Europe & regulation
DORA
Since January 2025, DORA has required banks, insurers and other financial entities to manage their ICT providers rigorously. Univerx is designed to supply the documents you need for that.
At a glance
- Designed for
The platform is built toward the requirement. Evidence such as an attestation does not exist yet – we name it as soon as it does.
- On request
The documents exist. You receive them for your review through the contact form.
- Available
Met and evidenced. We assign this level only once the evidence exists.
- Service description with service levelsOn request
- List of sub-processors with locationsOn request
- Information for your register of informationOn request
- Description of export and data returnOn request
- Technical and organisational measuresOn request
#What DORA covers
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, DORA for short, has applied since 17 January 2025. It addresses banks, insurers, investment firms, payment institutions and other financial entities.
DORA rests on five pillars: ICT risk management, incident handling and reporting, digital resilience testing, ICT third-party risk management and information sharing. For Univerx as a provider, the fourth is the one that matters most.
#Your customer service as an ICT service
A cloud platform for customer contact is an ICT service under DORA. Advice, complaints, claims and collections run through it. If it goes down, your customers notice at once.
That puts Univerx into your third-party risk management: into the risk assessment before signing, into the register of information during the term, and into your exit plan at the end.
#What Univerx contributes
| Requirement | Article | What Univerx contributes |
|---|---|---|
| Risk assessment before signing | Art. 28 | Technical and organisational measures, list of sub-processors |
| Register of information | Art. 28(3) | Details of service, locations and subcontractors |
| Minimum contract contents | Art. 30 | Draft contract checked against your checklist |
| Exit strategy | Art. 28(8) | Description of export and data return |
| Incident reporting | Art. 19 | Agreed reporting lines to your organisation |
Each contribution is a document on request or a design goal. We state the position for your case in the offer.
#Critical or important functions
If an ICT service supports a critical or important function, Art. 30(3) asks for more: service levels with precise performance targets, tested contingency plans, participation in testing, and unrestricted rights of access, inspection and audit.
Whether your customer service falls into that category is your call. Collections or claims intake are closer to it than product advice. Univerx is designed to support either classification.
#How to prepare the assessment
The earlier the documents are in house, the less hangs on the contract at the end. A fixed sequence that procurement, information security and the business work through together has proved its worth.
Settle before deciding
Banking & financial services and Insurance show what this looks like in your industry. The technical basis is described in Security & availability.
#Sources
- Regulation (EU) 2022/2554 (DORA) on EUR-Lex.
- Art. 28 (general principles), Art. 30 (key contractual provisions) and Art. 19 (reporting of major ICT-related incidents).
Products
Where the topic applies.
The product families this topic matters most for.
Univerx Cloud
One cloud for every customer contact.
- EU
- BSI C5
- NIS2
Univerx Contact Center
Every contact in the right queue.
- DSGVO
- BFSG
- EU
Univerx AI
AI that resolves requests and backs up people.
- AI Act
- DSGVO
- EU
Univerx Trust Center
Security and regulation as a design principle, not an appendix.
- DSGVO
- EU
- AI Act
- BSI C5
- eIDAS
- NIS2
- DORA
- BFSG
Trust & Europe
Every topic in the trust center.
Every topic carries a status. It tells you what is a design goal, which documents you can request and what is evidenced today.
| Topic | Status |
|---|---|
| GDPR | On request |
| Data residency & hosting in Germany | Designed for · German hosting planned |
| EU AI Act | Designed for |
| BSI C5 | Designed for · goal, no attestation |
| eIDAS & online ID | Designed for |
| NIS2 | Designed for |
| DORA | Designed for |
| European Accessibility Act | Designed for · WCAG 2.1 AA as a goal |
| Responsible AI | Designed for · principles & controls |
| Security & availability | Designed for |
| United States: HIPAA, PCI DSS, SOC 2, TCPA, CCPA | Designed for |
Frequently asked questions
Does DORA apply to our customer service?
DORA applies to your ICT services as a whole, and a cloud contact centre platform is one of them. Whether it supports critical or important functions is something you assess in your risk analysis.
What is the register of information?
Under Art. 28(3), financial entities keep a register of all contractual arrangements on ICT services. Univerx compiles the information for it on request.
Which contract terms does DORA require?
Art. 30 lists minimum contents, including a service description, data processing locations, access and audit rights, termination rights and exit strategies. We check the contract against your checklist.
Does NIS2 apply alongside DORA?
For financial entities, DORA takes precedence as the more specific law. NIS2 becomes relevant mainly if group companies operate in other sectors.
Related
Trust & EuropeNIS2
NIS2 obliges companies in essential sectors to manage risk, report incidents and secure their supply chain. Univerx is a link in that chain and is designed to support your duties with documents and clear reporting lines.
Trust & EuropeSecurity & availability
Encryption in transit and at rest, identity and access management, network and API security, multi-zone availability and continuity plans: what Univerx is designed for so your customer service keeps running.
Trust & EuropeGDPR
Processing under Art. 28 GDPR, documents for your data protection impact assessment, retention and deletion policies and role rights. What exists you receive on request; what is a goal we call a goal.
Trust & EuropeData residency & hosting in Germany
The goal: data and media stay in the EU region you choose. Hosting in Germany is planned. What lives where, and who can reach it, is set out in documents you receive on request.
Guides2 November 2026 · 11 min readRunning a contact centre in Europe
What the GDPR, the EU AI Act and German co-determination mean for routing, recording and analytics – and how to answer the questions from procurement, privacy and the works council before the first contact runs on a new platform.
Europe & regulation1 November 2026 · 5 min readData residency: the five questions procurement and privacy ask
"The data stays in Europe" is a good start, but not an answer. Five questions procurement and privacy teams follow up with, and what makes an answer reliable.
Europe & regulation2 November 2026 · 4 min readConsent in outbound: what German competition law means for campaigns
Consent first, contact second. What German law requires and how a campaign keeps to it every day.
GlossaryDORA
DORA requires banks, insurers and other financial entities to withstand digital disruption, report it and manage their ICT service providers. For customer service, third-party risk matters most.
GlossaryNIS2
The NIS2 directive obliges companies in many sectors to manage cyber risk, report incidents quickly and secure their supply chain. Service providers such as a contact centre platform are part of that supply chain.
See Univerx on your own example.
In a demo we show the platform along your channels and requests, from AI agents to video, workforce scheduling and analytics.
Online, in German or English, with no preparation on your side.