ICT service under DORA: what counts and what does not

What counts as an ICT service under DORA, and who decides

Before a supplier list can feed the register of information or the Article 30 contract clauses, each provider has to be sorted into one question: does it provide an *ICT service* in DORA's sense? Article 3(21) defines ICT services as digital and data services provided through ICT systems to one or more users on an ongoing basis. The Commission describes this definition as intentionally broad, and it is the financial entity that must assess whether each service it relies on qualifies. The answer is the organization's own determination, and an auditor or competent authority will review the reasoning behind it, so the decision needs to be written down, not assumed.

Four facts usually change the answer. The first is whether the service is ongoing: a single static solution with no maintenance, support or updates falls outside the test, while a subscription, support contract or update channel generally brings it inside. The second is whether the provider is itself a regulated financial entity, because the Commission treats a service a regulated entity provides to another regulated entity in connection with financial services as a financial service, not an ICT service, for the third-party rules. Services a regulated entity provides unrelated to its financial services remain ICT services. The third is whether the software runs on the organization's own premises, which is the question the EBA declined to answer in its 2024 Q&A, so it needs a documented position rather than a citation. The fourth is whether the provider sits in the same financial group, which moves it into the intra-group category defined in Article 3(20).

The practical step is to record, for each supplier, the service, whether it is ongoing, the provider's regulatory status, the deployment model and group membership, then the conclusion and the reason for it. An implementation partner can prepare that register of reasoning and the supporting evidence, including a view on self-hosted platforms where the support arrangement is the deciding factor. Confirm the interpretation with your competent authority or legal counsel for any borderline case, because the organization, not the partner, owns the outcome.

How to decide whether a supplier provides an ICT service

This sequence gives the compliance lead a repeatable, documented way to decide which suppliers fall under DORA's ICT service definition, and it leaves a record of each decision that an assessor can follow.

Build the supplier inventory from records
Start with a complete list of suppliers drawn from procurement records, accounts payable, IT asset registers, cloud billing accounts and contract databases. Include free tools and open-source components that are supported under a paid arrangement, because those can appear only in IT or business unit records. The compliance lead owns the inventory, and it is done when each supplier has an owner, a contract reference and a short description of what it delivers.
Test each supplier against the Article 3(21) elements
For each supplier, ask whether it delivers a digital or data service through ICT systems to one or more users. Record whether the output is hardware as a service, hardware with technical support, or a software or data service, and note any analogue telephone service, which the definition excludes. The compliance lead or a delegate completes a short classification record for every supplier, marking each element as met, not met or unclear, with the supporting evidence attached.
Apply the ongoing basis test
Decide whether the service is provided on an ongoing basis. A one-time purchase of an ICT product, or a single static solution with no ongoing maintenance, support or updates, falls outside the register-of-information scope under the ESAs' FAQ, question 94. Check the contract for recurring fees, support entitlements, update channels and hosted components. Mark the supplier as in scope, out of scope or unclear, and move any unclear case to a reviewed exception.
Check the treatment of services between regulated entities
Where the supplier is itself a regulated financial entity, check whether it provides the service to another regulated financial entity in connection with financial services. Under Q&A DORA030, such a service is predominantly a financial service and not an ICT service for DORA's third-party risk rules. Record which regulated entities are involved, the financial service the service supports, and the answer. Keep the rationale with the classification record, because the clarification affects only the third-party risk requirements.
Check whether the service is unrelated to regulated services
Where the supplier is a regulated financial entity, check whether the service is unrelated to or independent of its regulated financial services. Under the same Commission answer, such a service is an ICT service. Document the supplier's regulated activities, the service description and the reasoning for each conclusion. Escalate any service that sits between the two categories to legal counsel, and keep counsel's written view on file with the classification record.
Record the decision with its rationale
Write one classification record per supplier that states the decision (ICT service, not an ICT service, or escalated), the element and test results, the Q&A or FAQ references relied on, the reviewer's name and the date of review. Store the records in the ICT third-party risk documentation so an assessor can trace each decision back to the contract and the definition. The step is complete when every inventory line has a signed-off record.
Route escalations and reviewed exceptions
Send cases the team cannot settle, such as software licences for use on the entity's own premises, to legal counsel or the competent authority's published guidance, and mark the outcome as a reviewed exception. Note that the EBA rejected a 2024 question on software licences in July 2024 because Q&A DORA030 did not address it, so the answer is not settled by published guidance. Confirm the current position with counsel before relying on a licence-based exclusion, and set a review trigger when a contract, product or regulation changes.

