Transition to DORA · full framework and Article 16
Building your register of information and submitting it each year
The register of information under Article 28(3) DORA covers all contracts for ICT services and is submitted to BaFin every year. We build the first register with you and then support the annual update and submission. You submit it yourself through your access to BaFin’s reporting platform MVP. Initial build from €8,400 net, annual update with submission support €3,500 net per submission, plus VAT in each case.
Who needs the register, and why is the first one the hardest?
This service covers both frameworks: financial entities under the full framework and under the simplified framework of Article 16 DORA. Under Article 28(3) DORA they maintain a register of information on all contractual arrangements for the use of ICT services provided by ICT third-party service providers, distinguishing those that support critical or important functions. For institutions under Section 1a(2a) of the German Banking Act (KWG group), such as factoring and leasing institutions, Article 28 applies from 1 January 2027, and not at all to microenterprises in that group.
Structure and fields are set by Commission Implementing Regulation (EU) 2024/2956. The register is submitted every year through BaFin’s MVP platform, reflecting the position on 31 December of the previous year. The submission process has to be completed in full and without errors by 31 March at the latest, and the obligation is only met once the European Supervisory Authorities have also validated the register.
Most of the work goes into the first register. Every ICT contract has to be found, including those never treated as outsourcing, because the DORA concept of an ICT service is much wider. Every contract needs the function it supports, and every provider a valid identifier. After that it is a matter of upkeep. What goes into the register and how it is structured is explained on our register of information page with a completion guide (in German). With this service we do the work for you.
What does the service include?
Five building blocks for the initial build, one for each following year. We assume that critical or important functions have already been identified.
Which contracts belong in it?
Contract inventory
From your outsourcing register, supplier list and contract files we record all contractual arrangements for ICT services. The direct provider (rank 1) always, and for services supporting critical or important functions also the subcontractors that effectively underpin the service.
What goes into the register (German)Which function does the contract support?
Mapping to functions
We map each contract to the functions on your function list, so that the register distinguishes contracts for critical or important functions from the rest. Contracts without a clear mapping go on the list of open points with a reason.
Identifying critical functions (German)Who exactly is the provider?
Obtaining identifiers
Providers that are legal persons need a valid and active LEI or EUID. BaFin does not accept a dummy LEI. We check existing identifiers and give you template wording for requests to your providers and, through them, to their subcontractors.
Does everything fit together?
Completion and plausibility check
We fill in the templates under the Implementing Regulation and check them for completeness, consistency and matching keys. We know the typical errors from our completion guide and go through them one by one before handover.
Typical validation errors (German)How does the register stay current?
Upkeep step in the contract process
Changes to ICT contracts go into the register without delay, and the information has to be reviewed regularly. We describe who records what in procurement and contract management, so that the register is not only maintained in March.
What comes back every year?
Annual update and submission support
For the 31 December reference date we reconcile new, changed and terminated contracts, check again and support your submission through MVP until it is accepted. If validation fails, we correct it with you before the deadline. If a data quality feedback arrives in April, we go through it with you.
What you have at the end
We hand over the results as files that you maintain yourself.
01
Contract inventory
All contractual arrangements for ICT services with source, provider, reference number and mapping to functions.
02
Completed register
The templates under Implementing Regulation (EU) 2024/2956 for one legal entity, checked and ready for your submission.
03
List of open points
Missing identifiers, unclear subcontractors, contracts without a mapping, each with an owner.
04
Template wording for providers
Requests for LEI or EUID and for subcontractors in the chain, to be sent by your company.
05
Upkeep guide
Who records what and when, as a step in procurement and contract management, with a date for the annual update.
06
Submission record
In the second stage: course of the submission, validation result, corrections and review of any data quality feedback.
