DORA – change of ICT sub-service provider, risk assessment & objection | Word/PDF/Excel

Your cloud provider or operations partner notifies you that an important ICT sub-supplier is to be replaced. Must your financial firm accept the change? When the ICT service supports a critical or important function, or a substantial part of one, DORA and the EU's specific sub-supplier standard may require a documented risk assessment, contractual notification, and a timely decision. This specialist package helps you handle a specific change notification – not just establish a general IT policy.

Applicable regulations: DORA, Regulation (EU) 2022/2554, applies from 17 January 2025. The complementary Commission Delegated Regulation (EU) 2025/532 applies from 22 July 2025 and covers risk assessment and conditions for subcontracting ICT services that support critical or important functions. Article 5 regulates material changes; Article 6 regulates certain conditions for contractual termination rights.

Contents: 5 Swedish work templates, a Swedish user guide and a separate English User Guide in both Word (DOCX) and searchable/printable A4 PDF, as well as an Excel register with nine tabs and 730 administrative formulas. Total 7 DOCX + 7 PDF + 1 XLSX = 15 files in a ZIP. One-time price SEK 79; no physical delivery, no macros and no automated supplier integration.

When is this the right DORA template?

Typical users are the IT risk function, compliance, legal counsel, procurement and supplier manager, information security officer and business owner of critical or important functions in financial firms. Example event: a company with a critical financial service receives written notification that operations, infrastructure, security function or data storage is being moved to another sub-supplier, perhaps in a new country or further down the delivery chain.

Scope: Not every IT purchase or common supplier change is a material change under Article 5. First document whether the entity is covered by DORA and whether the specific sub-supplier chain supports a critical or important function, or a substantial part of one. The same legal requirements should not be attributed to companies outside the relevant scope.

All 15 customer files

Excel – nine tabs for the contract and risk process

The workbook consists of Read me, Overview, Changes, Contract, Risks, Answers, Decision, Exit and Sources. Each actual change is assigned a case ID. The overview counts notifications, incomplete risk documentation, contracts to be investigated, unanswered requests, objections without actual communication and exit cases. It contains 730 formulas and has passed 23 out of 23 scenario tests, including risk above tolerance, subcontracting not allowed by the contract, incomplete change notification, missing supplier proof, objection without proof of delivery and exit case with missing decision documentation. Automatic labels such as “REVIEW APPLICABILITY”, “COMPLETE CONTRACT”, “OBJECTION ASSESSMENT BEFORE DEADLINE” and “EXIT REQUIRES MANUAL DECISION” never mean that legal requirements have been met. The customer file is reset without fictitious test cases.

How you handle the change in practice

1. Receive and save the original notification. Capture the actual sender, contract, time of message, new sub-supplier chain and planned implementation date.
2. Check applicability. Assess DORA entity, critical/important function, materiality, sub-supplier chain and contractually agreed permission to hire sub-suppliers.
3. Verify notification period. Article 5.2 requires a reasonable contractually agreed period for approval or objection. There is no general legal rule of exactly 30 days. Let the responsible person establish the final response time based on the actual contract.
4. Assess the risk of the change. Investigate concentration, continuity, security, data localization, sub-suppliers' resources as well as access, inspection and audit rights.
5. Request necessary additional information. Ask the main supplier to document the chain and the actual effect of the change. The financial firm retains responsibility even if the supplier has performed its own risk assessment.
6. Make and communicate a competent decision. If the risk exceeds risk appetite/tolerance, the financial entity shall, according to Article 5.4, inform the supplier, object and request modifications before the end of the period. Save actual proof of sending and receipt.
7. Follow up on implementation and possible exit. Check the actual implementation date. Assess Article 6 and DORA Article 28.7 as well as the own contract before termination or migration.

What do DORA and Regulation (EU) 2025/532 say?

Article 3, 2025/532: the financial entity shall perform relevant assessments of sub-suppliers that support critical or important functions. Relying on the ICT supplier's due diligence does not exempt the company from ultimate responsibility.

Article 4: the contract shall identify which relevant ICT services may be outsourced to sub-suppliers and under what conditions. Any necessary contractual adjustments shall be implemented in time and planned in a documented manner.

Articles 5.1–5.3: material changes shall be notified in good time so that the company can assess risk and the supplier's ability to fulfill the contract. A reasonable contractually agreed objection period shall exist. The supplier may implement the change when the financial entity has approved it or has not objected by the end of the period according to the applicable contract and regulations.

Article 5.4: if the change exceeds the established risk tolerance, the company shall before the end of the period communicate its assessment, object and request changes. This is not the same as a system automatically determining the risk.

Article 6: the contract shall contain termination rights, including if the supplier implements the change despite objection, implements it prematurely without approval or outsources relevant services without the contract expressly allowing it. This is a conditional contractual right – not an automatic rescission. Also check Article 28.7 in DORA.

Primary sources: Commission Delegated Regulation (EU) 2025/532 and DORA (EU) 2022/2554. See the European Commission's list of implementing acts.

Difference from Mallbutiken's general DORA package

DORA ICT Supplier Contract & Compliance Template Package 2026 covers broad contract management and regulatory compliance. This special product solves a more delimited work step: an actually notified change in the sub-supplier chain, with assessment, response within the agreed time, objection and separate exit review. For a general IT change request, there is also IT Change Request & Change Management.

Frequently Asked Questions

Must all sub-supplier changes be approved under DORA?

No. These specific rules concern ICT services that support critical or important functions or substantial parts thereof and relevant material changes. Review the actual service, impact and contract.

Is the objection period always 30 days?

No. The Regulation requires a reasonable notification period in the contract. There is no universally prescribed 30-day period. Such a period only applies if it follows from the relevant contract and is applicable.

What do we do if the risk assessment exceeds the risk appetite?

Article 5.4 states that the company shall inform about its risk assessment, object and request changes before the contractually agreed end of the period. This shall be done by the competent function and documented.

Can we terminate the contract if the change has already been made?

Article 6 states contract-based termination possibilities in specified situations. Check the contract, actual sequence of events, risk and continuity and let the responsible legal counsel review the measure. Not every implemented change gives an automatic right of termination.

Can the supplier's risk investigation replace ours?

No. The Regulation states that the financial entity is not exempted from its ultimate responsibility just by relying on the supplier's due diligence.

Can Excel automatically calculate a legally correct objection period?

No. The workbook records the period that a responsible person has established after contract review; it does not calculate the contractual deadline or approval itself.

Are all documents in English?

No. Five work templates, a Swedish guide and Excel are in Swedish. A separate English User Guide describes the use, but does not constitute a full translation of the work templates.

Are the PDF files fillable?

No. They are searchable and printable A4 copies of the Word documents, not PDF forms with interactive fields.

Version, source control and limitations

Version 1.0 – November 9, 2026. Legal source control has been performed with official EU legal acts and technical file review of DOCX, PDF and XLSX. No external lawyer, supervisory authority or independent ICT auditor has reviewed or approved the material. The templates cannot send contract messages, verify a sub-supplier's actual security or approve a termination decision. Use them as administrative documentation for separate expert and competent review.