Quick answer
DORA (the Digital Operational Resilience Act) is an EU regulation applying since 17 January 2025. It requires 20 types of financial firms to manage technology risk, report major ICT incidents, test their defences and control supplier risk, and lets EU supervisors oversee critical tech providers[2].
Key points
- DORA entered into force on 16 January 2023 and has applied since 17 January 2025.
- It covers 20 different types of financial entities, from banks and insurers to investment firms, plus their ICT providers.
- A major ICT incident must first be notified within 4 hours of being classified as major, and no later than 24 hours after detection.
- Only firms identified by their supervisors must run advanced threat-led penetration tests; an ECB note gives the example of one every three years.
- EU supervisors designated the first critical ICT third-party providers, whose services range from core infrastructure to data services, in November 2025.
On this page
#What problem is DORA trying to solve?
Modern finance is software. Your bank's ledger, a card payment, an insurance claim: all of it runs on ICT, short for information and communication technology, and much of it runs on computers owned by outside suppliers such as cloud providers. If those systems go down or are hacked, customers cannot pay, trade or reach their money. Operational resilience means being able to keep critical services running, or recover them quickly, when something goes wrong.
Before DORA, EU rules on technology risk were scattered across sector laws. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, brings them into one rulebook. It entered into force on 16 January 2023 and applies as of 17 January 2025[1]. The European Insurance and Occupational Pensions Authority (EIOPA) says it applies to 20 different types of financial entities and to ICT third-party service providers[2].
#What are DORA's main pillars?
| Pillar | What firms must do | Everyday meaning |
|---|---|---|
| ICT risk management | Set up a framework of principles and requirements for managing ICT risk[2] | Know your systems and how they can fail |
| Incident reporting | Report major ICT-related incidents to the competent authority[2] | Tell the supervisor quickly when something big breaks |
| Resilience testing | Run basic and, for some firms, advanced testing[2] | Attack your own systems before criminals do |
| ICT third-party risk | Manage suppliers through key contract terms and monitoring[2] | Don't outsource the problem along with the service |
| Information sharing | Exchange information and intelligence on cyber threats[2] | Warn each other about new attacks |
ESMA lists oversight of critical third-party providers as a sixth pillar[1].
#Who has to comply with DORA?
DORA reaches far beyond big banks. EIOPA lists banks, insurance companies and investment firms among the covered financial entities, 20 types in total, and the regulation also reaches ICT third-party service providers[2]. National supervisors apply it day to day; Ireland's central bank, for example, notes that DORA applies to a wide range of the financial entities it regulates[3]. If a fintech app runs on a licensed partner, as described in banking as a service explained, the licensed firm is the one answering to the supervisor.
#How fast must a major incident be reported?
Not every glitch counts. Under the EU rules summarised by the Dutch markets regulator (AFM), an incident is major when it affects critical services and either involves successful, malicious and unauthorised access to network and information systems that may lead to data losses, or materially meets thresholds in at least two classification criteria such as clients affected, duration, geographical spread or economic impact; recurring incidents with the same cause can also qualify[4].
Reporting a major ICT incident under DORA
Initial notification
Within 4 hours of classifying the incident as major, and no later than 24 hours after it was first detected.
Intermediate report
Within 72 hours of classification, or as soon as regular activities have been recovered.
Final report
No later than one month after classification; if the incident is still unresolved then, no later than one day after it is finally resolved.
These deadlines come from the AFM's guidance on DORA incident reporting[4]. The two-clock design for the first notice matters: a firm cannot buy time by delaying the decision to call an incident major, because the 24-hours-from-detection limit still applies.
Worked example
Worked example: when is the first notice due?
Deadlines computed with code from the AFM time limits[4]: the initial notification is due at whichever comes first, 4 hours after classification or 24 hours after detection.
- Case A: detected Monday 2 March 2026 at 09:00, classified major the same day at 15:00
- Initial notice due Monday 19:00 (4 hours after classification comes first)
- Case A: intermediate report
- Due Thursday 5 March at 15:00 (72 hours after classification)
- Case B: same detection, classified major on Tuesday 3 March at 08:00
- Initial notice due Tuesday 09:00 (24 hours after detection comes first)
#What is threat-led penetration testing?
