{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-28-30",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/dora-agent/art-28-30)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-17",
    "fingerprint": "ewai:se:0fe7ae",
    "proof": "sha256:1b13fca237b5a6841503bf098dfa32d2892693fa67f65295997e9b18a8b337b0",
    "jurisdiction": "se",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "agent_id": "agent:eu:dora:agent-dora-art-28-30",
  "agent_version": "1",
  "schema_version": "1",
  "graph_version": "2026-10-10.1",
  "section": "DORA art. 28, 29 och 30, förordning (EU) 2022/2554",
  "title": "DORA Art. 28–30 ICT Third-Party Risk Agent",
  "question": "What must we do before and when contracting an ICT provider under DORA?",
  "applies_from": "2025-01-17",
  "requirements": [
    {
      "id": "requirement:eu:dora:art-28-1-a",
      "provision": "Art. 28(1)(a)",
      "title": "Full responsibility remains with the financial entity",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-28-2",
      "provision": "Art. 28(2)",
      "title": "Strategy on ICT third-party risk reviewed by the management body (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:dora:art-28-3",
      "provision": "Art. 28(3)",
      "title": "Register of information on all ICT contracts",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-28-3-report",
      "provision": "Art. 28(3), third subparagraph",
      "title": "Yearly report to the competent authority",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-28-4",
      "provision": "Art. 28(4)",
      "title": "Pre-contract assessment and due diligence (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:dora:art-29-1",
      "provision": "Art. 29(1)",
      "title": "ICT concentration risk: substitutability and multiple contracts (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:dora:art-30-1",
      "provision": "Art. 30(1)",
      "title": "Rights and obligations in one written contract",
      "verbatim": true
    },
    {
      "id": "requirement:eu:dora:art-30-2",
      "provision": "Art. 30(2)",
      "title": "Minimum contract terms (summary)",
      "verbatim": false
    },
    {
      "id": "requirement:eu:dora:art-30-3",
      "provision": "Art. 30(3)",
      "title": "Additional terms for critical or important functions (summary)",
      "verbatim": false
    }
  ],
  "deadlines": {
    "register_report": {
      "at_least": "once a year",
      "provision": "Art. 28(3)"
    },
    "critical_contract_notice": {
      "when": "in a timely manner, before the planned arrangement",
      "provision": "Art. 28(3)"
    }
  },
  "sanctions": [
    {
      "key": "art-50-administrative",
      "provision": "Art. 50(3)–(4)",
      "authority": "National competent authorities (Art. 46)",
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "amount": "set_by_member_state",
      "measures": [
        "cease-and-desist order",
        "cessation of practice",
        "measures including of pecuniary nature",
        "public notice naming the person and breach"
      ],
      "id": "sanction:eu:dora:art-50-administrative"
    },
    {
      "key": "art-35-periodic-penalty",
      "provision": "Art. 35(6)–(8)",
      "authority": "Lead Overseer (EBA, ESMA or EIOPA)",
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
      "applies_to": "critical ICT third-party service providers",
      "max_daily_share_of_worldwide_turnover": 0.01,
      "max_months": 6,
      "id": "sanction:eu:dora:art-35-periodic-penalty"
    }
  ],
  "cases": [],
  "counts": {
    "requirements": 9,
    "controls": 4,
    "cases": 0,
    "scope_entity_types": 20
  },
  "deterministic": true,
  "agent_hash": "218d40544ef6637e5bdaf82f16ed0f1528c6671d6e970766232a766bdcd10d11",
  "hash": "sha256:1b13fca237b5a6841503bf098dfa32d2892693fa67f65295997e9b18a8b337b0",
  "case_note": "No DORA sanction decision with an official public source is in the register yet (DORA applies from 2025-01-17); status not_in_register.",
  "scope": {
    "entities": [
      "credit institutions",
      "payment institutions",
      "account information service providers",
      "electronic money institutions",
      "investment firms",
      "crypto-asset service providers and issuers of asset-referenced tokens",
      "central securities depositories",
      "central counterparties",
      "trading venues",
      "trade repositories",
      "managers of alternative investment funds",
      "management companies",
      "data reporting service providers",
      "insurance and reinsurance undertakings",
      "insurance and reinsurance intermediaries",
      "institutions for occupational retirement provision",
      "credit rating agencies",
      "administrators of critical benchmarks",
      "crowdfunding service providers",
      "securitisation repositories"
    ],
    "provision": "Art. 2(1)(a)–(t)",
    "note": "Gambling and betting operators are not financial entities under DORA unless they also hold one of these licences."
  },
  "endpoints": {
    "self": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-28-30",
    "node": "https://legal.exploreworldai.com/api/public/v1/node/agent/agent%3Aeu%3Adora%3Aagent-dora-art-28-30",
    "page": "https://legal.exploreworldai.com/agent/dora/art-28-30",
    "nodes": "https://legal.exploreworldai.com/graf/dora",
    "regulation": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj"
  },
  "not_covered": {
    "other_articles": "Art. 24–27 resilience testing and Art. 31–44 oversight of critical ICT providers are not_in_register for these agents."
  },
  "provenance": {
    "primary_source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj",
    "reporting_deadlines": "https://eur-lex.europa.eu/eli/reg_del/2025/301/oj",
    "read_at": "2026-10-10",
    "method": "verbatim EUR-Lex text where verbatim = true; editorial control and cross-framework mapping (unreviewed)"
  },
  "source": "Source: NovaCopilot",
  "version": "legal-2026-10-17",
  "expires": "2026-10-18T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-17+legal-2026-10-17+2026-10-17T17:42:33",
    "content_hash": "sha256:1b13fca237b5a6841503bf098dfa32d2892693fa67f65295997e9b18a8b337b0",
    "revalidate_after": "2026-10-17T20:09:31.428Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/dora-agent/art-28-30",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "withheld": {
    "control_mappings": 4
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}