Example: initial build for a leasing institution
This is how the initial build could run at a fictitious leasing institution in the KWG group that is not a microenterprise and falls under Article 28 from 1 January 2027. An example, not a commitment: meetings, the state of the contracts and providers’ response times will shift the plan.
| Period | Phase | Result | Input from the institution |
|---|---|---|---|
| December 2026 | Scoping and documents | Contract sources identified: outsourcing register with 9 entries, supplier list, contract files. Function list approved | Provide documents, name a contact person |
| January 2027 | Contract inventory and mapping | 23 contractual arrangements for ICT services, 6 of them for critical or important functions | Two workshops with procurement, IT and contract management |
| January to February 2027 | Identifiers and completion | Templates filled in, LEI or EUID requested from 4 providers and 3 subcontractors | Send requests to providers |
| February 2027 | Check and handover | Register checked, 2 open points with owners, upkeep step in the procurement process | Sign-off, upkeep from handover |
Fictitious example by Blackfort Technology, no client data and no commitment on dates or results. As far as we know, no source settles when the KWG group first submits a register. The example assumes the register is to be ready for submission from early 2027.
What does the register cost, and where are the limits?
Two stages with a fixed base scope for one legal entity and up to 25 contractual arrangements for ICT services. The PD column shows the effort per building block in person days. Additional legal entities or arrangements are priced after the scoping call.
| Building block | Scope | PD |
|---|---|---|
| Initial build: contract inventory | Recording from your documents, check of existing LEIs and EUIDs, template wording for requests to providers | 1.5 |
| Initial build: mapping to functions and providers | Mapping to your function list, service chains for critical or important functions | 1 |
| Initial build: completing the templates | Templates under Implementing Regulation (EU) 2024/2956 | 1.5 |
| Initial build: plausibility check | Check, list of open points, upkeep guide, handover | 1 |
| Initial build: workshops | up to 4, up to 3 hours each, by video or on site, for example with procurement, IT and contract management | 1 |
| Price of initial build | from €8,400 net plus VAT. Submission is not included, see annual update | 6 |
| Annual update | Reconciliation of new, changed and terminated contracts and identifiers for the 31 December reference date, one meeting | 1.5 |
| Annual update: check | Plausibility check of the updated register | 0.5 |
| Annual update: submission support | Support for your submission through MVP until accepted, correction if rejected | 0.5 |
| Price of annual update | €3,500 net plus VAT per submission | 2.5 |
Offered to businesses only (B2B). PD = person days. One arrangement is anything that receives its own reference number in the register. Additional legal entities, arrangements or a group-level register are priced after the scoping call and stated in our proposal. A gap analysis is not credited against this single service, only against the packages in the “Transition to DORA” series (Transition from BAIT, VAIT, KAIT, ZAIT and BAIT legacy clean-up).
How does the initial build work?
Four phases. How long it takes depends mainly on how quickly contracts are available and providers deliver their identifiers.
1
Scoping and documents
Clarify framework and legal entities, collect contract sources, request the function list and existing identifiers.
2
Contract inventory and mapping
Record contracts, clarify service chains for critical or important functions, map functions.
3
Identifiers and completion
Prepare requests to providers, fill in the templates, follow up open points.
4
Check and handover
Plausibility check, list of open points, upkeep guide and handover of the register.
After that you maintain the register yourself. At the reference date the second stage begins if you commission it. If you have to submit by 31 March, the register should be ready early in the year so that there is time for corrections.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Completion guide, build service or gap analysis?
Our register of information page (in German) explains templates, mandatory fields, identifiers, submission and typical validation errors and offers a completion guide with a sample contract to download. If you want to build the register yourself, start there. With this service we build it with you and support the submission.
The DORA gap analysis shows whether register, function list and contracts fit together and what is missing overall, and ends with an action plan. Our “Transition from BAIT” package and the other transition packages in the series do not include the register. This service complements them.
If your institution belongs to the KWG group
Under Section 1a(2a) sentence 2 no. 3 KWG, Articles 28-30 DORA do not apply to microenterprises in the KWG group. On our reading, the register therefore does not apply to them either, because it is part of Article 28(3). An entity is a microenterprise only if it employs fewer than ten persons and its annual turnover and/or annual balance sheet total does not exceed EUR 2 million. The German text reads “bzw.”, the English “and/or”. Factoring and leasing institutions often exceed the balance sheet threshold. We therefore record your figures at the start and do not assume the status. Our applicability page explains criteria and borderline cases.
