Do AI vendors need to be in the DORA register of information?

Yes, if they provide ICT services to an EU financial entity. DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 and requires financial entities to keep a register of information on all contractual arrangements with ICT third-party service providers. AI and cloud providers supplying ICT services fall within that, and contracts supporting critical or important functions need specific provisions.

How it works

1. List every AI service you use, including model APIs and AI features inside other software.
2. Add each to the register of information with the functions it supports.
3. Check contracts for DORA's required clauses: service levels, audit rights, exit plans.
4. Keep evidence of what each AI service did. Sealed records support incident reporting and testing.