Direct answer: DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 to more than 20 types of financial entities and their ICT third-party risk. Its core is five areas: ICT risk management, ICT incident reporting, digital operational resilience testing, ICT third-party risk and contracts, and threat information sharing, plus an EU-level oversight framework for critical ICT third-party service providers. The incident reporting deadlines are set by the RTS (Commission Delegated Regulation (EU) 2025/301): the initial notification within 4 hours of classification as a major incident and no later than 24 hours from awareness; an intermediate report within 72 hours of the initial notification; and a final report within one month of the intermediate report. Financial entities must also maintain an ICT contract register, include the required clauses in contracts, and perform TLPT for critical or important functions at least every three years.
This guide is for banks, insurers, payment, investment, asset management and crypto-asset service providers operating in the EU, and for cloud, data centre, SaaS, managed service, security and outsourcing providers serving them. Data cut-off: 7 November 2026; sources are the EUR-Lex DORA text, EIOPA/ESMA DORA pages and Commission Delegated Regulation (EU) 2025/301 (incident reporting RTS). Official facts, editorial interpretation and items to confirm are kept separate. This is not legal advice.
(1) DORA already applies; it is not a future regulation. A financial entity remains ultimately responsible for ICT third-party risk - outsourcing does not transfer responsibility. (2) Incident reporting runs on a hard clock: initial notification within 4 hours of classification and no later than 24 hours from awareness; intermediate report within 72 hours; final report within one month. (3) The contract register, contract clauses and TLPT are the three items regulators can check most easily; build checkable evidence before buying more tools.
Timeline: from legislation to 2026 execution
DORA was adopted on 14 December 2022, entered into force on 16 January 2023 and has applied since 17 January 2025. The incident reporting RTS, Commission Delegated Regulation (EU) 2025/301, was published in the Official Journal on 20 February 2025 and sets the deadlines and content for the initial notification, intermediate report and final report. The 2026 focus is no longer "does DORA apply" but execution: is the register complete, are contract clauses in place, are major incidents reported on the 4h/24h/72h/one-month clock, are critical/important functions tested on the TLPT cycle, and how is the EU oversight framework for critical ICT third-party providers being applied.
| Date | Event | What it means |
|---|---|---|
| 14 Dec 2022 | DORA adopted | Harmonised EU rules for digital operational resilience in finance |
| 16 Jan 2023 | DORA enters into force | Implementation preparation period begins |
| 17 Jan 2025 | DORA applies | Financial entities must run ICT risk/third-party/testing/reporting under DORA |
| 20 Feb 2025 | Incident reporting RTS published | 4h/24h/72h/one-month deadlines and report content clarified |
| 2026 | Execution deepens | Register, contracts, TLPT and critical-provider oversight |
Sources: EUR-Lex Regulation (EU) 2022/2554, EIOPA/ESMA DORA pages and Commission Delegated Regulation (EU) 2025/301 (accessed 7 November 2026). Specific application dates, transition arrangements and national supervisory practice follow the official texts and competent authority requirements.
Five pillars: what DORA actually covers
DORA is not a single "cybersecurity regime"; it splits financial-sector ICT resilience into five areas: ICT risk management (governance, framework, asset/access, backup and recovery, incident handling), ICT incident management and reporting (classification, major incident reports, voluntary threat notification), digital operational resilience testing (basic testing plus advanced TLPT), ICT third-party risk management (due diligence, contracts, register, concentration risk, exit), and threat information sharing (voluntary). In addition, DORA establishes an EU oversight framework for critical ICT third-party service providers, designated by the ESAs and supervised by a Lead Overseer.
| Pillar | Core requirement | Key articles |
|---|---|---|
| ICT risk management | Governance and framework, asset/access control, backup/recovery, incident handling, communication | Articles 5-16 |
| Incident management and reporting | Major incident classification, initial/intermediate/final reports, voluntary threat notification | Articles 17-23 |
| Resilience testing | Annual basic testing of critical systems; TLPT at least every three years | Articles 24-27 |
| Third-party risk | Due diligence, contract clauses, register, concentration, exit strategy | Articles 28-30 |
| Information sharing | Voluntary sharing of cyber threat information among financial entities | Articles 31-32 (and 45) |
| Critical provider oversight | ESAs designate critical ICT third parties; Lead Overseer; EU list | Articles 31-44 |
Sources: Regulation (EU) 2022/2554 (accessed 7 November 2026). This is an editorial summary; the scope of each article and the proportionality/simplified framework (Article 16) follow the text.