This special rule is in the KWG. DORA itself does not exempt microenterprises from the register under Article 28(3). It is still open when the KWG group first submits. Article 28 applies to them from 1 January 2027, and each submission reflects the position on 31 December of the previous year. We have not found a source that settles this. We follow BaFin’s announcements and align the timetable in our proposal accordingly.
Who is responsible for the service
The responsible consultant is Christian Gebhardt, founder and managing director of Blackfort Technology, owner-managed since 2017.
What does your company contribute?
A contact person
For example from contract management, outsourcing management or IT, with access to contracts and cost data.
Function list and documents
Your list of critical or important functions, the outsourcing register, a supplier list and the contracts themselves.
Providers and MVP access
Sending the identifier requests to your providers, and a person with MVP access who submits.
What is not included?
To set expectations:
- No identification of critical or important functions. We work with your function list. If there is none, the classification has to be settled first, for example in the gap analysis or a transition package.
- No contract review and no contract negotiation. Whether your contracts contain the mandatory terms under Article 30 DORA is a separate topic, and wording and review of clauses belong with your legal counsel. No legal advice, including on whether your company has to keep the register.
- No submission on your behalf and no notifications. You submit through your MVP access, and responsibility for the register stays with your company. You make notifications of planned contracts for critical or important functions yourself.
- No upkeep during the year. After handover you record changes yourself. Ongoing support is agreed separately.
- No commitment that validation succeeds at the first attempt, and no commitment on how supervisors or auditors will assess the register. No certificate.
The assessments on this page are general information on the state of DORA, Implementing Regulation (EU) 2024/2956 and the KWG. Whether and how they apply to your company has to be checked in the individual case.
Frequently asked questions
Do we have to keep a register of information at all?+
Yes, if Article 28 DORA applies to you, under the full framework as well as under the simplified framework of Article 16. There is an exception for microenterprises in the KWG group, because Articles 28-30 do not apply to them under Section 1a(2a) KWG. Other microenterprises keep the register. Our applicability page explains whether your company is covered.
Do you submit the register for us?+
No. You submit through your access to BaFin’s MVP platform, and we support the process. The obligation is only met once the European Supervisory Authorities have also validated the register. If validation fails, you upload the corrected register again before the deadline. After 31 March, late submission is no longer possible in the current cycle.
We already have an outsourcing register. Is that not enough?+
It is a good starting point but usually does not cover all ICT contracts. The DORA concept of an ICT service is much wider than outsourcing, and according to BaFin every third-party arrangement with an ICT element has to be assessed. We use your outsourcing register as one of several sources.
Is the first submission part of the initial build?+
The initial build ends with a register ready for submission. Support for the submission belongs to the second stage and is charged per submission. If the initial build falls shortly before the reference date, we set out in our proposal how the two stages fit together.
What if we have more than 25 contracts?+
Then we price the initial build and the annual update after the scoping call. One arrangement is anything that receives its own reference number in the register. A group-level register covering several legal entities is also agreed separately.
Read more
- DORA register of information: structure, mandatory fields, submission
- Classifying critical or important functions under DORA
- ICT third-party risk under DORA: managing providers and Article 30 contracts
- DORA gap analysis: quick check, Article 16 and full framework
- DORA Article 16 transition: moving from BAIT to the simplified framework
- DORA scope: who does DORA apply to, and which framework?
- DORA Article 16: the simplified ICT risk management framework
- ICT risk management under DORA: framework and DOR strategy
- About us: DORA-Readiness by Blackfort Technology, Bonn
Sources
- Regulation (EU) 2022/2554 (DORA), Article 28(3) (retrieved 2026-11-06)
- Commission Implementing Regulation (EU) 2024/2956 (standard templates for the register of information) (retrieved 2026-11-06)
- BaFin: register of information and notification requirements (German) (retrieved 2026-11-06)
- BaFin: FAQs on DORA, section register of information (German) (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA, section 7 (PDF, German) (retrieved 2026-11-06)
- Section 1a German Banking Act (KWG), German (retrieved 2026-11-06)
- Section 65a German Banking Act (KWG), German (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss your register
Tell us briefly which framework applies to your company, roughly how many ICT contracts you have and whether there is an approved function list. In the initial call, by phone or video, we discuss whether the service fits. In the scoping call that follows we agree scope, price and timetable.