DORA explained: what the Digital Operational Resilience Act actually requires

Instrument

Regulation (EU) 2022/2554

Applies since

17 January 2025

Legal form

Regulation — directly applicable, no national transposition needed

Who is in scope

Roughly 20 categories of EU financial entity, plus their ICT suppliers

Supervisor

Your existing prudential or markets supervisor — no new authority

Incident clock

Initial notification within hours · intermediate 72 hours · final within a month

Who DORA applies to

DORA covers roughly twenty categories of EU financial entity: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, trading venues, central securities depositories and others, plus the ICT suppliers they depend on. It replaces a patchwork of national outsourcing guidance with one binding set of rules across five areas.

The important consequence of that breadth is that scope is not a question you answer once for a group. A banking licence, an insurance licence and a crypto-asset service provider authorisation held by three entities in the same group each bring their own supervisor and their own filing route, even though the underlying obligations are identical.

The five pillars

DORA is usually described in five limbs. They are not five separate projects — the evidence produced by one feeds the next — but they are the shape a supervisor will use when they examine you.

• ICT risk management framework. The management body approves it and remains answerable for it, so accountability cannot be pushed down to the CISO.
• Incident classification and reporting. Major ICT incidents go to the national competent authority on a fixed clock: initial notification within hours, an intermediate report within 72 hours, and a final report within a month.
• Resilience testing. Annual testing of critical systems, and threat-led penetration testing at least every three years for larger entities.
• Third-party risk. A Register of Information covering every contractual arrangement with an ICT provider, submitted annually to the supervisor, plus mandatory contract terms on audit rights, subcontracting, data location and exit.
• Threat intelligence sharing. Voluntary.

What it looks like in practice

In practice DORA is performed continuously rather than annually. The board signs off the framework, the first line runs the controls, risk and internal audit test them independently, and the register is filed as structured data in the templates set by the European Supervisory Authorities.

Country status, and why there is no transposition table

DORA is a regulation, not a directive. It applies directly and identically in all 27 member states with no national implementing law required, which is exactly why it landed on time while NIS2 did not. There is no per-country variation in the obligations themselves.

What does vary by country is who supervises you and how they collect the paperwork. DORA does not create a new authority. Your existing prudential supervisor picks it up, so the answer is entity-specific rather than country-specific: a significant bank answers to the ECB under the SSM, a smaller bank or an insurer to its national supervisor, an investment firm or CASP to its national markets authority.

Register of Information collection mechanics also differ. Belgium's FSMA, for example, gathers registers through its FiMiS survey and forwards them to the ESAs, and narrowed the 2026 round so that only a limited set of entities must resubmit, with the rest simply confirming no change.

A handful of states are still legislating national adaptation measures that designate authorities and set sanctioning powers. France is doing this in Title III of the loi Résilience, which as at August 2026 has not been enacted. DORA binds French financial entities today regardless; only the domestic enforcement plumbing is outstanding.

The oversight layer that is genuinely new

On 18 November 2025 the ESAs published the first list of designated critical ICT third-party providers, naming 19 firms across hyperscale cloud, data centre operations, network infrastructure and financial-sector technology. Designated providers come under direct EU-level oversight with powers of investigation and on-site inspection, including at material subcontractors. The list is reassessed annually.

Designation does not transfer any responsibility away from the financial entity. It intensifies scrutiny of whether that entity governs the relationship properly — which means the contract terms, the audit rights, the subcontracting chain and the exit plan all become more, not less, likely to be examined.

How DORA sits alongside NIS2 and MiCA

DORA is lex specialis for financial entities, so a bank satisfies the ICT risk and incident limbs of NIS2 through DORA rather than doing the work twice. In the other direction, MiCA routes crypto-asset service providers straight into DORA for ICT resilience — MiCA sets the authorisation and conduct regime, DORA supplies the operational resilience layer underneath it.

None of this collapses three programmes into one. It means the same evidence can serve more than one supervisor, provided it is produced in a form that survives examination by any of them.