DORA (Regulation (EU) 2022/2554) reaches most ICT providers outside the EU through their EU financial clients' contracts, not as regulated entities. Only designated critical providers are overseen directly, and the first list, of 18 November 2025, names 19, none headquartered in the GCC.
This guide is for CISOs, contract and bid managers at Gulf cloud, software, data-centre and managed-service firms with EU bank, insurer or investment-firm clients.
Which DORA duties reach a company outside the EU?
DORA has applied since 17 January 2025 (Article 64). Article 2(1) lists ICT third-party service providers at point (u), next to financial entities. On our reading, that does not make a provider a regulated entity. The duties fall on financial entities, which stay fully responsible when they outsource (Article 28(1)).
| Situation | Overseen directly? | What applies | What to have ready |
|---|---|---|---|
| Gulf ICT provider, service not supporting a critical or important function | No | The client's Article 30(2) contract terms | One written contract, service and data locations, an LEI, data-return and exit terms |
| Gulf ICT provider, service supporting a critical or important function | No | Article 30(2) and 30(3) terms, plus Delegated Regulation (EU) 2025/532 if you subcontract | Tested contingency plans, audit access, a full subcontractor list, a change-notice process |
| Provider designated critical by the European Supervisory Authorities | Yes, by a Lead Overseer | EU clients may use a third-country provider only if it sets up an EU subsidiary within 12 months of designation (Article 31(12)) | An EU subsidiary, a coordination point, answers to recommendations within 60 days |
| IT company of a Gulf financial group, mainly serving the group's EU financial entities | No. It cannot be designated (Article 31(8)) | The subsidiaries still keep the register and DORA contracts | Intra-group contracts and register data |
| A Gulf financial group's EU bank, insurer or investment firm | Yes, as a financial entity | DORA as a financial entity, including the register, incident reporting and training (Articles 5(4) and 13(6)) | Its own register, contracts and training records |
Before signing, the client assesses whether your service supports a critical or important function (Article 28(4)): one whose disruption would materially impair its financial performance, service continuity or compliance with its authorisation. Ask which of the first two rows it has put you in.
Supporting a client's critical or important function does not make you a designated critical provider. Only an ESA designation under Article 31 brings direct oversight.
What will EU clients put in your contract?
Article 30(1) requires one written contract, including the service levels. Article 30(2) lists the minimum terms for every ICT contract.
- (a) the services, and whether you may subcontract critical or important functions
- (b) the countries or regions where you provide services and store data, with advance notice of changes
- (c) availability, authenticity, integrity and confidentiality of data, and (d) access, recovery and return of data on insolvency, discontinuation or termination
- (e) service levels, and (f) incident assistance without extra charge or at a cost fixed in advance
- (g) full cooperation with the client's competent and resolution authorities, and (h) termination rights and notice periods
- (i) the conditions for your staff to take part in the client's ICT security awareness and digital operational resilience training
Under Article 13(6), clients must train all employees and senior management and, where appropriate, include their ICT providers in relevant training. Agree which modules your people join and how attendance is recorded.
Where your service supports a critical or important function, Article 30(3) adds precise service-level targets and business contingency plans that you implement and test, with appropriate ICT security measures. You also join the client's threat-led penetration testing and accept an exit strategy with a mandatory transition period.
Article 30(3)(e) is the heaviest term: unrestricted rights of access, inspection and audit for the client, its appointee and its competent authority. You must also cooperate with on-site inspections, including by the Lead Overseer. Where audits would affect your other clients, you and the client can agree alternative assurance levels (Article 30(3)(e)(ii)).
Under Delegated Regulation (EU) 2025/301, your client notifies a major incident within 4 hours of classifying it and no later than 24 hours after becoming aware. An intermediate report follows within 72 hours, and a final report within one month of that. Agree a notification time you can actually meet.
Why does being outside the EU matter to your client?
For critical or important functions, Article 29(2) makes the client weigh subcontractors in third countries, the insolvency law that would apply and limits on urgent data recovery. Where the provider itself is in a third country, it also considers compliance with EU data protection rules and effective enforcement of the law there. No GCC state, nor the DIFC or ADGM, has an EU adequacy decision, so personal data sent to you needs a transfer tool under Chapter V of the GDPR.