Who is in scope: financial entities and ICT providers
DORA applies directly to more than 20 types of financial entities, including credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, alternative investment fund managers, UCITS management companies, insurance/reinsurance undertakings, insurance intermediaries, occupational retirement provision institutions, credit rating agencies, statutory auditors and crowdfunding service providers. ICT third-party service providers (cloud, data centre, SaaS, managed services, security, outsourcing) are not all directly supervised, but financial entities must manage them through contracts, due diligence and the register; providers designated by the ESAs as critical ICT third-party service providers enter the EU oversight framework. Small/non-interconnected entities may use the simplified framework (Article 16), but baseline requirements still apply.
| Object | Position under DORA | Check first |
|---|---|---|
| Financial entity | Direct obligation holder: risk/incidents/testing/third-party/sharing | Whether it is a type listed in Article 2 |
| ICT third-party provider | Affected through contracts and due diligence; critical providers are overseen | Whether it supports critical/important functions |
| Critical ICT third party | Designated by the ESAs; Lead Overseer supervision | Whether it is on the EU critical provider list |
| Small/non-interconnected entity | May use the simplified framework (Article 16) | Whether it meets the simplified conditions |
| Non-EU provider | In scope of contracts/oversight when serving EU financial entities | Data location, subcontracting chain, EU presence |
Sources: Regulation (EU) 2022/2554 Articles 2, 16 and 28-31 and EIOPA/ESMA DORA pages (accessed 7 November 2026). Specific entity types, simplified-framework eligibility and critical-provider designations follow the text, ESA lists and competent authority requirements.
Third-party risk: the register and contract clauses
DORA requires financial entities to maintain an ICT contract register at entity level (and at sub-consolidated/consolidated levels) covering all ICT third-party contracts and distinguishing those supporting critical or important functions; at least annually they must report to competent authorities on the number of new arrangements, provider categories, contract types and services/functions, and provide the full register or specific sections on request. Contracts must be in writing, include service levels and cover at least: description of services and subcontracting conditions, locations of data processing/storage, data protection and availability/integrity/confidentiality, access and assistance to authorities, service levels and performance targets, incident reporting and support, termination and exit strategies, audit/inspection rights and training. Contracts supporting critical or important functions face stricter requirements.
| Element | What the register records | What the contract states |
|---|---|---|
| Provider | Name, LEI/identifier, category, country | Entity, subcontracting chain, notification duties |
| Service | Service/function, critical/important flag, ICT service type | Scope, SLA, performance targets |
| Data | Processing/storage locations, data sensitivity | Location-change notice, data protection |
| Contract | Start/end, renewal, termination, exit | Termination rights, exit strategy, transition assistance |
| Risk | Concentration, substitutability, subcontracting dependency | Audit/inspection rights, supervisory assistance |
| Incidents | Incident contacts, reporting path | Incident support, notification deadlines |
Sources: Regulation (EU) 2022/2554 Articles 28-30 (accessed 7 November 2026). This is an editorial summary; register templates/frequency follow the ESAs' ITS and competent authority requirements, and contract clauses differ for critical/important functions.
