The DORA Register of Information is rebuilt every year, and the deadline is not the same for everyone

Anyone in a cooperative bank, an insurance company or an investment firm who filed the Register of Information last spring and treated the matter as closed is about to discover that it was not a filing: it was a cycle. In a few months it has to be rebuilt, with a new reference date, on contracts that have since been renewed, transferred or terminated. And whoever sells those services — the software house behind the core banking system, the data centre holding the disks — will receive the same questionnaire from financial clients for the second or third time, with questions they answered the first time as best they could.

What Article 28 requires, and of whom

Regulation (EU) 2022/2554 — DORA — requires financial entities to keep an up-to-date register of every contractual arrangement for the use of ICT services provided by third parties, and to make it available to the competent authority. We have already written about the subcontracting chain; here the question returns every twelve months: who redoes the extraction, and from what.

The perimeter is wider than most assume. The IVASS market letter of 7 March 2025 spells it out in a footnote: DORA covers undertakings under Solvency II and intermediaries, including ancillary ones, that are not micro, small or medium-sized enterprises — that is, those with 250 employees or more and annual turnover above EUR 50 million, or an annual balance sheet above EUR 43 million.

Ninety-nine fields, and none of them sits in a business system

The format is set by Implementing Regulation (EU) 2024/2956, published on 2 December 2024: fifteen templates, fourteen of which have numbered columns, for a total of ninety-nine fields. The point is not the number: those fields do not sit in any system, they sit inside the contracts.

Template B_02.02 asks, for every arrangement supporting a critical or important function, for the termination notice period in calendar days as it stands «in una situazione di status quo», in a status quo situation — and it asks twice, once for the entity and once for the provider. Then the country of the governing law, the country the service is provided from, the country of data at rest, the country of data processing, the sensitivity of that data on three levels and the degree of reliance on four, from «dipendenza irrilevante», not relevant reliance, to «dipendenza totale», full reliance.

Template B_07.01 asks for a judgement: how substitutable that provider is, on four levels, and for which reason if the answer is «non sostituibile», not substitutable. Then the date of the last audit on that service, with a convention that leaves no room to hide: if no audit has been carried out, you write «9999-12-31». Then whether an exit plan exists.

The register is Article 30 projected onto a table

These columns do not come out of nowhere: Article 30(2)(b) of DORA requires the contract to state up front the regions or countries «in cui si devono trattare i dati, compreso il luogo di conservazione», in which the data are to be processed, including the storage location, and Article 30(3)(f) requires exit strategies. Hence the consequence that costs: filling in the register means discovering which contracts do not contain the clauses Article 30 demands. An empty cell in B_02.02 is not a reporting problem, it is evidence that the contract has to be renegotiated — and the register then lands on a supervisor’s desk.

Three authorities, three calendars

Legislative Decree 23 of 10 March 2025 designates, in Article 3, the DORA competent authorities — Banca d’Italia, Consob, IVASS and COVIP — each for the entities it supervises. They do not share a calendar.

Banca d’Italia, in a communication of 13 February 2026, set annual transmissions from 2026 onwards at 15 March each year, with a reference date of 31 December of the preceding year, through the INFOSTAT platform; registers undergo data quality controls, and where anomalies emerge they must be corrected and resubmitted. The next deadline is therefore Monday 15 March 2027, on data as at 31 December 2026. IVASS, in the calendar annexed to its market letter of 9 March 2026, sets the DORA Register of Information at a reference date of 31/12/2025 and a submission deadline of 31/03/2026: more than two weeks later than the bank. And the delivery is not a form: the 2025 IVASS letter prescribes a .zip archive containing one .csv file for each of the 15 templates, named after the reporting entity’s LEI.

There is then a second annual appointment: since 22 May 2026 Banca d’Italia has required directly supervised intermediaries to submit, annually and on a consolidated basis, by 31 May, the estimates of aggregated annual costs and losses caused by major ICT-related incidents, under Article 11 of DORA.

The ICT provider is on the other side of the same form

If you sell IT services to financial entities, those recurring requests are not paperwork. Recital 1 of Regulation 2024/2956 states that the register’s information is «essenziali per il processo annuale di designazione dei fornitori terzi critici di servizi TIC», essential for the annual designation of critical ICT third-party service providers — the designation we wrote about when the first list came out. And the criteria in Article 31 of DORA include substitutability: a cell your clients fill in about you every year, without asking your permission.

Why this needs a closed system

ICT contracts contain prices, service levels, penalties and confidentiality clauses that forbid disclosing their content to third parties: uploading them to a general-purpose cloud service breaches those obligations before a single row has been extracted. The register is then handed to a supervisor, and every field has to be defensible — which clause it came from, on what criterion — and that can only be said of a system whose contents are known. The extraction repeats every year: if it depends on an external service that can change its terms or its licence, the cycle breaks in the worst possible year. And the result — where the data sit, what it costs to leave, who cannot be replaced — is the map of the firm’s dependencies: knowledge you keep, not knowledge you export.

How we solve it

Complying. The control runs on the real contracts and produces every field together with the trace of where it came from — which clause, which annex — flagging the arrangements where the clause Article 30 demands is simply absent. Not a form filled in each February, but a register that stays correct when a renewal is signed in July. It is how we handle confidential documents.

Deciding. The same architecture holds contracts, supplier master data, the application map and the classification of functions together in a single operating model, on which AI agents carry out decisions with an operator in command — for large enterprises, defence, public administration and healthcare. Always on-premise, on standalone machines that require no deep integration into the client’s network, or on a dedicated cloud with data centres in Italy, and always with shared management: the client does not need to already employ people who administer AI models. It is the method behind the platform we build.

How many days of notice do you have, contract by contract, to leave a provider that supports a critical function? It is a mandatory field in the register, and the first thing to know in order to decide. Half an hour with one of our engineers is enough to establish where the answer sits.

Sources

What we do not know

As at the date of checking, there is no IVASS communication setting the 2027 deadline: the published calendar covers the collection as at 31 December 2025, and the Institute updates it with an annual letter. The Banca d’Italia 15 March deadline, by contrast, is a standing rule, and the date of 15 March 2027 follows from it. The Consob pages on DORA carry no notice with an equivalent deadline, and the COVIP site did not respond to our requests: on both we assert nothing. We have not quantified the penalties for an incomplete or late register. And no consolidated version of DORA appears on EUR-Lex to date: the text we read is the one published in the Official Journal of the Union on 27 December 2022, with no amendment or corrigendum markers.