Regulation · EU · Reg. 2022/2554
The Digital Operational Resilience Act
The EU's rulebook for keeping finance running when its technology fails, and the first to bring critical technology suppliers under direct oversight.
- Status
- In force
- Applies since
- 17 January 2025
- Structure
- Five pillars
- Also covers
- Critical ICT providers
In brief
Five Pillars and an Accountable Board
DORA treats technology failure as a systemic risk to finance and builds a single resilience regime across the sector. Four of its five pillars carry direct obligations: an ICT risk-management framework, the classification and reporting of major ICT incidents, a testing programme, and the management of third-party ICT risk. The fifth encourages voluntary threat-intelligence sharing.
Its sharpest innovation is reaching past the regulated firm to its suppliers. Critical ICT third-party providers, the large cloud and, increasingly, AI vendors the sector depends on, come under direct EU oversight. For AI in finance, models are ICT systems inside the framework, and model vendors are third parties you must map, monitor, and be able to exit.
- Articles 5–16
- ICT risk management. A documented framework the management body owns: identify, protect, detect, respond, recover, and learn.
- Articles 17–23
- Incident reporting. Classify major ICT-related incidents against set criteria and report them to the competent authority on a defined clock.
- Articles 24–27
- Resilience testing. A regular testing programme, with threat-led penetration testing for the most significant entities.
- Articles 28–44
- Third-party risk. A register of information, concentration-risk limits, exit strategies, and oversight of critical providers.
Where it meets the others
Where DORA Meets the Other Regimes
One fact about a system, and each regime that asks for it.
- One incident
- DORAreports a major ICT incident (Art. 19)time limits set under Art. 20
- EU AI Actreports a serious incident (Art. 73)15 days; 2 days if widespread; 10 days on a death
- GDPRnotifies a personal-data breach (Art. 33)72 hours
- NIS2reports a significant incident (Art. 23)24 h warning, 72 h notice, one month
- MDRreports a serious incident (Art. 87)15 days
DORA is lex specialis to NIS2 for financial entities.
- One management system
- EU AI Actquality management system (Art. 17)deemed met by financial-services governance rules (Art. 17(4))
- DORAICT risk management framework (Art. 6)approved by the management body (Art. 5)
Who owes what
The Financial Sector and the Firms It Runs On
DORA covers financial entities broadly, and for the first time reaches the technology providers they depend on.
- Financial entity
- Banks, insurers, investment and payment firms. Nearly the whole regulated sector, plus crypto-asset service providers. Each runs the full five-pillar programme, proportionate to size and risk.
- Management body
- The accountable individuals. Own the ICT risk framework, set risk tolerance, and maintain the skills to oversee it, under Article 5.
- Critical ICT provider
- The suppliers the sector depends on. Designated cloud and technology providers, coming under direct oversight by the European Supervisory Authorities.
- Competent authority & ESAs
- The supervisors. National regulators supervise entities; the ESAs run the pan-EU oversight of critical providers.
The Board Owns ICT Risk and Cannot Delegate It
Under DORA, the management body bears ultimate responsibility for managing the entity's ICT risk. It must define, approve, and oversee the ICT risk-management framework, set the entity's risk tolerance, and review the arrangements regularly, and its members must keep sufficient knowledge and skills to understand ICT risk, through ongoing training. Responsibility for resilience sits with named individuals at the top of the firm, not with the technology function alone.
Timeline
In Force, and Now Supervised
DORA is fully in force. The current phase is the build-out of the critical-provider oversight regime and the first supervisory cycles.
- 16 Jan 2023
- Regulation enters into force, with a two-year implementation window.
- Live
- 17 Jan 2025
- DORA applies in full across EU financial entities.
- Live
- 2025–2026
- The ESAs designate and begin overseeing critical ICT third-party providers.
- Live
Source: Official Journal of the EU · DORA and its regulatory and implementing technical standards · Check the consolidated text before relying on a date.
Penalties
National for Firms, Direct for Providers
DORA leaves administrative penalties on financial entities to national law, while giving the ESAs a direct tool against critical providers.
- National
- Financial entities face effective, proportionate, and dissuasive administrative penalties set by their competent authority, plus remediation orders.
- 1% / day
- Critical ICT third-party providers face periodic penalty payments of up to 1% of average daily worldwide turnover, imposed by the ESAs to compel compliance.
Check the consolidated text before relying on a figure.
The regimes alongside it
The Regimes That Apply Alongside It
- Reg. 2024/1689
EU AI Act
Applies across every sector. Obligations by risk tier for providers and deployers, phasing in to December 2027.
Full guideRead the guide - Reg. 2016/679
GDPR for AI
Data protection. Lawful basis, impact assessments (DPIAs) and people's rights, wherever AI uses personal data.
In forceRead the guide - Dir. 2022/2555
NIS2 Directive
Cyber resilience for essential and important entities. The management body is personally responsible.
In forceRead the guide
FAQ
Common Questions
DORA applies to a broad set of EU financial entities, including banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, and more, plus the critical ICT third-party providers that serve them. Article 2 lists the covered entity types; if you are a regulated financial entity in the EU, you are almost certainly in scope.
DORA has applied since 17 January 2025. There is no further transition period for financial entities; the obligations are live and national competent authorities have held enforcement powers since that date.
For critical ICT third-party providers, the Lead Overseer can impose periodic penalty payments of up to 1% of average daily worldwide turnover, charged daily for up to six months until compliance (Article 35). Fines and administrative penalties on financial entities are set by each Member State under Articles 50-52, so the quantum varies by jurisdiction.
DORA rests on five pillars: ICT risk management (Articles 5-16), ICT-related incident reporting to competent authorities (Articles 17-23), digital operational resilience testing including threat-led penetration testing for larger entities (Articles 24-27), ICT third-party risk management (Articles 28-44), and information-sharing arrangements (Article 45).
No. Those frameworks overlap but do not substitute for DORA. DORA imposes specific requirements, such as the ICT incident classification and reporting timelines, resilience testing regime, and contractual clauses for ICT third-party arrangements under Article 30, that general information-security certification does not cover.
Yes, in two ways. Financial entities must embed DORA-mandated contractual terms in ICT third-party contracts (Article 30), and providers designated as "critical" come under direct EU oversight by a Lead Overseer, with the periodic penalty powers noted above.
DORA keeps the accountability with you. You must maintain a register of ICT third parties, manage concentration risk, and hold a tested exit strategy for each critical dependency.
Article 5 makes the management body own the ICT risk framework and keep the skills to oversee it. It is a board-level, personally-held duty.
DORA requires a full testing programme, and threat-led penetration testing on a multi-year cycle for the most significant entities, going well beyond a routine annual test.
Your next step