DORA asks about the contract, not the model
Since January 2025, a European financial entity has had to hold its ICT third-party arrangements to Regulation (EU) 2022/2554. An AI vendor is one of those arrangements, and the questions arrive from your risk team long before anyone asks about model quality.
This page sets out what DORA asks of such a contract and what Munito AI supplies today. We are an ICT third-party service provider to you; the regulated entity is you, and the obligations are yours. Nothing here is legal advice.
What Article 30 asks for, and what we give you
Article 30 lists what every ICT contract must state. Read it with your own counsel; this is where to find each answer on our side.
| Article 30 asks for | Where our answer is |
|---|---|
| A clear description of the service | Models and prices, and the order form |
| The locations where the service is provided and data processed | Regions, and the munito-region header of every response |
| Data protection terms | The DPA, which forms part of the Terms |
| Sub-contracting, and notice before a change | The sub-processor list, by region, with notice in the DPA |
| Access, inspection and audit rights | The contract; our engineers answer your risk team directly |
| Incident assistance, at no extra cost | The support terms of your plan |
| Termination rights and an exit plan | The contract, and the portability below |
| Service level descriptions and targets | The order form of a committed contract |
Residency, answered in one call
A request to https://api.eu.munito.ai runs in the EU, and the response says so in the munito-region header. Your workspace stores content in one data region, EU or US, fixed at sign-up.
That is a residency answer your team can test rather than take on trust, which is worth more in a register of information than any paragraph.
Concentration risk is the argument for open weights
DORA makes you think about what happens when one provider fails or leaves. A closed model is the hard case: the weights are not yours, no one else serves them, and an exit is a rewrite.
Open weights invert that. The same model runs at another provider, on your own GPUs, or on-premises, through the same OpenAI- or Anthropic-shaped API. Your exit plan is a base URL and a capacity decision, and you can rehearse it.
| Scenario | With a closed model | With open weights on Munito AI |
|---|---|---|
| The provider raises prices | Renegotiate or rewrite | Move the model, keep the code |
| The provider fails | The capability stops | Run the same weights elsewhere |
| The regulator asks for an exit test | Hard to rehearse | Point a base URL at a second deployment |
Register of information
Your register needs the legal entity, the function supported, the locations, and whether the service supports a critical or important function. Munito AI France, a French SAS in Paris, is the contracting entity and the one the DPA names. The sub-processor list gives the chain by region, and Regions gives the processing and storage locations.
Whether the function is critical or important is your assessment, not ours, and it changes what the contract must contain.
What we do not have yet
Our SOC 2 audit and ISO 27001 certification work are in progress. Neither is finished, and we will not imply otherwise in a tender response.
We are not designated a critical ICT third-party provider; that designation belongs to the European Supervisory Authorities and applies to a small number of firms. If your assessment places us in a critical function, say so early, because it changes the contractual terms you need from us.
Start
- Collect the documents for the review
- See the workloads a bank runs
- Read the DPA
- Talk to an engineer about your register, your assessment and your exit plan