AI Governance Engineer
GitHub

DORA Art. 28(3) and 28(8): register of ICT third-party arrangements and exit strategies

Keep a register of information on all contractual arrangements for ICT services from third-party providers, and exit strategies for ICT services that support critical or important functions

By Reviewed

From clause to evidenceThe chain from DORA Art. 28(3) and 28(8) to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: Digital Operational Resilience Act (EU) 2022/2554, Art. 28(3) and 28(8)ClauseDORAArt. 28 and 28Duty holder: Financial entitiesDuty holderFinancialentitiesApplies from: 2025-01-17 (In force)Applies from2025-01-17In forceArtefact: Register entries for AI and model services; exit plan and exit-drill recordArtefactRegisterentries for AI…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from DORA Art. 28(3) and 28(8) to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: Digital Operational Resilience Act (EU) 2022/2554, Art. 28(3) and 28(8)ClauseDORA · Art. 28 and 28Duty holder: Financial entitiesDuty holderFinancial entitiesApplies from: 2025-01-17 (In force)Applies from2025-01-17 · In forceArtefact: Register entries for AI and model services; exit plan and exit-drill recordArtefactRegister entries for AI…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-DORA-ART28. Drawn from chapter 08.
Text alternative
  • Clause: DORA, Art. 28 and 28.
  • Duty holder: Financial entities.
  • Applies from: 2025-01-17, In force.
  • Artefact: Register entries for AI….
  • Layers: Layer 02, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
When this obligation appliesThe date of AIGE-OBL-DORA-ART28 on a time axis, against its review date 2026-09-24.2024202620282030As of 2026-09-242025-01-17 · In force2025-01-17 · In forceSource: Obligation register(chapter 08)
When this obligation appliesThe date of AIGE-OBL-DORA-ART28 on a time axis, against its review date 2026-09-24.2025-01-17 · In force2024202620282030As of 2026-09-242025-01-17 · In forceSource: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-DORA-ART28
DateStepDetail
2025-01-17In force
Id
AIGE-OBL-DORA-ART28
Instrument
Digital Operational Resilience Act (EU) 2022/2554 law
Clause
Art. 28(3) and 28(8)
In scope
Financial entities
Authority
Financial competent authority
Applies from
In force

The artefact that evidences it

Register entries for AI and model services; exit plan and exit-drill record.

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

Source

Chapter 08, section Cyber-security and incident-reporting law, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). DORA Art. 28(3) and 28(8): register of ICT third-party arrangements and exit strategies (AIGE-OBL-DORA-ART28). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-dora-art28. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{DORA Art. 28(3) and 28(8): register of ICT third-party arrangements and exit strategies (AIGE-OBL-DORA-ART28)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-dora-art28},
  note         = {Version 0.5.0}
}