Originally published on moveinfra.eu .

Under Article 28(8) of the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) and Article 10 of Commission Delegated Regulation (EU) 2024/1773, financial entities in the European Union must maintain documented, realistic, and tested exit strategies for every cloud service supporting a critical or important business function. Applicable since January 17, 2025, DORA requires more than a high-level policy statement: companies must document concrete trigger events, verified alternative cloud providers or in-house options, technical data and application migration plans, transition timelines, and contractual termination clauses under Article 30(3)(f), and must review and test these plans periodically.

Key takeaways

Who is affected: Banks, payment institutions, e-money institutions, investment firms, crypto-asset service providers (CASPs), insurers, and other regulated financial entities using cloud services for critical or important functions.

Four…