California software and cloud companies have spent years winning European financial customers. Since January 2025, many of those customers have been asking a new set of questions, and the reason is a five-letter acronym: DORA compliance.
The EU's Digital Operational Resilience Act applies to banks, investment firms, payment and e-money institutions, insurers and many other financial entities across the European Union. It doesn't regulate US tech firms directly in most cases. But it regulates how their EU financial clients choose, contract with and monitor technology providers. If you sell software, data or cloud services to a European financial firm, DORA is now part of your sales cycle.
What your EU clients now have to do
Under DORA, financial entities must manage risk from information and communication technology (ICT), including the risk that comes from their suppliers. In practice, that means your customers must:
keep a register of all their ICT third-party arrangements and report it to their regulator
assess suppliers' security and resilience before signing and throughout the relationship
include specific contractual terms, covering service levels, data location, audit rights, incident support and exit plans, in contracts for ICT services
report major ICT incidents to their regulator within tight deadlines, which often depends on information from you
If your contracts and processes can't support those obligations, your client has a compliance gap. And their procurement team knows it.
The biggest providers are now directly overseen
DORA also created an EU oversight framework for critical ICT third-party providers. In November 2025, the European Supervisory Authorities published their first list of providers designated as critical. Those firms now face direct oversight at EU level.
Most California companies won't be on that list. But the designation shows where regulators are heading: technology suppliers to the financial sector are now part of the regulatory perimeter.
What this means for your sales team
Expect longer, more detailed procurement. European financial clients will send due diligence questionnaires covering security certifications, incident response, subcontractors, data locations and business continuity. They'll ask for contract clauses that let them, and sometimes their regulators, audit you.
Firms that prepare a standard DORA response pack, with policies, certifications, incident procedures and a contract addendum, close deals faster than those who answer every questionnaire from scratch.
Four steps to take now
Identify your EU financial clients and which services you provide them.
Review your contracts against DORA's mandatory provisions, and prepare a standard addendum.
Test your incident process. Can you tell a client within hours what happened, what was affected and what you are doing about it?
Map your own subcontractors. Your clients will ask about your supply chain too.
Who should own this internally
DORA questions land across legal, security, sales and customer success. Without an owner, each team answers differently. Give one person responsibility for your DORA response pack and contract position, and make sure sales knows to bring them in early on any European financial deal.
The opportunity
DORA isn't only a burden. For US tech firms that get ahead of it, it's a competitive advantage. European banks would rather work with suppliers who already speak the language of operational resilience. Being that supplier is a sales argument, and in a crowded market, that's worth having.
Copyright © 2026 California Business Journal. All Rights Reserved.
For California Business Journal Disclaimers, go to https://calbizjournal.com/terms-conditions/.
