The register of information required under Article 28(3) of DORA is not a document. It is a set of linked tables, B_01.01 through B_07.01 in the implementing technical standard, filed in the format the Authorities publish and validated on receipt. A file that fails validation is not a late filing. It is not a filing.
That single mechanical fact sets where the work goes, and it is not where anyone budgets it.
The interpretation was never the expensive part
We had scoped the first cycle as an interpretation problem: read the standard, decide what counts as a critical or important function, write the policy, fill the tables. Interpretation took days. Records took months. The tables ask for a legal entity identifier for every direct provider, a contractual arrangement reference for every contract, and a function identifier tying both to something the business recognises. Most of the entities I worked with could produce two of the three, and the missing one was rarely the same missing one twice.
The questions supervisors put in writing
Follow-up queries arrived in writing after both filings. Not one of the ones I saw asked how the regulation should be read. All of them asked whether the tables agreed with each other, and the published feedback on data quality reads the same way.
- Why the count of contractual arrangements supporting a critical or important function had fallen while the count of such functions had risen
- Whether the legal entity identifier recorded against a provider belonged to the contracting entity or to its parent
- How the criticality assessment recorded against an arrangement was reached, and who approved it
- Where the exit plan for a critical arrangement was documented, and when it was last tested
- Why a subcontractor supporting a critical function appeared in one group entity's register and not in another's
Where the hours go
A direct provider without a legal entity identifier cannot appear in the register at all. Small suppliers do not hold one and do not want to pay the annual renewal that keeps it current. The longest wait I recorded, from first request to issued identifier, was 11 weeks, for a provider that had never held one. Another had let its registration lapse, so the record returned as retired, which is a validation failure rather than a gap. Neither provider was in breach of anything. The financial entity was the one holding the deadline.
The other consumer of hours is the subcontracting chain. Deciding how far down a chain a subcontractor still supports a critical or important function is a judgement, and the judgement has to be written, dated and owned by a person with a title. Most of the argument in both cycles was about that. It cannot be pushed to the supplier, because the supplier is not the one being supervised.
Nothing in either cycle turned on how the regulation reads. All of it turned on records.
What I told clients that was wrong
I told them the second cycle would be maintenance, at roughly a third of the cost of the first. For the entities where contract variations, renewals and one platform migration had passed through procurement without the function mapping being touched, the second cycle took longer than the first. Nobody had been asked to update the mapping, because the register had been built as a project and closed as a project. I had one cycle of evidence behind that estimate and gave a number anyway.
What we carry into the work here
The method we take into this work comes from those two cycles: the function identifier is attached to the contract at signature rather than reconstructed at filing, one named owner is recorded against each arrangement, and the criticality judgement is dated and signed by that owner. The test we apply is whether the register could be rebuilt from the contract file alone, by someone who was not involved in building it. A register built as a project and closed as a project fails that test by the second cycle, which is the failure I have watched happen and the one this method is arranged against. Whether it holds across a full cycle is what a full cycle has to show. I will write down what the next one costs and where the estimate was wrong again.