DORA

1. 2026-09-18 Low
   EBA publishes final Guidelines on management of third-party risk aligned with DORA

   The EBA has published its final Guidelines on the management of third-party risk, creating a more proportionate and consistent regulatory framework that aligns with DORA requirements. …

   New document

That is the last 90 days. Sign in to read further back.

1. 2028-01-17 in 434 days Commission review of DORA due, including the criteria for designating critical ICT third-party providers (Article 58(1))
2. 2025-11-19 Commission proposes routing DORA major-incident reports through a single-entry point, COM(2025) 837
3. 2025-11-18 The ESAs publish the first list of designated critical ICT third-party providers
4. 2025-02-20 Delegated Regulation (EU) 2025/301 on the content and time limits of major-incident reports published in the Official Journal
5. 2025-01-17 DORA starts to apply

1. 2025-11-19
   Digital Omnibus proposal, COM(2025) 837 Draft

   Commission proposal whose Article 8 would have financial entities report major ICT-related incidents through the single-entry point that ENISA would run under NIS2. source

   More

   • Not adopted; the European Parliament lists procedure 2025/0360(COD) as awaiting a committee decision.
2. 2023-06-28
   Financial Data Access proposal, COM(2023) 360 Draft

   Commission proposal for a framework for Financial Data Access that also amends Regulation (EU) 2022/2554. source

   More

   • Not adopted; the European Parliament lists procedure 2023/0205(COD) as awaiting Parliament's first-reading position, with interinstitutional negotiations opened in December 2024.
3. 2022-12-14
   Regulation (EU) 2022/2554 Major versionCurrent

   The Digital Operational Resilience Act, published in OJ L 333 of 27 December 2022. source

   More

   • It entered into force on 16 January 2023 and has applied since 17 January 2025.
   • Its detailed rules sit in Commission delegated and implementing regulations (listed under Documents), which supplement the text without changing it.

DORA applies to almost every kind of regulated EU financial entity and to the ICT third-party service providers they use.

Financial entities

Credit institutions, payment and e-money institutions, account information service providers, investment firms, crypto-asset service providers, CSDs, CCPs, trading venues, trade repositories, AIFMs, management companies, data reporting service providers, insurers and reinsurers, insurance intermediaries, IORPs, credit rating agencies, critical benchmark administrators, crowdfunding providers and securitisation repositories (Article 2(1)(a)-(t)). source

ICT providers

ICT third-party service providers are in scope (Article 2(1)(u)); those designated as critical come under direct EU oversight. source

Lighter regime

Small and non-interconnected investment firms, exempted payment and e-money institutions, certain credit institutions exempted under Directive 2013/36/EU and small IORPs follow a simplified ICT risk management framework instead of Articles 5 to 15 (Article 16). source

Relation to NIS2

For financial entities DORA's ICT risk, incident reporting, testing and third-party rules apply instead of NIS2's (NIS2 recital 28). source

No certificate: the financial entity runs its own ICT risk framework, tests it and reports to its supervisor, and the largest entities face threat-led penetration tests at least every three years.

Management body

The management body defines, approves, oversees and is responsible for the ICT risk management framework (Article 5(2)). source

Incident reporting

Report major ICT-related incidents to the competent authority (Article 19): initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, intermediate report within 72 hours, final report within one month (Delegated Regulation (EU) 2025/301, Article 5). source source

Resilience testing

Entities other than microenterprises keep a testing programme, with tests done by independent internal or external parties (Article 24). source

Threat-led testing

Entities identified by their authority carry out threat-led penetration testing (TLPT) on live production systems at least every three years (Article 26(1)-(2)). source

Register of information

Keep a register of all contractual arrangements for ICT services from third-party providers, at entity and group level (Article 28(3)), using the templates of Implementing Regulation (EU) 2024/2956. source source

National competent authorities supervise and sanction financial entities; the ESAs' Lead Overseer can impose daily penalty payments on critical ICT providers.

National powers

Competent authorities have supervisory, investigatory and sanctioning powers, including access to documents and on-site inspections; Member States set the administrative penalties (Article 50). source

Critical providers

On 18 November 2025 the ESAs published the first list of designated critical ICT third-party providers, which are now under direct oversight. source

1. Law text Regulation (EU) 2022/2554 (Digital Operational Resilience Act)
2. Law text Delegated Regulation (EU) 2024/1774 - ICT risk management tools and the simplified framework
3. Law text Delegated Regulation (EU) 2024/1772 - classification of ICT-related incidents and cyber threats
4. Law text Delegated Regulation (EU) 2025/301 - content and time limits of major-incident reports
5. Template Implementing Regulation (EU) 2025/302 - forms and templates for major-incident reports

1. NIS2

   The horizontal EU cybersecurity directive; DORA replaces its risk, reporting and supervision rules for financial entities.

2. EBA GL/2019/04

   EBA guidelines on ICT and security risk management for banks and payment providers that predate DORA.

3. PSD2 SCA

   Payment-specific authentication and security rules; DORA's companion Directive (EU) 2022/2556 amended PSD2 itself.

4. APRA CPS 230

   Australia's operational risk standard for regulated financial institutions, with its own service-provider and business continuity rules.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to DORA (RSS)