· ReadyStack
Worked example
Real numbers from this tool, line by line.
Seven Article 30 clauses were missing from one master services agreement - the kind a vendor-risk lead at a Dublin payment institution signs with a cloud provider and files away.
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. That is 603 days as of 12 September 2026, and the article supervisors quote back is Article 30: the provisions every ICT contract must contain in writing. Nine of them apply to any ICT service, under Article 30(2). Six more apply when the service supports a critical or important function, under Article 30(3). Fifteen clauses in total - and a contract drafted by good lawyers still fails on the two or three nobody thought to write down.
The contract reads fine until you read it against the article
Take the sample master services agreement shipped with this linter as a test fixture. It names the services. It carries a data protection clause with the exact DORA wording - availability, authenticity, integrity and confidentiality - plus performance targets, contingency plans and a minimum notice period.
It fails seven checks:
- the regions and countries where the data is processed are never named, because hosting is described as "at any location worldwide";
- incident assistance is promised "on a best-efforts basis", where Article 30(2)(f) allows only no additional cost or a cost fixed ex-ante;
- there is no obligation to join the financial entity's threat-led penetration testing;
- there is no exit strategy and no transition period;
- there are no grounds for termination, which Article 28(7) requires;
- and the audit right, which Article 30(3)(e) says is unrestricted, is capped at one audit per calendar year.
Two of those seven are not omissions at all. They are drafted clauses that read compliant and are not. That is the part a keyword search misses.
Rules you can read, in the repository
The extension keeps every rule in one JSON file, next to the engine:
{
"id": "art30_3_f_exit_strategy",
"sev": "error",
"mode": "require",
"msg": "Art. 30(3)(f): no exit strategy with a mandatory adequate transition period.",
"any": ["exit strateg", "exit plan"]
}Eighteen rules are require - the clause has to appear somewhere in the document. Four are forbid - the wording is present and it defeats the article: an audit capped to one inspection per year, incident support billed at time and materials or then-current rates, data placed at any location worldwide, and location or subcontractor changes made without notice. Twenty-two rules, each carrying its article reference into the finding.
Why this is not a prompt
A general assistant summarises Article 30 differently each time, and it will not run over forty signed agreements on a commit hook. The rule file is fixed and diffable: the same contract produces the same findings in March and in December.
What it costs to do by hand
Outside counsel reading one ICT contract against Article 30 takes two to four hours at roughly EUR 300 an hour for EU financial-regulatory work. Thirty vendor contracts is a multi-week engagement, repeated whenever a template changes.
The free extension and the free browser page do one contract, completely: open it, run the lint, and every missing clause comes back with its article and the wording to paste in. The licence key changes the axis - one pass over every contract in the repository, and an exported per-vendor, per-clause evidence table you keep for the register of information and the Q4 file.
Findings are drafting gaps to review with counsel, not legal advice.
15 seconds — what it actually does
Questions people ask
What does this extension actually do?
It reads an ICT vendor contract kept in your repository as Markdown and checks it against twenty-two rules drawn from DORA Article 30, Article 28(7) and Article 29. Each finding names the article, says which clause is missing, and gives the wording to paste in. A complete contract returns no findings at all.
Who is it for?
Vendor-risk, legal-operations and compliance engineers at EU financial entities in scope of DORA: banks, payment and e-money institutions, insurers, investment firms and crypto-asset service providers, plus the ICT providers answering their questionnaires. It suits teams that keep master services agreements and contract templates in Git rather than in a document management system.
Why not just ask an AI assistant to review the contract?
A general assistant paraphrases Article 30 differently on every prompt and cannot run over every contract in a repository on each commit. Free contract-review tools are not written against DORA at all. Here the rules sit in a readable JSON file, so the same contract always yields the same findings and a reviewer can audit the rules themselves.
What is free and what needs a licence key?
Free covers one contract, completely: open the file, run the lint, and every missing Article 30 clause is named with its article reference and suggested wording. The licence key adds scope and ownership: one pass over every contract in the repository, and an exported per-vendor, per-clause evidence table you keep and hand to an auditor.
What would this cost if a person did it?
Outside counsel reading one ICT contract against Article 30 takes two to four hours at roughly three hundred euro an hour for EU financial-regulatory work. A portfolio of thirty vendor contracts becomes a multi-week engagement. The extension is $29 once, one licence key per person or team seat,.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. ICT Contract Clause Lint - DORA Article 30 checks the file you open against 22 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.