Each financial entity also keeps a register of information on all its ICT contracts and reports on it to its competent authority at least yearly (Article 28(3)). Under Implementing Regulation (EU) 2024/2956, if you are established in a third country, you are identified by LEI only, and the template records the country of your global headquarters. Without an LEI, you leave a gap in your client's register.
Submission windows vary. Luxembourg's CSSF, for example, took 2026 registers from 11 February to 31 March 2026.
What changes if you subcontract part of the service?
Delegated Regulation (EU) 2025/532 has governed subcontracting of critical or important services since 22 July 2025. It names the location of a subcontractor or its parent company as a complexity factor (Article 1). Before signing, the client checks that you can assess subcontractors and identify every one supporting a critical or important function (Article 3).
You stay responsible for subcontracted services and flow down contingency plans, security standards and the same audit rights as Article 30(3)(e) (Article 4). Material changes need notice, and you implement them only after approval or no objection within the agreed period (Article 5). If you go ahead despite an objection, the contract may let the client terminate (Article 6).
Who can be designated critical, and what follows?
The European Supervisory Authorities (EBA, EIOPA and ESMA) designate critical providers and give each a Lead Overseer (Article 31). Delegated Regulation (EU) 2024/1502 sets a high first step: serving at least 10% of one category of financial entity by number and 10% by total assets, counting only critical or important services.
The ESAs published the first list on 18 November 2025. Its 19 entries include Amazon Web Services EMEA Sarl, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and SAP SE. None is headquartered in the GCC.
EU financial entities may use a designated provider established outside the EU only if it sets up a subsidiary in the Union within 12 months of designation (Article 31(12)). The clock runs from designation, not from 17 January 2025. The provider must say within 60 calendar days whether it will follow the Lead Overseer's recommendations (Article 42). Inspections outside the EU need the provider's consent and no objection from the local authority (Article 36).
For Gulf financial groups, a group company that mainly serves financial entities in its own group is an ICT intra-group service provider, which Article 31(8) excludes from designation. The ESAs' joint Q&A 2024_7096 confirms this applies wherever the group company is established, so the subsidiary rule does not reach it.
What is under review?
EUR-Lex lists no amending act in force for DORA. The ESAs update the critical-provider list every year (Article 31(9)), and we found no 2026 update on 4 October 2026. The Commission must review the subsidiary rule by 17 January 2028, including whether a subsidiary is needed at all (Article 58).
The Digital Omnibus, COM(2025) 837 of 19 November 2025, is only a proposal. Its Article 8 would route major incident reports through an ENISA single-entry point, with the underlying reporting requirements unchanged. On 4 October 2026 it was awaiting a committee decision in Parliament.
How AGS can help
Two kits cover DORA in editable Word and Excel files, plus PowerPoint in the training package.
- DORA ICT Third-Party Risk & Digital Operational Resilience Management System: 265 documents, including an ICT Contract Management Policy, ICT Subcontracting Policy, DORA Register of Information and Exit Strategy Guide.
- DORA ICT Risk & Digital Resilience Awareness Training Package: 343 documents of courses, slide decks and records for financial entities. Its Training Audience Identification Guide treats ICT provider staff as an Article 30(2)(i) audience.
Frequently asked questions
Does DORA require ISO/IEC 27001 certification from ICT providers?
No. Article 28(5) requires appropriate information security standards but names no standard or certificate. An ISO/IEC 27001:2022 system is one way to evidence your controls.
Can an EU regulator fine a Gulf ICT provider under DORA?
No, DORA sets no fine for ICT providers. A designated critical provider that ignores the Lead Overseer's information, inspection or report requests faces a periodic penalty payment of up to 1% of average daily worldwide turnover per day, for up to six months. Other providers face contract consequences, such as termination under Article 28(7).
Can a provider ask to be designated critical?
Yes. A provider not on the list may apply under Article 31(11), and the ESAs decide within six months.
AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by the European Commission, the European Supervisory Authorities or any competent authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