Why the ongoing basis test removes many one-time purchases

DORA only treats a supplier as an ICT third-party service provider when the ICT service is provided on an ongoing basis. The ESAs' register of information FAQ, question 94, is explicit that a one-time purchased ICT service is not considered, and neither is a single static solution without ongoing maintenance, support or updates. For a self-hosted platform, this means the first question is not what the software is, but whether anything continues to be delivered after the day it was installed. Start by listing each product your organization runs, then record for each one what, if anything, the supplier delivers after go-live.

The evidence that shows ongoing provision is usually found in the commercial paperwork rather than the product. Look for recurring subscriptions, maintenance or support contracts with fixed renewal terms, update or security advisory feeds that your team depends on, hosted access to a supplier-run service, and managed operations where the provider runs or monitors the system for you. A perpetual licence on its own points one way. A perpetual licence with a paid support renewal that delivers patches, fixes and technical assistance points the other way, because the supplier is then providing an ongoing service alongside the software. Confirm with the supplier exactly what the renewal covers, since the same product can sit on either side of the line depending on the contract.

Because the test looks at what the contract and operating model actually deliver, keep the signed contract, the order forms, the invoices for each renewal, and the current support terms on file. These documents are the basis for your decision and should be dated and reviewed whenever the licence, support tier or supplier terms change. Record the conclusion, the reasons and the documents relied on in your ICT services inventory, and reassess it at each renewal. Ask your legal or procurement team to confirm how DORA's ICT third-party rules apply to your specific licence before you treat any product as out of scope.

Which supplier relationships are hard to classify

Most supplier relationships sort cleanly once the definition is applied, but a few sit on the boundary. The cards below cover the cases where the Commission's answers, the ongoing basis test or the intra-group rules change the outcome, and the question each one should prompt.

Financial entity serving another financial entity

Where a regulated financial entity provides ICT services to another regulated financial entity in connection with financial services, Q&A DORA030 treats the service as predominantly a financial service, not an ICT service, for third-party risk purposes. Ask whether the service is delivered as part of the provider's regulated financial activity or is a technology service sold on its own. Record the reasoning in the assessment, because the clarification is narrow and depends on the facts of each arrangement.

Services independent of regulated activity

A regulated financial entity that sells a service unrelated to, or independent of, its regulated financial services is providing an ICT service under DORA. Software hosting, data processing or platform access offered to another firm can fall here even when the provider is a bank or payment institution. Ask whether the service would still be offered if the provider had no licence, and whether it runs on the provider's ICT systems on an ongoing basis.

Hardware as a service and supported hardware

The ICT service definition expressly includes hardware as a service and hardware services with technical support. A device leased with monitoring, firmware updates or maintenance therefore belongs in scope, while a one-time hardware sale does not. Ask whether the contract includes ongoing support, updates or a managed service, and whether the hardware cannot function as intended without that support.

Intra-group providers and predominant ICT activity

Under Article 3(20), an intra-group ICT service provider is an undertaking in a financial group that provides predominantly ICT services to entities in the same group or institutional protection scheme. The word predominantly is the test. Ask what share of the provider's activity is ICT services to group entities, and whether the group entity is in fact a technology provider or a financial business with an internal technology function.

Open-source software with paid support

Self-hosted open-source software that is installed once and never updated is generally not an ongoing ICT service. Once a vendor sells support, maintenance, security patches or version updates, the relationship is ongoing and the vendor may fall within the ICT third-party service provider definition. Ask who delivers updates, whether the contract covers ongoing support, and whether the licence alone is the only thing purchased. The EBA rejected a question on software licences in July 2024, so this point rests on the ongoing basis test and needs your own analysis.

