Digital Operational Resilience Act DORA

DORA is the EU's rulebook for technology risk in finance. Its full reference is Regulation (EU) 2022/2554 of 14 December 2022. It is a regulation, so it is binding in its entirety and applies directly in all member states, without national implementing laws. It has applied since 17 January 2025 (Article 64).

The term in its title is defined in Article 3. Digital operational resilience is a financial entity's ability to build, assure and review its operational integrity and reliability, including through disruptions. The definition covers capabilities that the entity obtains from outside providers, which is why the law reaches technology suppliers.

DORA is often confused with the NIS2 Directive, a directive that covers many sectors. For financial entities, DORA is the sector-specific act and applies in its place (Article 1(2)).

The entities listed in Article 2(1). The list has twenty-one points, of which twenty are types of financial entity (Article 2(2)). They include credit institutions, payment institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, and managers of alternative investment funds.

ICT third-party service providers are the last point on the list. They are in scope without being financial entities.

Some small players are left out. Article 2(3) excludes, for example, insurance intermediaries that are micro, small or medium-sized enterprises. For everyone else the rules scale with size and risk profile (Article 4).

Law firms and accounting practices are not on the list. DORA does not apply to them as such.

It requires work in five areas, which the table sets out with the articles that govern each.

The first four are duties. The fifth is a permission. Throughout, the management body bears the ultimate responsibility for managing the entity's ICT risk (Article 5(2)).

The regulation does not itself state the hours or days for incident reports. Those time limits are left to technical standards drawn up under Article 20.

It means the contract changes. The financial entity stays fully responsible for compliance when it uses outside ICT services (Article 28(1)), so it passes its duties down in writing. This applies where the supplier provides ICT services, defined as digital and data services provided through ICT systems on an ongoing basis (Article 3). A software or cloud service fits that definition. Legal or tax advice does not.

Article 30(2) lists what every such contract must contain. The items include a full description of the services and whether subcontracting is allowed, the locations where services are provided and data is processed, and provisions on the availability, authenticity, integrity and confidentiality of data. The contract must also cover access to and return of data if the provider fails or the contract ends, service levels, help with ICT incidents, cooperation with the entity's authorities, and termination rights.

More is required where the service supports a critical or important function (Article 30(3)). The contract must then add precise performance targets, reporting duties, tested contingency plans, unrestricted rights of access, inspection and audit, and an exit strategy with a transition period.

It is a provider that the European Supervisory Authorities have designated as critical for financial entities (Article 31). The criteria include the systemic impact of a large-scale failure, the importance of the financial entities that rely on the provider, and how hard the provider would be to replace.

A designated provider is overseen directly at EU level by one of those authorities, acting as Lead Overseer. The Lead Overseer can request information, investigate, inspect and issue recommendations (Article 35). If the provider has not complied with a request, investigation or inspection, the Lead Overseer imposes a daily penalty payment, at the earliest 30 calendar days after notifying the measure. The amount is up to 1% of the provider's average daily worldwide turnover in the preceding business year, for no more than six months.