimum viable amendments look like for contracts that cannot be fully renegotiated in the available time, and how to document remediation progress for supervisory review.

Module 11. Negotiating DORA Pushback: A Response for Every Standard Objection

Vendors have developed a set of standard objections to DORA-compliant contract clauses. Commercially unacceptable for access rights. Operationally impossible for notification timelines. Not applicable to our service model for sub-contractor cascade. This module gives you a response for each objection: the regulatory text that makes the requirement non-negotiable, the permissible flexibility in how the requirement can be met, and the specific language that has resolved each class of dispute in practice.

Module 12. The Register of Information: What Your Competent Authority Will Request

DORA Article 28 requires firms to maintain a register of information on all contractual arrangements with ICT third-party service providers. The register is not a simple contract list: it must contain specific fields defined by the regulation and its implementing technical standards. This module walks through the required fields, how to populate them from your contract inventory, and how to structure the register so a competent authority can examine it without generating a long list of follow-up questions.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

The vendor's legal team returns your DORA addendum with Article 28 access rights struck through as commercially unacceptable.

A business line wants to go live with a new cloud provider before remediation of their existing contracts with that vendor is complete.

Your competent authority sends a written request for your register of information on ICT third-party arrangements.

A vendor sub-contracts a material portion of its services to a third party without prior notification, and you need to know what your contract gives you the right to do.

What you get with this course

Clause library: drafted versions of all 19 mandatory DORA provisions for copy-and-adapt use in your own contracts
Negotiation response guide: a mapped response for each common vendor objection, anchored to the specific regulatory text
Legacy remediation methodology: a triage and sequencing tool for prioritising your existing contract portfolio
Register of information template: pre-populated field structure aligned to DORA's implementing technical standards
Downloadable templates and worked examples for every module
Hand-built implementation playbook specific to the in-house legal function, delivered alongside course access

What you will have in hand by Day 1, Week 1, Month 1

Course access provisioned within 24 hours via the Art of Service learning environment.

Hand-built implementation playbook delivered alongside course access.

Before and after

Before

A growing backlog of ICT contracts not yet compliant with DORA, recurring vendor pushback on the same two or three clauses, and a register of information your supervisor will eventually request but that is not yet ready to share.

After

A clause library ready to deploy in your next vendor negotiation, a remediation register that tracks progress across your full contract inventory by criticality, and a register of information your competent authority can examine without generating follow-up questions.

What happens if you do not address this

Non-compliant ICT contracts remain a direct and ongoing regulatory exposure. Your competent authority has the power to require formal remediation, and the register of information request will surface the gaps quickly. Legal counsel who cannot move the contract backlog become the bottleneck for business lines waiting on vendor clearance, which creates pressure to approve non-compliant arrangements rather than hold the line.

Who it is for

Senior in-house legal counsel at a regulated financial institution subject to DORA. Accountable for ICT third-party contract compliance across multiple business lines, each with their own vendor relationships and their own urgency. Comfortable reading EU regulation directly but looking for implementation-level drafting tools rather than another high-level overview. Responsible for both the new-contract pipeline and the remediation of existing agreements that predate DORA.

Who this is NOT for. Junior legal staff who have not yet been assigned ownership of DORA contract remediation. External counsel billing by the hour on behalf of a client who already owns the drafting decisions. Compliance officers managing the governance framework rather than the underlying contracts.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. 12 modules. Two to three hours of reading and template work per module if applied directly to your contract inventory. The clause library and negotiation response guide are designed to go into your next vendor engagement immediately, without requiring the full 12 modules to be complete first.

Why $199 is the right number

External counsel will draft DORA-compliant clauses at hourly rates, which works but does not leave your team with a reusable methodology or clause library. In-house training programmes cover the regulation at a high level but rarely produce working contract language. This course sits between those two: specific enough to generate usable drafting output, affordable enough to work without a project code.

FAQ

Is this course written for a particular type of financial institution?

The course is written for in-house legal counsel at EU-regulated financial institutions subject to DORA. The examples focus on contracts for ICT services supporting critical or important functions, which is where the most demanding requirements sit and where vendor pushback is most common.

Does the course address the implementing technical standards under DORA?

Yes. The RTS on ICT third-party risk is covered where it affects the contractual provisions, including the pooled audit arrangements in the access and audit RTS and the register of information fields specified in the implementing technical standards.

What if my firm has already begun DORA contract remediation?

The clause library and negotiation response guide are useful at any stage of remediation. The triage and sequencing methodology in Module 10 works as a diagnostic against a programme already in progress, helping you identify where the remaining gaps are and how to sequence the outstanding work.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.