DORA adds no line of its own to a cloud bill, but several of its duties cost money: a register of information with a cost figure per contract, Article 30 contract clauses, tested exit plans, resilience testing, and logs and backups good enough to support an incident report. To budget DORA cloud costs, map each duty to a cost line, a data source and an owner. Below are a cost-line table, a review sequence and questions for your adviser. None of it is legal advice.
Who applies DORA and who is affected indirectly
Regulation (EU) 2022/2554 has applied since 17 January 2025 (Article 64). It binds the financial entities in Article 2(2): credit, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and others. Article 2(3) excludes insurance intermediaries that are micro, small or medium-sized enterprises, which covers some insurtechs. In Germany BaFin supervises, supported by the Financial Market Digitalisation Act (FinmadiG, BGBl. 2024 I No. 438).
Small and non-interconnected investment firms and exempted payment and e-money institutions, among others, use the simplified framework in Article 16, but Articles 28 to 30 still apply; Article 4 proportionality sets the depth.
A SaaS company selling to banks or insurers is an ICT third-party service provider. BaFin's DORA FAQ says the regulation applies only to financial entities and reaches providers indirectly, through contract terms. Direct supervision starts only with designation as a critical ICT third-party provider. The European Supervisory Authorities published the first list on 18 November 2025: 19 providers, including Amazon Web Services EMEA Sarl, Google Cloud EMEA Limited and Microsoft Ireland Operations Limited. According to BaFin, oversight of a designated provider does not relieve financial entities of their own duties, such as auditing that provider where required.
Where DORA creates cloud cost
The register of information and its cost field
Article 28(3) requires a register of all contractual arrangements for ICT services. The templates in Implementing Regulation (EU) 2024/2956 include the mandatory field B_02.01.0050: the annual expense or estimated cost of each arrangement for the past year, with no double counting between overarching and subsequent arrangements. BaFin expects the register yearly, reflecting 31 December, by 31 March at the latest through its reporting platform (MVP).
Someone must derive spend per contract from invoices and cost exports. Marketplace purchases appear on the AWS or Azure invoice but have another counterparty and need their own register line.
Article 30 contract clauses
Under Article 30(2), every ICT contract needs, among other things, the locations where data is processed and stored with advance notice of changes, data return, incident assistance "at no additional cost, or at a cost that is determined ex-ante", cooperation with authorities, and termination rights with minimum notice periods. Where the service supports a critical or important function, Article 30(3) adds quantitative service levels, participation in the entity's TLPT, unrestricted rights of access, inspection and audit, and exit strategies with a "mandatory adequate transition period".
AWS offers eligible customers a DORA Financial Services Addendum through the account team; Google Cloud says its updated terms address Article 30. The cost line is the legal review of whether those texts fit your case.
Exit strategies and exit plans
For ICT services supporting critical or important functions, Article 28(8) requires exit strategies. Exit plans must be comprehensive, documented, sufficiently tested and reviewed periodically. A rehearsal costs data transfer, a target environment, parallel running and migration work.
The EU Data Act removes only part of that. From 12 January 2027, providers may not charge switching charges for the switching process (Article 29 of Regulation (EU) 2023/2854). Standard service fees remain, so parallel running is still paid. See EU Data Act: plan cloud switching costs before 2027 and, for the transfer lines, AWS data transfer costs explained: CUR, NAT and flow logs.
Concentration risk
Before contracting for a critical or important function, Article 29 asks whether the provider is not easily substitutable and requires the entity to "weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers". DORA requires that weighing, not a second cloud. A standby region or second provider is a decision with running costs; budget it with its rationale.
Testing, backups and incident reporting
Except for microenterprises, Article 24(6) requires appropriate tests at least yearly on all ICT systems and applications supporting critical or important functions. Threat-led penetration testing (TLPT) every three years applies only to entities the authority identifies; the default criteria in Delegated Regulation (EU) 2025/1190 include systemically important banks and payment institutions above EUR 150 billion of payment transactions in each of the two preceding years.
Article 12 requires backup policies and, when backups are restored using own systems, ICT systems physically and logically segregated from the source. Delegated Regulation (EU) 2024/1774 requires documented logging procedures, including a retention period. Under Delegated Regulation (EU) 2025/301, the initial notification of a major incident is due within four hours of classification and no later than 24 hours after becoming aware of it, the intermediate report within 72 hours of the initial notification, and the final report within one month after that. Without protected logs, those deadlines slip.