How common supplier situations are usually classified

This table compares common supplier situations against the classification rules in the supplied DORA sources, with the question to ask and the record to keep for each. The classifications are starting points that usually hold, not conclusions, so each financial entity must make its own determination for its specific contract and service.

Situation	Key question	Likely classification	What to document
One-time purchased ICT service	Is the service delivered once, with no ongoing maintenance, support or updates?	Usually outside the register of information scope, since DORA covers ICT services on an ongoing basis	The purchase record, the delivery terms, and the reason no ongoing element exists
Single static solution with no maintenance or updates	Does the product receive any patches, support or updates after delivery?	Usually not an ongoing ICT service if nothing is provided after delivery; requires assessment if updates arrive later	The vendor's support and update terms, and a dated check that no ongoing element has been added
Hosted or subscription service	Does the provider run digital or data services through ICT systems for the entity on an ongoing basis?	Usually an ICT service and in scope for third-party risk rules	Contract, service description, the provider's role, and the ICT systems it uses
On-premises licensed software with an ongoing support contract	Does the support or maintenance relationship bring the provider's ongoing services into the entity's environment?	Requires assessment; the supplied sources do not settle the software licence question, so the support element is the usual point of analysis	The licence terms, the support contract, and the rationale for the classification adopted
Hardware as a service	Is hardware supplied with ongoing service or technical support?	Usually an ICT service, since DORA's definition expressly includes hardware as a service and hardware with technical support	The service agreement, support scope, and the provider's ongoing obligations
Service between regulated financial entities tied to financial services	Is the service provided in connection with the financial services the provider is authorised to offer?	Usually a financial service rather than an ICT service for third-party risk purposes, per the Commission's answer in Q&A DORA030	The provider's regulated status, the link to financial services, and the reasoning applied
Service unrelated to financial services	Is the service provided independently of the provider's regulated financial services?	Usually an ICT service if it is digital or data-based and provided on an ongoing basis	The service scope showing its independence from regulated activities, and the classification decision
Intra-group ICT provider	Does a group undertaking provide predominantly ICT services to entities in the same group or institutional protection scheme?	Treated as an ICT intra-group service provider under DORA's definition; the provider must still be assessed for its services	The group relationship, the services provided, and how the arrangement is recorded for group reporting

The software licence question DORA has not answered

No published answer settles whether licensing third-party software for use on a financial entity's own premises is an ICT service under DORA. In April 2024 a question put exactly that point to the EBA. In July 2024 the EBA rejected it because the matter was being answered in Q&A DORA030, and that answer does not mention software licences. The practical consequence is that the classification is still the financial entity's own judgment, and it has to be made, recorded and defended without a supplied answer to point to.

Until a regulator or court says otherwise, document the reasoning on both sides. Record the case for treating the licence as an ICT service, which rests on the broad definition in Article 3(21) and the 'ongoing basis' test, and the case against it, which rests on a licence that delivers a static product with no ongoing service. Then check the facts that usually decide the matter: whether the contract bundles maintenance, security updates, vendor support, hosted components, remote administration or a cloud-side element, and whether any of these run on an ongoing basis. Where those elements exist, the analysis of a support contract is covered on the open-source and self-hosted page.

Ask for a view before you rely on your conclusion, especially for a critical or important function. Put the question to your competent authority through your normal supervisory channel, and obtain written advice from legal counsel familiar with DORA. Apply the same test to every supplier, whether the product is commercial, open source or a self-hosted platform with a paid subscription, so that a licence is not treated as out of scope for one vendor and in scope for another. Keep the file with your register of information decisions so that the reasoning can be shown at the next supervisory review.

Who decides, who prepares the evidence and who reviews it

The financial entity carries the legal responsibility. The definition in Article 3(21) is applied to its own arrangements, and the Commission's answer in Q&A DORA030 states that financial entities must assess whether the services they rely on are ICT services. The management body approves the method, and each supplier relationship owner applies it to the contracts and software in their area.

