Delivering DORA compliance at scale

In May 2024, a global asset management firm needed to do one job: get its supplier contracts into shape for the Digital Operational Resilience Act (DORA) - quickly, consistently, and with enough governance to stand up to external scrutiny.

The programme covered 168 critical and non-critical suppliers, each with different commercial leverage, operational dependencies, and contract maturity. The work was planned to run into 2025, which meant the client needed a method that could scale, endure employee changes, and keep decision-making coherent over time.

The goal:

• Contract language aligned to DORA requirements across a large supplier set 
• A defensible, repeatable approach to negotiation (avoiding ad hoc deal-by-deal compromises) 
• Clear visibility into progress and risk across the population 
• Minimal internal disruption: fewer escalations, fewer surprises, fewer last-minute blockers

‍

The biggest potential risks were non-compliance and execution drag and with this many suppliers, the risks included:

• Inconsistent negotiation positions across teams, leading to rework and internal disagreement 
• Low visibility into contract status, with leadership unable to see where risk is concentrating 
• Supplier pushback and long cycle times, especially where contract changes feel “regulatory” rather than commercial 
• Template sprawl - preventing multiple versions from creating confusion and governance gaps 
• ‍Escalation overload, avoiding every supplier markup becoming a bespoke legal debate

The client needed to move fast, but not at the expense of governance. Speed without control would create compliance risk; control without speed would stall the programme.

Why existing options were not fit for purpose

Common approaches don’t hold up well at this scale:

The client needed an approach that combined legal accuracy + operational discipline, with a clear system for triage, negotiation, and reporting.

‍

‍

Radiant Law was engaged to run an end-to-end remediation programme designed to be process-first and data-driven, so the client could maintain momentum while preserving governance and risk priorities.

The operating principle: standardise what can be standardised; escalate only what truly needs escalation.

That meant building the “machine” around the legal work, not just producing markups:

• Consistent templates aligned to supplier criticality 
• A structured gap analysis method to identify and prioritise non-compliance 
• A negotiation playbook to reduce unnecessary escalations and keep outcomes consistent 
• A live amendment tracking system to give leadership real-time visibility 
• A governance cadence to keep decisions documented and progress measurable

‍

‍

1) Scoping and planning

Radiant worked with the client to define:

• The programme scope, prioritisation across suppliers and an execution timeline and working cadence

The goal was to avoid a “boil the ocean” start and instead create a plan that made progress visible early - while still accommodating complexity.

‍

2) Template development by supplier category

Radiant developed multiple templates to reflect different risk profiles and negotiation realities:

• Critical Supplier Template 
• Reduced EBA Template ‍
• Non-Critical Supplier Template

This avoided a one-size-fits-all template that would either be too heavy for low-risk suppliers or too light for critical dependencies.

‍

3) Supplier outreach and negotiation management

Radiant managed supplier engagement at scale:

• Initiating outreach, reviewing supplier markups, coordinating inputs and decisions with internal stakeholders

This was designed to keep negotiation cycles moving while ensuring positions stayed aligned with the client’s governance and risk priorities.

‍

4) Gap analysis system for identifying non-compliance

Radiant developed a structured assessment template to:

• Evaluate existing supplier contracts, flag gaps against DORA requirements and support prioritisation and reporting

This helped turn “contract review” into a measurable compliance workstream.

‍

5) Playbook creation to reduce escalations

To prevent inconsistent outcomes and repeated debates, Radiant created a playbook with:

• Predefined negotiation positions, fallback positions and guidance designed to keep negotiations low-escalation where possible

The practical benefit: fewer internal decision loops, faster supplier turnaround, and more uniform contract outcomes.

‍

6) Amendment tracking for real-time visibility

Radiant built a database to track contract amendment status across the supplier population, giving the client:

• A single source of truth for progress, clarity on what’s stuck and why and data to support governance reporting and risk focus

‍

7) Governance and reporting cadence

Radiant provided weekly progress updates, including:

• Progress stats, escalation handling and structured reporting to support decision-making

This kept programme leadership informed and reduced the chance of late-stage surprises.

‍

‍

Radiant’s process-first approach is helping the client move through a complex DORA remediation programme with more control and less friction - supporting:

• Greater confidence in compliance readiness 
• Reduced internal negotiation noise through consistent playbook-driven positions 
• Stronger visibility and governance via structured tracking and reporting ‍
• More sustainable supplier engagement, by keeping negotiations organised and predictable

Over the course of the project the primary value evolved past legal accuracy as a singular goal and into a system that can keep delivering consistent outcomes over time.