DORA register of information

You cannot supervise a concentration you cannot see. Before DORA, no supervisor knew how many European insurers depended on the same cloud provider for the same critical function, and each entity often did not know it for its own subcontracting chain beyond the first tier. The register of information corrects that through a prescribed-format inventory: identification of the provider by a standardized code, function served, whether that function is critical or important, country of provision and of data storage, subcontracting chain, contract end date, exit strategy. Each entity keeps it current and files it with its competent authority, which forwards it to the European supervisory authorities. That flow feeds the designation of critical providers placed under direct oversight. The practical difficulty treated as secondary turned out to be central: correctly identifying each provider by a unique identifier, and reconstructing second-tier and deeper subcontractors, presupposes contractual information many entities had never collected.