Management body: approves the methodology for deciding what counts as an ICT service and accepts the outcome of borderline cases.
Compliance lead: maintains the classification policy, sets the record format and reruns the review when contracts or product use change.
Procurement and legal counsel: identify licence agreements, support and maintenance terms, one-time purchases and intra-group arrangements, and interpret the contract wording.
Supplier relationship owners: confirm how each product is used, whether it runs on an ongoing basis, and who supplies updates or support.

Some entities take external legal advice on borderline points, but the entity records the conclusion and its reasons.

Check that each named owner can explain, for every supplier, why the arrangement is or is not an ICT service.

Mistakes that pull the wrong suppliers into or out of scope

Most DORA scoping errors come from deciding on the wrong basis: a label, a licence type or a historical assumption rather than what the supplier delivers and whether it does so on an ongoing basis. The cards below cover the errors we see most often, the check that prevents each one, and the record that shows the check was done.

Treating every SaaS tool as an ICT service

Not every hosted product is an ICT service in DORA's sense. The definition turns on whether the service is provided on an ongoing basis, meaning it carries maintenance, support or updates. Check whether the vendor patches, supports or updates the product during the term. Record the answer for each tool in the classification log, with the contract clause or product documentation that supports it.

Excluding a licence because it is perpetual

A perpetual licence can look like a one-time purchase, but a paid support or maintenance renewal brings the supplier back into scope. Illustrative example: a self-hosted platform bought outright with an annual support contract is an ongoing service for as long as that contract runs. Check every renewal line item, not only the licence. Record the support terms and the renewal dates alongside the exclusion decision.

Ignoring services between regulated group entities

Services between regulated financial entities in the same group can be predominantly financial services rather than ICT services, but only where they are provided in connection with financial services. Services that are unrelated to regulated activity remain ICT services. Check the purpose of each intra-group service and whether it supports regulated business. Record the analysis, including which entity provides the service and to whom.

Classifying by contract type, not delivery

A contract labelled as a licence, consultancy or managed service does not settle the question. The test is what is actually delivered to the financial entity: digital or data services delivered through ICT systems, including hardware as a service. Check the delivered functions, the systems involved and who operates them. Record a short description of the delivered service beside the contract reference, so the classification rests on substance.

Failing to revisit classifications at renewal

A supplier outside scope at signing can move into scope when the product changes, a support tier is added, hosting moves to the provider, or a renewal adds updates. Set a trigger to reassess at every renewal, change order and material change in the service. Record the date of each review, the reviewer and any change to the classification.

Leaving no written rationale for an exclusion

An exclusion that exists only as a blank cell in the register cannot be defended to a supervisor. The Commission's answer places the responsibility for assessing whether a service is an ICT service on the financial entity itself. For every supplier excluded from scope, write a short rationale covering the delivered service, the ongoing element test and the date. Have it approved by the owner of the ICT third-party risk process.

Questions buyers ask about ICT services under DORA

Who decides whether a supplier provides an ICT service under DORA?

The financial entity decides, and it cannot delegate the accountability. The Commission's answer in Q&A DORA030 states that financial entities are responsible for assessing whether the services they rely on are ICT services, and it describes the definition as intentionally broad. An implementation partner can prepare the inventory, apply the definition to each contract and document the reasoning, but the organization owns the outcome and must be able to defend it to its competent authority. Ask any partner to show the written method and the sign-off record before work starts.

Does a one-time purchase of ICT software need to go in the register?

Generally no, if it is a one-time purchase with no ongoing basis. The ESAs' register of information FAQ (question 94) states that only ICT services provided on an ongoing basis are in scope, and it gives the example of a single static solution without ongoing maintenance, support or updates. The test is therefore whether the arrangement continues through maintenance, support, hosting or updates. Confirm each case against the contract terms, because a purchase that bundles updates or support may be treated differently from a bare licence.

How much effort does the ICT service classification take, and what drives it?

No supplied source gives a duration for this exercise, so confirm the estimate against your own inventory. The effort is driven mainly by three factors: the number of suppliers and contracts to review, the complexity of each contract (bundled licences, hosting, support tiers and subcontracting chains), and the group structure, since intra-group arrangements need separate treatment. Effort falls when contract data is already centralized and rises when legal, procurement and IT hold separate records. Ask any quote to state the number of contracts in scope and the review method for each.

