The DORA Register of Information, built from your records.
The EU Digital Operational Resilience Act (DORA) requires financial entities to keep a Register of Information on their ICT third-party arrangements. Qgentic reads your contracts and vendor records into it, checks every field against the regulatory rules, and produces the xBRL-CSV package across all fifteen ITS templates, each one populated from your records or declared not-reported as the ITS provides. The validation report and audit trail go to a named person for approval.
One run, contracts to export
Contracts and vendor data go in, the register is assembled, every LEI is checked, a named person approves, and the package comes out. It plays in your browser, with nothing to install.
How your data gets in: integration and data.
Who files it
EU financial entities
Firms in DORA's Article 2 scope, including banks, insurers, investment firms and payment institutions.
Groups with EU subsidiaries
A non-EU group files for each EU-authorised subsidiary. Qgentic scopes the register per authorised entity.
ICT service providers
Providers bound by Article 30 contract terms. Qgentic pre-fills templates B_05.01, B_02.02 and B_07.01.
UK-only firms report under the UK operational resilience rules instead: see Qgentic OpRes.
Where it sits in DORA
Qgentic DORA does one job: the Register of Information. It assembles and validates the register, so nobody re-keys it by hand.
✓ Register of Information
Article 28 requires a register of every ICT third-party arrangement. Qgentic reads your source data, runs the validation rules and generates the templates, ready for authorisation.
The other four pillars sit outside it:
Risk frameworks
Governance and protection, usually run in a GRC tool.
Incident reporting
Classification and reporting of major ICT incidents.
Resilience testing
Scenario testing and threat-led penetration testing.
Threat intelligence
Exchange of cyber-threat information between financial entities.
The register it builds becomes the reference data your risk and incident teams work from.
How the register gets built
- IntakeContracts and vendor data arrive by file upload, CSV batch export or REST API.
- Extraction and checksEach data point is mapped to the required schema. Code verifies every identifier and ISO code, and each repair is logged in the audit trail.
- OutreachMissing supplier information, such as the subcontractors behind a critical function, triggers automated outreach to the vendor.
- ValidationThe rules engine checks cross-references, date formats and supply-chain completeness before the run goes on.
- Approval and exportA named person reviews and approves the package, and the xBRL-CSV templates and their cryptographic hashes are generated.
What code decides, and what the model does
| Decided by code | Done by the model |
|---|---|
| ISO 17442 LEI checksums (MOD 97-10) | Document processing and parsing |
| ISO 3166 / ISO 4217 code set validation | Data extraction and mapping |
| Cross-template rules (B_01.01 to B_99.01) | Drafting data collection requests |
| Cryptographic audit logging | Summarising for review |
Nothing the model extracts enters the register until it passes these rules, and the export is checked against the required schema.
What you get
Every file below is in the sample package, ready to inspect.
The register export
One xBRL-CSV file per populated ITS template (the entity, arrangement, provider, supply-chain, function and assessment tables), plus a manifest with SHA-256 hashes and filing indicators, ready for your regulatory reporting channel.
The audit trail
Every action is logged to a tamper-evident SHA-256 hash chain, and the whole trail downloads as one ZIP with the manifest, the approver's details and a run report.
Where it stops
The output is a hash-manifested CSV report package; the xBRL files are not certified against the EBA taxonomy. Vendor outreach produces drafts, which need your SMTP relay to send. Approvals happen in the dashboard or through the API.
What it costs
Pilot
Your existing contracts run in parallel with the manual process. The fee is credited to the annual licence and priced to sit inside a compliance owner's own signing authority.
SaaS
Hosted, and scaled to the number of arrangements in your register.
On-premise
An annual licence to run air-gapped on your own infrastructure. Sealed Site covers one pack at one site, up to 250 arrangements; capacity tiers start at £110K / €120K.
Every edition's price is on the pricing page. Consultancies can also deliver it through the partner programme.
Frequently asked questions
What is the DORA Register of Information?
The Register is a structured record of all ICT third-party arrangements mandated by Article 28 of Regulation (EU) 2022/2554. The Implementing Technical Standards define fifteen standardised templates, from B_01.01 to B_99.01, that cross-reference one another and must stay internally consistent. A firm populates the templates that apply to it.
Which entities must file the Register?
Financial entities defined in DORA Article 2. The register is maintained at entity level and, for groups, at sub-consolidated and consolidated level too: a group files per authorised entity, plus a consolidated view.
How does DORA affect UK organisations?
UK groups must file for their EU-authorised subsidiaries. UK-only entities are governed by UK operational resilience regulations, supported by Qgentic OpRes.
How are validation errors minimised?
Code checks fields such as Legal Entity Identifiers and cross-template references before they enter the register, and nobody re-keys the data by hand.
What does the AI do?
The model reads unstructured documents and drafts. Every regulatory validation check is made by deterministic rules.
Does Qgentic file with the regulator itself?
No. Once a named person approves it, Qgentic produces the xBRL-CSV package, and you submit it through your usual regulatory filing channel.
Can it run offline?
Yes. The air-gapped edition runs entirely offline, on your own infrastructure.
What does the export contain?
The populated xBRL-CSV templates, a file manifest with a SHA-256 hash per file, and a cryptographic audit log. The sample package has all three.
DORA guides
The DORA Register of Information, explained
Who must file, the fifteen ITS templates and what each captures, the four identifiers that have to line up, the Annex III service codes, and the rules that catch the rest.
How to validate an LEI (ISO 17442)
The MOD 97-10 check digit, a worked example, and why a bad LEI fails a DORA register.
DORA ICT subcontracting: mapping the chain
Why the whole chain matters, what the subcontracting table captures, and where concentration risk hides.