Cost lines for the budget and the register
| Duty | Cost line | Where it shows up | Cadence | Owner |
|---|---|---|---|---|
| Register, Art. 28(3) | Map accounts to contracts, derive spend, submit | internal time | yearly | Finance and compliance |
| Contracts, Art. 30 | Review, renegotiation, addenda | legal fees | at signing and on change | Legal and procurement |
| Exit plan, Art. 28(8) | Egress, target environment, parallel running, migration work | data transfer lines, a second account, person-days | per rehearsal | Engineering |
| Concentration, Art. 29 | Assessment, standby if chosen | second region or provider lines | ongoing, if decided | Management |
| Backup, Art. 12 | Segregated copies, restore tests | backup storage, snapshots, cross-region transfer | ongoing | Engineering |
| Testing, Art. 24 to 26 | Test environment, external testers, TLPT if identified | compute in test accounts, supplier invoices | yearly, TLPT every three years | Security |
| Logs and reporting, Art. 17 to 19 | Log ingestion, retention, on-call | CloudTrail, Log Analytics, Cloud Logging | ongoing | Platform team |
Check retention defaults first. Azure Log Analytics keeps most tables for 30 days by default and can extend total retention to 12 years, billed by data volume and days retained. Google Cloud Logging's _Default bucket keeps logs for 30 days, configurable from 1 to 3,650 days. AWS CloudTrail delivers the first copy of management events free; further copies, data events and S3 storage are charged.
What SaaS suppliers to financial entities should price in
Each Article 30 clause becomes supplier work. Before your first bank contract, cost these:
- Data location: committed regions and notice duties limit later moves.
- Incident assistance: it must be free or priced ex ante, so put the price in the contract.
- Audit, access and TLPT participation: plan person-days and, if needed, a separate test tenant.
- Transition period: after termination you keep running the service and deliver an export.
- Subcontractors: your cloud provider sits in your customer's chain; Delegated Regulation (EU) 2025/532 governs that subcontracting.
Decide deliberately whether to offer a standard addendum or negotiate each contract.
A five-step review sequence
- Classify functions. Compliance decides which functions are critical or important and which cloud contracts support them.
- Fix the cost source per contract. AWS organisation, Azure billing account or Google Cloud billing account, Marketplace items kept separate, plus a tag or label carrying the contract reference.
- Derive last year's spend per contract in the register currency, recording the query and data cut.
- Price the exit scenario as a formula. Data volume × transfer price + months of parallel running × monthly cost of the target environment + person-days × day rate.
- Put the lines into the plan with an owner and review cycle, as in cloud budget planning for 2027.
Common mistakes
- Register value taken from the invoice total: support, Marketplace and tax land on the wrong contract.
- Exit plan reduced to an egress bill: parallel running and rebuilding managed services are missing.
- Multi-cloud by reflex: Article 29 asks for a weighing, not a doubled budget.
- Log retention never set: the incident report lacks data, or cost grows unnoticed.
Questions for your legal adviser and compliance team
- Are we a financial entity under Article 2(2), does an Article 2(3) exclusion apply, or the Article 16 simplified framework?
- Which of our functions are critical or important, and which cloud contracts support them?
- Do our cloud providers' addenda cover Article 30(2) and (3), and which contract type do they require?
- What testing depth does our supervisor expect, and have we been identified for TLPT?
- Which log and backup retention periods does our policy set, and on what basis?
- How would our reporting route change if the Digital Omnibus proposal COM(2025) 837 introduces a single entry point? On 10 October 2026 it is still a proposal.
What Costfluent can contribute
Costfluent reads AWS, Azure and Google Cloud billing data through read-only connections and shows cost by provider, account, service, resource and tag. Allocation rules and segments assign cost to owners, such as the product that carries a critical function, and a saved cost report can go to compliance by scheduled email. That gives the register's cost field a traceable basis; it is not DORA evidence. If you assess Costfluent itself as an ICT supplier, the security page describes the hosting country, access scope and certification status.
Sources and method
Checked on 10 October 2026: Regulation (EU) 2022/2554 (DORA), Implementing Regulation (EU) 2024/2956 on the register of information, Delegated Regulation (EU) 2024/1774 on ICT risk management, Delegated Regulation (EU) 2025/301 on incident reporting, Delegated Regulation (EU) 2025/1190 on TLPT, Delegated Regulation (EU) 2025/532 on subcontracting, ESAs' list of designated critical ICT third-party providers, 18 November 2025, BaFin DORA FAQ, BaFin on the register of information, BaFin workshop on the 2026 register submission, FinmadiG, Data Act, Regulation (EU) 2023/2854, procedure 2025/0360(COD), Digital Omnibus, AWS on DORA, Google Cloud on DORA contracts, Azure Monitor data retention, Cloud Logging retention, AWS CloudTrail pricing. The tables, review sequence and questions are Costfluent recommendations, not legal advice.