A penetration test is an authorised, simulated attack on your own systems. Threat-led penetration testing (TLPT) goes further: testers use intelligence about real attackers to mimic how they would target a specific firm, often called ethical red-teaming. The ECB's TIBER-EU framework, first published in May 2018, was updated in 2024 to align fully with DORA's technical standards on TLPT[5]. Only a subset of firms, designated by their supervisors, must run TLPT[6], and the ECB's 2024 note on the topic gives the example that a Dutch financial entity subject to DORA is required to complete DORA TLPT every three years[7].
#Why does DORA care so much about cloud providers?
Because many firms depend on the same few suppliers. EIOPA describes the EU-wide oversight framework for critical ICT third-party providers (CTPPs) as a response to systemic and concentration risks from the sector's reliance on a limited number of ICT providers[2]. To find them, supervisors collect each firm's register of information on its contractual arrangements with ICT third-party service providers[8]. National authorities had to send these registers to the three European Supervisory Authorities (the EBA, EIOPA and ESMA) by 30 April 2025[9].
DORA milestones so far
16 January 2023
DORA enters into force[1].
17 January 2025
DORA starts to apply[1].
18 February 2025
The ESAs publish a roadmap towards designating critical ICT providers[9].
30 April 2025
Deadline for national authorities to submit registers of information to the ESAs[9].
18 November 2025
The ESAs publish the list of designated critical ICT third-party providers[10].
With designation, the ESAs began direct oversight engagement to assess whether these providers have appropriate risk management and governance frameworks for the services they deliver to financial entities[10]. The financial firms remain responsible for their own resilience; oversight of the supplier does not replace it.
Common beginner mistakes about DORA
Thinking DORA is only about cyber attacks
It covers any ICT disruption, including outages and failed changes, not just hacking.
Assuming it applies only to banks
Around 20 types of financial entities are in scope, including insurers and investment firms.
Believing outsourcing moves the responsibility
Firms must manage third-party risk themselves and keep a register of information on their ICT contracts.
Mixing up DORA with data protection law
DORA is about keeping services running and reporting incidents; personal data rules are a separate regime.
#How does DORA fit into regtech?
Mapping every ICT contract, classifying incidents against several criteria and meeting four-hour deadlines is exactly the kind of work compliance software is built for; see what is regtech. DORA also overlaps with other technology rules, such as the card data standard in PCI DSS explained and the core systems described in core banking systems explained.
The bottom line
DORA makes technology risk a board-level legal duty for EU finance. Firms must manage ICT risk, report major incidents on tight deadlines, test their defences and keep control of their suppliers, while EU supervisors now oversee the most critical tech providers directly. For customers, the aim is simple: fewer and shorter outages in the services they rely on.
Frequently asked questions
When did DORA start to apply?
On 17 January 2025, after entering into force on 16 January 2023[1].
Does DORA apply to cloud providers directly?
Partly. Financial firms must manage their ICT suppliers, and providers designated as critical are subject to direct oversight by the European Supervisory Authorities; the first were designated on 18 November 2025[10].
Does DORA apply outside the EU?
DORA is EU law for financial entities in the EU. Non-EU companies feel it mainly when they supply ICT services to EU financial firms.
Do all firms have to run threat-led penetration tests?
No. All in-scope firms must test their resilience, but advanced threat-led testing applies only to a subset of firms identified by their supervisors[6].
Sources
- Digital Operational Resilience Act (DORA) — European Securities and Markets Authority (ESMA), 2026 Primary
- Digital Operational Resilience Act (DORA) — European Insurance and Occupational Pensions Authority (EIOPA), 2026 Primary
- Digital Operational Resilience Act (DORA) — Central Bank of Ireland, 2026 Primary
- DORA: ICT-related incidents — Dutch Authority for the Financial Markets (AFM), 2026 Primary
- TIBER-EU — European Central Bank, 2026 Primary
- DORA - Frequently Asked Questions — Central Bank of Ireland, 2026 Primary
- Adopting TIBER-EU will help fulfil DORA requirements (MIP OnLine topical, September 2024) — European Central Bank, 2024 Primary
- The ESAs announce timeline to collect information for the designation of critical ICT third-party service providers under DORA — European Banking Authority, 2024 Primary
- The ESAs provide a roadmap towards the designation of CTPPs under DORA — European Banking Authority, 2025 Primary
- The European Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience Act — European Banking Authority, 2025 Primary
.jpg){kind=link}
_mainframe_computer_system_at_Living_Computer_Museum_(strongly_edited_image).jpg){kind=link}