Does a support contract change how a licensed product is classified?

It can. A licence alone may leave software outside the ICT service definition, but a support contract that provides ongoing maintenance, updates or technical assistance brings the supplier's arrangement onto an ongoing basis. The DORA definition explicitly covers digital services provided on an ongoing basis, and the register FAQ treats maintenance, support and updates as the markers of that basis. Review the licence and support agreements together, and record the classification of each separately so that an open-source or self-hosted platform with a paid support contract is assessed on its actual terms.

How should we handle the unanswered question on software licences?

Treat it as an open interpretive point and document your position. In April 2024 a question asked whether licensing third-party software for use on a financial entity's own premises is an ICT service. The EBA rejected it in July 2024 because the matter was being addressed in Q&A DORA030, which does not mention software licences. Your file should therefore record the facts, the reading you applied, the reasons, and a note to revisit the position if guidance changes. Ask your national competent authority or legal counsel whether they expect a particular treatment, and keep that answer on file.

Is an intra-group provider an ICT service provider under DORA?

The arrangement is captured by a separate definition. DORA defines an ICT intra-group service provider as an undertaking in a financial group that provides predominantly ICT services to financial entities in the same group or institutional protection scheme (Article 3(20)). Such arrangements still fall within the ICT services concept where they meet the definition, so they must be identified and assessed. The Commission's Q&A DORA030 also says that a regulated entity providing ICT services to another regulated entity in connection with financial services is predominantly a financial service, which changes the third-party risk treatment. Check each intra-group flow against both points.

What should we give an implementation partner to classify our suppliers?

Provide the material that shows what each supplier actually delivers and how it is paid for. Typically this includes the supplier list, the signed contracts and order forms, licence and support terms, service descriptions, hosting and subcontracting details, intra-group agreements, and any existing register of information entries. Also provide the internal definitions your policy already uses and the name of the person who will approve the classification. The partner prepares the analysis and evidence, but your organization owns the decisions, so the more complete the input, the fewer open questions the review generates.

Can a partner complete the classification without our own staff?

A partner can do much of the analytical work, but it cannot make your decisions or replace accountable staff. Someone inside the organization must confirm which systems are business-critical, explain how services are actually used, approve each classification and own the resulting register and policy. Expect to assign a named owner from legal or procurement, a technical contact for each system, and a sign-off authority. Ask the partner to state in the scope which tasks it performs and which require your staff, so that the division of work is agreed in writing.

How DeployOpen prepares the classification evidence

DeployOpen helps financial entities and their ICT providers document why each supplier relationship does or does not count as an ICT service under DORA. The work covers the software, hosting and support arrangements inside your own infrastructure, and the written record of how each one was assessed. Your organization owns the classification decision, and an independent auditor or supervisor reviews it.

How we scope

Engagements are fixed-scope, with the suppliers, systems and contracts to review agreed in writing before work starts.
We list each supplier relationship and record whether it involves ongoing maintenance, support, updates or hosting.
The written scope names who makes the final classification decision inside your organization, usually legal, compliance and the ICT owner.

How we build

We map each self-hosted open-source platform to its software licence, any paid support contract and any managed service around it.
We separate one-time purchases from services delivered on an ongoing basis, using the Article 3(21) test as the reference point.
We flag intra-group and regulated-to-regulated arrangements so the reasoning behind their treatment is written down and reviewable.

How we hand over

You receive a classification record for each relationship, showing the facts relied on and the reasoning applied.
Records are structured so they can feed your register of information and the ICT third-party policy, which we do not complete on your behalf.
We confirm with you which points still need a written answer from the supplier, your legal team or the competent authority.

How we support

Ongoing support, upgrades and reviews can be covered by a retainer when suppliers, contracts or your product mix change.
Re-classification is triggered when a support contract is added, removed or materially altered, and we update the record accordingly.
Independent auditors and supervisors make the assessment of your compliance. We prepare the evidence they will ask to see.

What counts as an ICT service under DORA