# DORA and your AI vendor: what Article 30 asks for

URL: https://munito.ai/solutions/dora

What DORA Article 30 asks of an ICT third-party contract, and where each answer is: the locations, the DPA, the sub-processors, the exit plan. Open weights cut concentration risk.

## DORA asks about the contract, not the model

Since January 2025, a European financial entity has had to hold its ICT third-party arrangements to [Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng). An AI vendor is one of those arrangements, and the questions arrive from your risk team long before anyone asks about model quality.

This page sets out what DORA asks of such a contract and what Munito AI supplies today. We are an ICT third-party service provider to you; the regulated entity is you, and the obligations are yours. Nothing here is legal advice.

## What Article 30 asks for, and what we give you

[Article 30](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng#art_30) lists what every ICT contract must state. Read it with your own counsel; this is where to find each answer on our side.

| Article 30 asks for                                  | Where our answer is                                                    |
| ---------------------------------------------------- | ----------------------------------------------------------------------- |
| A clear description of the service                   | [Models and prices](https://docs.munito.ai/models), and the order form   |
| The locations where the service is provided and data processed | [Regions](https://docs.munito.ai/regions), and the `munito-region` header of every response |
| Data protection terms                                | [The DPA](https://legal.munito.ai/dpa), which forms part of the Terms    |
| Sub-contracting, and notice before a change          | [The sub-processor list](https://trust.munito.ai/subprocessors), by region, with notice in the DPA |
| Access, inspection and audit rights                  | The contract; our engineers answer your risk team directly               |
| Incident assistance, at no extra cost                | The support terms of your plan                                           |
| Termination rights and an exit plan                  | The contract, and the portability below                                  |
| Service level descriptions and targets               | The order form of a committed contract                                   |

## Residency, answered in one call

A request to `https://api.eu.munito.ai` runs in the EU, and the response says so in the `munito-region` header. Your workspace stores content in one data region, EU or US, fixed at sign-up.

That is a residency answer your team can test rather than take on trust, which is worth more in a register of information than any paragraph.

## Concentration risk is the argument for open weights

DORA makes you think about what happens when one provider fails or leaves. A closed model is the hard case: the weights are not yours, no one else serves them, and an exit is a rewrite.

Open weights invert that. The same model runs at another provider, on your own GPUs, or on-premises, through the same OpenAI- or Anthropic-shaped API. Your exit plan is a base URL and a capacity decision, and you can rehearse it.

| Scenario                  | With a closed model          | With open weights on Munito AI              |
| ------------------------- | ---------------------------- | --------------------------------------------- |
| The provider raises prices | Renegotiate or rewrite       | Move the model, keep the code                  |
| The provider fails         | The capability stops         | Run the same weights elsewhere                 |
| The regulator asks for an exit test | Hard to rehearse     | Point a base URL at a second deployment        |

## Register of information

Your register needs the legal entity, the function supported, the locations, and whether the service supports a critical or important function. Munito AI France, a French SAS in Paris, is the contracting entity and the one the DPA names. The sub-processor list gives the chain by region, and [Regions](https://docs.munito.ai/regions) gives the processing and storage locations.

Whether the function is critical or important is your assessment, not ours, and it changes what the contract must contain.

## What we do not have yet

Our SOC 2 audit and ISO 27001 certification work are in progress. Neither is finished, and we will not imply otherwise in a tender response.

We are not designated a critical ICT third-party provider; that designation belongs to the European Supervisory Authorities and applies to a small number of firms. If your assessment places us in a critical function, say so early, because it changes the contractual terms you need from us.

## Start

- [Collect the documents for the review](https://munito.ai/security-review)
- [See the workloads a bank runs](https://munito.ai/solutions/fintech)
- [Read the DPA](https://legal.munito.ai/dpa)
- [Talk to an engineer](https://munito.ai/contact) about your register, your assessment and your exit plan