DORA: Overview

Regulation: EU 2022/2554 (Digital Operational Resilience Act) Applicability: 17 January 2025 (fully applicable) Scope: Digital operational resilience of the financial sector

DORA Article 1(2) is sector-specific EU law for financial entities also identified as essential/important under NIS2, within the equivalent obligations covered by NIS2 Article 4. It does not exempt all financial-sector suppliers from NIS2. An ICT supplier is subject to direct ESA oversight only if designated critical under Article 31; contractual requirements can affect other suppliers.

What is DORA?

For DORA financial entities also within NIS2, DORA is the sector-specific act under DORA Article 1(2) and NIS2 Article 4 for the corresponding duties. Determine the entity and scope; this does not give ICT suppliers a blanket exemption.

Who falls under DORA?

Financial entities (Art. 2)

Category	Examples
Credit institutions	Banks, savings banks
Payment institutions	Including institutions exempted under PSD2
Electronic money institutions	Separate category under Article 2(1)(d), including exempted institutions
Investment firms	Securities dealers
Insurance undertakings	Life and non-life insurance
Reinsurance undertakings	Reinsurance companies
Institutions for occupational retirement provision (IORPs)	IORPs operating pension schemes with no more than 15 members in total are excluded (Art. 2(3)(c))
Crypto-assets	Crypto-asset service providers authorised under MiCA and issuers of asset-referenced tokens (Art. 2(1)(f))

The table is a selection of financial entities, not the complete Article 2 list. Check the exclusions in Article 2(3) and any national option under Article 2(4). ICT third-party service providers are separately covered by Article 2(1)(u); they are not financial entities under Article 2(2). Direct oversight applies after designation as critical under Article 31, subject to its conditions and exclusions.

Simplified regime (Art. 16)

Article 16 is limited to the entity categories expressly listed there: small and non-interconnected investment firms, specified exempt payment/credit/e-money institutions and small occupational pension institutions. Small size, low ICT complexity or low systemic importance alone does not qualify an entity. Article 4 proportionality is a separate principle; Article 16 does not create a general exemption from reporting major ICT-related incidents under Article 19.

Five pillars of DORA

Voluntary threat-information sharing under Article 45 must meet its safeguards; participation and its termination must be notified to the competent authority (Art. 45(3)).

Relationship to other regulations

DORA vs NIS2

Aspect	NIS2	DORA
Type	Directive	Regulation
Scope	Specified entity types and services under Articles 2–3 and national law	Financial entities in Article 2 and specified ICT provider relationships
Relationship	General framework	Sector-specific act for relevant financial entities and equivalent duties (Art. 1(2), NIS2 Art. 4)
Incident reporting	Article 23 and national implementation: trigger, recipient and staged reports	Article 19 and Regulation 2025/301: classification, competent authority and separate deadlines
Testing	Assessing the effectiveness of measures under Article 21 and the applicable regime	Testing under Articles 24–25, including microenterprise adjustments; TLPT only for entities identified under Article 26
Suppliers	Supply-chain security	ICT relationships and concentration; direct oversight of designated critical providers

DORA is a sector-specific act in relation to NIS2 for the relevant financial entities and equivalent requirements (DORA Article 1(2), NIS2 Article 4). It does not replace GDPR or the AI Act. Assess personal-data processing and the use of AI separately; reuse evidence where the requirements overlap.

Timeline

DORA entered into force on 16 January 2023 and has applied since 17 January 2025. Record current reporting dates communicated by the competent authority; a historical ESA data-collection date is not a perpetual entity-level deadline. TLPT is required only for identified entities under Article 26, at least every three years unless the authority adjusts the frequency.

Penalties and supervision

DORA does not set a universal “EUR 10 million or 1%” fine for every financial entity. National authorities apply the national administrative-sanction framework under Articles 50–51. For a designated critical ICT provider, the Lead Overseer may impose a periodic penalty under Article 35: up to 1% of average daily worldwide turnover in the preceding business year for each day, for at most six months under the provision’s conditions. This is not a fixed EUR 1 million per day.

ČNB is the Czech competent authority under Section 9 of Act No 31/2025 Coll., within the allocation of powers under DORA Article 46, including ECB powers in the SSM and applicable home/host supervision rules. A designated Lead Overseer from the ESAs supervises a critical ICT provider; this is distinct from the financial institution’s own supplier due diligence.

Key requirements

ICT Risk Management Framework (Art. 6)

The following framework requirements concern the standard regime; Article 16 replaces Articles 5–15 for the categories listed there.

Documented framework approved by the board
Digital Operational Resilience Strategy
Risk tolerance defined by the board
At least annually, microenterprises periodically; also on Art. 6(5) event triggers

Incident Reporting — Article 19 and Regulation 2025/301

Stage	Trigger and deadline for a major ICT-related incident
Initial notification	As early as possible, within 4 hours of classification as major and no later than 24 hours after awareness. If classification occurs later than 24 hours after awareness, notify within 4 hours of that classification (Reg. 2025/301 Art. 5(1)(a) and 5(2))
Intermediate report	Within 72 hours after the initial notification, with required updates and an update when regular activities are recovered
Final report	Within one month after the intermediate report or latest updated intermediate report

Apply the specific reporting exceptions in Article 5 of the RTS where relevant. Record awareness, classification, reporting and recovery as separate timestamps; the four-hour clock does not start automatically at the time of the incident.

TLPT (Art. 26)

For entities identified under Article 26(8) and Regulation 2025/1190 Article 2; Article 26(1) excludes microenterprises and Article 16 entities
Threat-Led Penetration Testing
At least every 3 years for designated entities; authority may adjust
Testers meeting Article 27 and applicable RTS; a certificate label alone does not establish eligibility

Register of information on ICT services (Art. 28(3))

All contractual arrangements for the use of third-party ICT services
Distinguish services supporting critical or important functions; designating a critical provider under Article 31 is a separate process
Full register to competent authority on request; at least annual information on new arrangements under Art. 28(3) and current authority instructions
Ongoing updates
Timely notification to the competent authority of planned ICT arrangements supporting critical or important functions, and when a function becomes critical or important

Next steps

Sources

Content reviewed: 6 September 2026. Primary sources: DORA, Incident reporting RTS — Art. 5, NIS2 — Art. 4.