Automated DORA Register of Information.
The EU Digital Operational Resilience Act (DORA) requires financial entities to maintain a Register of Information for ICT third-party arrangements. Qgentic parses your contracts and vendor records into the required eleven CSV templates, validates every field against the regulatory rules, and produces the filing package, validation report and audit trail for review and approval.
Supports offline deployment. Includes sample data. Partner integration available.
End-to-End Workflow
Review the system's operational flow: data ingestion, register assembly, identifier validation, user approval, and final package generation. No installation is required to view the demo.
Data integration is covered in the Integration Guide →
Applicable Organisations
EU Financial Entities
Organisations within DORA's Article 2 scope, including banks, insurers, investment firms, and payment institutions.
Global Groups with EU Entities
Non-EU organisations must file for their EU-authorised subsidiaries. The system handles register scoping per authorised entity.
ICT Service Providers
Providers subject to Article 30 contractual obligations. The system supports pre-filled templates (B_05.01, B_02.02, B_07.01).
Organisations exclusively subject to UK regulations should refer to Qgentic OpRes.
Functional Scope within DORA
The system is designed specifically for the Register of Information, automating the data assembly and validation to eliminate manual reporting errors.
✓ Register of Information
Addresses DORA Article 28 requirements for maintaining a register of ICT third-party arrangements. The system processes source data, executes validation rules, and generates the required templates for authorisation.
The system does not address the other four DORA pillars:
Risk Frameworks
Governance and protection functions, which are typically managed via internal GRC tools.
Regulatory Incident Reporting
Classification and reporting of major ICT incidents.
Resilience Testing
Scenario testing and threat-led penetration testing.
Threat Intelligence
Exchange of cyber-threat information between financial entities.
The generated register acts as the primary data source for risk and incident management functions.
Data Pipeline
- IngestionContracts and vendor data are imported via file upload, CSV batch export, or REST API.
- Extraction & VerificationData points are extracted to the required schema. Identifiers and ISO codes are deterministically verified. Data repairs are logged in the audit trail.
- Data CollectionMissing supplier information, such as subcontractor data for critical functions, triggers automated outreach workflows.
- ValidationThe rules engine validates cross-references, date formats, and supply-chain completeness before proceeding.
- Approval & ExportA designated user reviews and approves the package, generating the eleven official CSV templates and cryptographic hashes.
Validation Mechanisms
| Deterministic Logic | AI Operations |
|---|---|
| ISO 17442 LEI checksums (MOD 97-10) | Document processing and parsing |
| ISO 3166 / ISO 4217 code set validation | Data extraction and mapping |
| Cross-template rules execution (B_01.01–B_99.01) | Generating data collection requests |
| Cryptographic audit logging | Information synthesis |
All extracted data must pass deterministic validation rules before inclusion in the final register. The export function enforces strict compliance with the required schema.
Export Specifications
Review the technical specifications by downloading a sample output package.
Register Export
Generates one CSV file per ITS template (B_01.01 through B_07.01), along with a manifest containing SHA-256 hashes and filing indicators. This output is ready for ingestion by your regulatory reporting channel.
Cryptographic Audit Trail
All system actions are logged to a tamper-evident SHA-256 hash chain. The audit data is packaged in a downloadable ZIP archive containing the manifest, approver details, and a run report.
System Boundaries
The system outputs hash-manifested CSV report packages. It does not produce EBA-taxonomy-certified xBRL files. Vendor outreach generates drafts that require integration with your SMTP relay. Approvals are currently managed via the console or API.
Deployment Options
Pilot Implementation
Parallel processing of existing contracts against manual workflows. Costs are credited to annual licences.
SaaS Deployment
Standard cloud deployment model scaled to arrangement volume.
On-Premise Deployment
Annual software licence for air-gapped deployment on internal infrastructure.
Detailed pricing and partner structures are available on the pricing page.
Frequently Asked Questions
What is the DORA Register of Information?
The Register is a structured record of all ICT third-party arrangements mandated by Article 28 of Regulation (EU) 2022/2554. It consists of eleven standardised templates that must maintain internal consistency.
Which entities must file the Register?
Financial entities defined in DORA Article 2. Filings are required per authorised entity, rather than at the group level.
How does DORA affect UK organisations?
UK groups must file for their EU-authorised subsidiaries. UK-only entities are governed by UK operational resilience regulations, supported by Qgentic OpRes.
How are validation errors minimised?
The system enforces deterministic checks on fields such as Legal Entity Identifiers and cross-template references, reducing the likelihood of manual data entry errors.
What is the role of AI in the process?
AI models handle unstructured data extraction and drafting. Deterministic rules manage all regulatory validation checks.
Does the system automatically file with regulators?
No. The system generates a compliant CSV package intended for submission through your established regulatory filing channels after manual approval.
Is offline operation supported?
Yes. The air-gapped edition operates entirely offline on client infrastructure.
What are the export deliverables?
The deliverables include populated CSV templates, a file manifest, and a cryptographic audit log. A sample package is available for review.
Demonstration Environment. The interactive demo processes synthetic data using the core engine, allowing evaluation of validation mechanisms directly within your browser. View the demonstration here.