Specimen applicability note — fictional software supplier Illustrative specimen or blank worksheet. Not a signed contract, legal opinion, client case or evidence that Dyasol has performed these operations. Complete and agree the relevant terms before use. Mandate and decision SPECIMEN A-01, version 1, 14 September 2026. Fictional Example Software Ltd, Bulgaria, supplying a bank. Question: does the bank questionnaire establish direct DORA or NIS2 duties? Initial conclusion: the questionnaire alone does not. On the assumed facts, there is no identified financial-entity licence or other DORA financial-entity category; customer contract requirements must still be assessed. NIS2 direct applicability remains unresolved pending the actual service model, group figures and applicable Bulgarian classification. This is a complete illustrative note with a qualified conclusion, not a legal opinion or a conclusion about any real company. Information relied on F-01 fictional management statement: 18 employees; turnover EUR 2 million; software development for business customers. F-02 fictional bank questionnaire: access controls, incidents and supplier evidence requested before renewal. F-03 fictional service description: product support is mentioned, but administration of customer systems and hosted-service operation are not described. No licences, group accounts or actual contracts were inspected. Every item here is an invented scenario fact, not a verified client record. Analysis by question DORA: distinguish listed financial entities from an ordinary ICT supplier; Articles 28–30 concern the financial entity’s ICT third-party risk and contractual arrangements. The customer must identify the requested contractual protections and service scope. A questionnaire is not itself a licence, designation or certificate. NIS2: activity classification, enterprise size and exceptions are separate checks. A description such as “software company” cannot settle whether cloud, managed service or another listed activity is actually supplied. The assumed standalone headcount is insufficient without linked/partner enterprise information and applicable exceptions. Open facts and conditional outcomes O-01 — management: provide ownership and linked/partner-enterprise data. O-02 — service owner: state who hosts, administers and operates customer systems; supply relevant service schedules. O-03 — compliance/legal reviewer: verify applicable Bulgarian entity category, size/exceptions and any notification. If no listed activity or exception is established, direct NIS2 scope may not be established; if a listed service and relevant criteria are established, direct duties need a full applicable-law analysis. Neither outcome is a promise before those checks. Actions and business consequences Ask the bank which answers and independent reports are mandatory, what it accepts as evidence, and the renewal deadline. Assign one technical owner and one commercial approver. Keep direct statutory applicability separate from promises in the contract: an organisation outside direct scope can still face renewal delay or contractual obligations. Do not assert an exemption, full compliance or agreed waiver from this specimen. Delivery and acceptance A real note should identify the entity, scope, sources and missing facts, explain the conclusion and give an actionable follow-up owner. Recipient review: can management decide what to collect and what not to promise? Record questions and corrections against the agreed scope. Sharing a commissioned note depends on its agreed purpose, recipients and terms; this specimen creates no reliance right for a third party. Reference framework DORA Regulation (EU) 2022/2554, Articles 2 and 28–30: https://eur-lex.europa.eu/eli/reg/2022/2554/oj . NIS2 Directive (EU) 2022/2555, Articles 2–3 and Annex I: https://eur-lex.europa.eu/eli/dir/2022/2555/oj . National application must be checked for the actual assessment date and facts. Source verification status is recorded separately; this specimen does not assert a completed national-law applicability check. Reference framework reviewed on 14 September 2026 against primary texts during regulatory review. Bulgarian implementing act: https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=241234 . The fictional entity classification remains unresolved.