Major incident reporting: 4 hours, 24 hours, 72 hours, one month
Article 19 requires financial entities to report major ICT-related incidents to competent authorities; the deadlines are specified in Article 5 of RTS (EU) 2025/301: the initial notification should be submitted as early as possible and in any case within 4 hours of classification as a major ICT-related incident and no later than 24 hours from awareness; the intermediate report is due within 72 hours of the initial notification (even if status/handling has not changed); the final report is due within one month of the intermediate report (or the latest updated intermediate report). If an incident is not classified as major within 24 hours but is classified later, the initial notification is due within 4 hours of that classification. If a deadline cannot be met, the entity must inform the competent authority before the deadline and explain why. DORA also allows voluntary notification of significant cyber threats.
| Stage | Deadline | Key point |
|---|---|---|
| Initial notification | Within 4 hours of classification; within 24 hours of awareness | Submit as early as possible; basic facts and materiality |
| Intermediate report | Within 72 hours of the initial notification | Required even if status unchanged; update after recovery |
| Final report | Within one month of the intermediate report | Root cause, impact, recovery, corrective measures |
| Late classification | Within 4 hours of classification | If classified major after 24 hours, the clock starts at classification |
| Unable to meet deadline | Before the deadline | Inform the authority and explain; no automatic waiver |
| Voluntary threat notification | Voluntary | Significant cyber threats may be notified proactively |
Sources: Regulation (EU) 2022/2554 Article 19 and Commission Delegated Regulation (EU) 2025/301 Article 5 (accessed 7 November 2026). Major-incident criteria, reporting templates/channels follow the RTS/ITS, competent authorities and national practice; this is not legal advice.
90-day implementation checklist
If DORA is not yet an auditable loop, use the first 90 days to close the cycle: scope and accountability, register, contracts, incident reporting, testing and evidence. The point is not to buy another tool but to connect the evidence regulators will ask for: who owns it, which ICT contracts exist, which support critical functions, how incidents are classified and reported, what testing covers and whether remediation is closed.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Confirm entity type, simplified-framework eligibility and competent authority | Scope conclusion, supervisory contact |
| Weeks 2-4 | Inventory ICT contracts, providers and critical/important function mapping | Draft register, critical function list |
| Weeks 3-5 | Close contract gaps: mandatory clauses, subcontracting/location/exit/audit rights | Contract gap list, remediation plan |
| Weeks 4-6 | Build major-incident classification and 4h/24h/72h/one-month reporting SOP | Classification matrix, templates, rota, drill |
| Weeks 6-9 | Annual basic testing plan; identify TLPT scope | Testing plan, TLPT scope and provider |
| Weeks 8-11 | Concentration, substitutability and exit risk assessment | Concentration report, exit playbook |
| Weeks 10-12 | Management review and evidence-pack review | Management review record, supervisory evidence index |
Editorial implementation advice, not an official template; specific contract clauses, register templates, testing requirements and report formats follow DORA, the RTS/ITS, competent authorities and national law.
FAQ
Does DORA apply now?
Yes. DORA entered into force on 16 January 2023 and has applied since 17 January 2025. The 2026 focus is execution: register, contract clauses, incident reporting, testing and critical-provider oversight.
Which entities does DORA cover?
More than 20 types of financial entities, including credit institutions, payment/electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, asset/fund managers, insurance/reinsurance undertakings, insurance intermediaries, occupational retirement provision institutions, credit rating agencies, statutory auditors and crowdfunding service providers. Check Article 2 and the national/competent authority scope.
Does DORA apply to non-EU ICT providers?
DORA's direct obligations fall mainly on financial entities; ICT providers are affected through contracts, due diligence and the register. Providers designated by the ESAs as critical ICT third-party service providers enter the EU oversight framework and may face information requests, recommendations and periodic penalty payments from the Lead Overseer. Non-EU providers serving EU financial entities should prepare for data-location, subcontracting-chain, audit/inspection, exit and supervisory-assistance clauses.
What are the exact major-incident reporting deadlines?
Under RTS (EU) 2025/301: initial notification within 4 hours of classification as major and no later than 24 hours from awareness; intermediate report within 72 hours of the initial notification; final report within one month of the intermediate report. If classified major after 24 hours, the initial notification is due within 4 hours of classification; if a deadline cannot be met, inform the authority before the deadline and explain why.
