Article 28 and the implementing standard
What actually goes in each field
Article 28(3) requires the register. What actually goes in each field is set by implementing regulation (EU) 2024/2956, which is the document to work from:
- Every contractual arrangement for ICT services, with the function it supports and the assessment of whether that function is critical or important.
- The provider identified by LEI or EUID, and the ICT service supply chain including the subcontractors that actually deliver.
- The country the service is provided from, and the country where data is at rest and where it is processed.
- Whether an exit plan exists, and how substitutable the provider is: the field that is hardest to answer honestly and most revealing when you do.
- The link back to the contract itself, so the register and the agreement cannot silently drift apart.
The register is also a continuing obligation rather than an annual filing, and it sits alongside article 28 duties that never appear in the submission at all: pre-contractual due diligence, concentration risk, and exit strategies.
Where this comes from
This page is an extract, and the note is the source
Every line above is taken word for word from DORA in practice, which carries the collection dates, the incident clock, the testing programme, article 30, and the primary sources these fields come from. Nothing here is behind a form and nothing is collected from you; the page exists so the field list can be printed and taken into a meeting.
This page is a practitioner summary, not legal advice. We do not opine on your legal position, we do not classify your functions for you as a matter of law, we do not represent you before the CSSF, and we certify nothing.
Regulation notes
Or start from what is on your desk.
The practitioner pages: dated, sourced, and written for engineers and risk officers rather than for search engines.