2025 was the year EU regulation finally caught up with B2B procurement. DORA (Digital Operational Resilience Act) is now in force for financial services. NIS2 applies to essential and important entities in healthcare, transport, energy, public administration and several other sectors. GDPR has been there for seven years but the enforcement intensity has roughly tripled in the last 18 months. The practical effect: every vendor evaluation is now also a compliance check. Here's the working checklist.
The four questions you have to answer before you sign
For every vendor you're about to sign with — particularly any vendor that processes personal data, supports critical operations, or has access to your network — answer these four questions, in writing, before the contract is final:
- What regulations apply to this vendor relationship? Map to GDPR (if any personal data), DORA (if you're a financial entity and they're an "ICT third-party service provider"), NIS2 (if you're a covered entity and they support an essential service), SOC2 / ISO 27001 / HIPAA / sector-specific.
- Does the vendor's documentation address each applicable regulation? Specifically, by name. "We are GDPR-compliant" is not enough — you need explicit reference to the controller-processor relationship, sub-processor list, data residency commitments, breach notification SLA.
- Are the contractual commitments backed by certification? SOC2 Type II report, ISO 27001 certificate, DORA register of information, current and dated. Promises without certification mean nothing.
- What's your exit / portability story? All three regulations require that you can transition away from the vendor in a controlled way. The vendor's contract must support that.
The clauses that have to be in the contract (not just in marketing)
Marketing pages say everything is compliant. Contracts often say less. The compliance-relevant clauses to actively look for:
- Data Processing Agreement (DPA) — signed addendum, not just a reference to a webpage. Includes Art. 28 controller-processor terms, sub-processor list, technical and organisational measures, audit rights.
- Breach notification SLA — explicit time commitment (best practice ≤ 72 hours), with named contact channels.
- Data location commitment — for EU customers, a written commitment to keep customer data + metadata in EU regions for the proposed workloads. If the vendor uses third-country processors, an SCC (Standard Contractual Clauses) reference + transfer impact assessment.
- DORA-specific (financial entities only): subordination of the contract to applicable financial regulation, specific assessment of concentration risk, exit and substitution strategies, in-scope rights of audit.
- NIS2-specific (essential / important entities): incident reporting cooperation, vulnerability handling, security testing access.
- Right to audit — or at minimum the right to receive current SOC2 / ISO audit reports under NDA.
- Termination for compliance failure — customer has the right to terminate if the vendor loses a required certification.
Where vendors usually fall short
In our experience across procurement evaluations, the most common gaps are:
- DPAs that reference an external URL rather than including the terms in the contract.
- Breach notification "as soon as reasonably practicable" instead of a hard SLA.
- Data residency commitments that exclude metadata (operational logs, support tickets, billing data).
- Audit rights limited to "vendor's SOC2 report once a year" — without right to ad-hoc audits in case of incident.
- Sub-processor lists out of date or undisclosed.
- DORA "register of information" requirements ignored entirely by vendors who haven't realised they're caught.
Automating the check
Running this checklist manually on every vendor proposal takes 30–60 minutes per document. Across an RFP with 5 candidates, that's a half-day of legal time per cycle. An AI vendor analysis tool with explicit compliance prompts can flag each of these gaps in seconds — surfacing not "the contract is compliant", but "the contract addresses 4 of 7 expected GDPR commitments, with the following gaps: no explicit breach notification SLA, no audit rights, sub-processor list incomplete."
POCsheet can be configured (via the Negotiation Playbook feature) to include compliance positions specific to your regulated industry. The AI then evaluates every vendor against the same rigor, every time. You stop missing things because you were tired or rushed.
What to do this quarter
- List every active vendor that processes personal data, supports a critical operation, or has network access.
- Map each to applicable regulations (DORA / NIS2 / GDPR / sector-specific).
- Pull the current contract for each and run it through the 7-clause check above.
- Flag any vendor missing more than 2 critical clauses. Those become priority renegotiations at next renewal.
- Build a playbook of your standard compliance positions. Apply to every future contract.
Doing this systematically once a year — at minimum — is the difference between procurement that meets the regulator's bar and procurement that's exposed when the audit comes.