What goes in the ICT contract register?
All ICT third-party contracts, flagging whether they support critical/important functions; at minimum record the provider, service/function, contract start/end and termination, data processing/storage locations, subcontracting, concentration/substitutability and incident contacts. Report at least annually on new arrangements, provider categories, contract types and services/functions, and provide the full or partial register on request.
How often is TLPT required?
Article 26 requires identified financial entities (excluding microenterprises and entities under the simplified framework) to perform TLPT at least every three years; the competent authority may adjust the frequency based on risk. TLPT should cover several or all critical/important functions and use external threat intelligence.
What are DORA's fines?
DORA requires Member States to provide effective, proportionate and dissuasive administrative penalties and remedial measures, but does not set a single EU amount; critical ICT third-party service providers are subject to a separate Lead Overseer periodic penalty-payment mechanism. Specific amounts/procedures follow national law and supervisory practice.
How do DORA and NIS2 relate?
DORA is the sector-specific regime for finance; NIS2 is the cross-sector regime. NIS2 Article 4 allows for sector-specific rules with equivalent effect; in practice financial entities usually follow DORA and their sector rules, but they should confirm the boundary under NIS2 Article 4, national law and competent authority guidance to avoid reporting gaps or duplicate programmes.
Research method and limitations
This article separates "official facts" from "editorial advice": DORA's adoption/entry-into-force/application dates, the 20+ financial entity types, the five pillars, Article 19 reporting, Article 26 TLPT every three years, Articles 28-30 register/contracts and the critical ICT third-party oversight framework come from EUR-Lex Regulation (EU) 2022/2554 and the EIOPA/ESMA DORA pages; the 4h/24h/72h/one-month deadlines come from Article 5 of Commission Delegated Regulation (EU) 2025/301. The 90-day list and the "check/output" columns are editorial.
Eight limitations: (1) this is not legal advice; (2) national supervisory practice, fines and simplified-framework eligibility are not checked country by country; (3) not all RTS/ITS technical details (classification criteria, templates, register fields) are covered; (4) the critical ICT third-party list and oversight decisions will update; (5) the article does not provide a clause-by-clause DORA/NIS2/CRA/GDPR mapping; (6) no complete contract template or testing plan is provided; (7) the "EU presence" expectation for non-EU providers should be confirmed against the specific oversight/legal texts; (8) policy and supervisory practice may update, so recheck the official pages before publishing.
Sources and basis
- EUR-Lex, Regulation (EU) 2022/2554 (DORA): eur-lex.europa.eu/eli/reg/2022/2554/oj. Article 2 scope, Articles 5-16 ICT risk, 17-23 incidents, 24-27 testing, 28-30 third-party, 31-44 critical provider oversight, Article 50 penalties. Accessed 7 November 2026.
- EIOPA, Digital Operational Resilience Act (DORA): eiopa.europa.eu/digital-operational-resilience-act-dora_en. DORA applies from 17 January 2025; 20 financial entity types; ICT risk/third-party/testing/incidents/sharing/critical provider oversight. Accessed 7 November 2026.
- ESMA, Digital Operational Resilience Act (DORA): esma.europa.eu/.../digital-operational-resilience-act-dora. DORA entered into force 16 January 2023, applies 17 January 2025; more than 20 entity types, 12 in ESMA's remit. Accessed 7 November 2026.
- EUR-Lex, Commission Delegated Regulation (EU) 2025/301: eur-lex.europa.eu/eli/reg_del/2025/301/oj. Article 5: initial notification 4h/24h, intermediate 72h, final one month; late classification and inability to meet deadlines. Accessed 7 November 2026.
Data cut-off 7 November 2026; based on official texts and supervisory pages; not legal advice; specific obligations follow DORA, the RTS/ITS, competent authorities and national law.