.svg "ZealiD Logo New (1)"){kind=small}
NIS2 and DORA
NIS2 and DORA for your vendor review
NIS2 classes qualified trust service providers like ZealiD as essential entities. DORA asks banks and other financial firms to manage ZealiD as an ICT third-party provider. This page sets out what applies to us, and what we give your vendor review.
ZealiD AB · Qualified Trust Service Provider · Supervised by PTS, Sweden
NIS2 ART 3, 21, 23 · DORA ART 28 TO 30
Key dates
Four dates behind your vendor review
DORA applies to banks, payment and e-money institutions, investment firms and other financial entities. They must manage the risk of every ICT provider they use, including ZealiD.
Looking for our certificates and audit reports? Certifications →
Who each law regulates
NIS2 regulates ZealiD. DORA regulates your firm's use of ZealiD.
What NIS2 asks of ZealiD
- Management approves and oversees the cybersecurity risk measures
Art 20 - Risk measures in ten areas, from incident handling to supply chain and encryption
Art 21(2) - Early warning within 24 hours, notification within 72 hours, final report within a month
Art 23(4) - Trust service providers report significant incidents within 24 hours
Art 23(4) - In Sweden, these rules apply through the Cybersecurity Act
SFS 2025:1506
What DORA asks of your firm
Register every ICT provider.
Keep a register of information on all your ICT contracts and report it to your supervisor. Art 28(3)
Put the key clauses in the contract.
Service description, locations, incident help, audit and exit rights, with more for critical or important functions. Art 30(2), 30(3)
Vendor review
What your review asks, and where to find it
Article by article
Where ZealiD meets your NIS2 and DORA questions
Article numbers refer to Directive (EU) 2022/2555 (NIS2) and Regulation (EU) 2022/2554 (DORA). Exit terms, service level targets and testing cooperation are agreed in each contract.
Common mix-ups
Three things DORA doesn't mean
01
There is no DORA certificate.
DORA places its duties on financial entities. Providers support them through contracts, so a "DORA certified" badge proves nothing.
02
Not every provider is "critical".
The EU supervisors designate critical ICT third-party providers. Their first list, of 18 Nov 2025, names 19 large providers such as cloud and IT firms. ZealiD isn't one of them.
03
Your firm stays responsible.
A financial entity remains fully responsible for meeting DORA when it uses an ICT provider. Art 28(1)(a)
Where ZealiD stands: the DORA Addendum to our service agreement is published in our Repository, next to our service levels and practice statements.
Open the Repository →Claims we don't make
"NIS2 certified"
There is no NIS2 certificate. The law sets duties and a supervisor checks them.
"DORA compliant"
DORA's duties sit with financial entities. We support yours through the DORA Addendum.
"Audited by PTS"
PTS supervises ZealiD. Accredited conformity assessment bodies carry out the audits.
Trusted by banks, law firms and platforms
We are building a future-proof bank, digital by design… Our business clients can now sign their credit and guarantee documentation digitally with ZealID, a provider of qualified electronic signatures and a partner of ABN AMRO.
Meets German AML rules (GwG)
DocuSign resells ZealiD's qualified signature, with ID document data, to its customers in German finance for remote identification.
Read the case study →Qualified Trust Service Provider
Check us on the EU Trusted List, not on our word
- Listed on the EU Trusted List (Sweden): qualified certificates for electronic signatures, qualified timestamps and remote qualified signature creation
- Supervised by PTS, the Swedish Post and Telecom Authority
- Audited every year by TÜViT
- Identity checks certified against ETSI TS 119 461
- Documents stored in Stockholm, EU
ZealiD AB
QUALIFIED TRUST SERVICE PROVIDER
LISTED SERVICES · SWEDEN
Send us your vendor questionnaire
We answer security, NIS2 and DORA questions from banks and other regulated firms.
Questions about NIS2 and DORA
Is ZealiD covered by NIS2?
Yes. NIS2 classes qualified trust service providers as essential entities, whatever their size (Art 3(1)(b)). In Sweden, the Cybersecurity Act (SFS 2025:1506) has applied since 15 January 2026.
Who supervises ZealiD?
PTS, the Swedish Post and Telecom Authority, supervises ZealiD as a qualified trust service provider. Accredited conformity assessment bodies audit ZealiD every year.
Is ZealiD DORA compliant?
DORA has no certificate, and its duties sit with financial entities. ZealiD supports yours with a DORA Addendum to the service agreement, published in our Repository.
Is ZealiD a critical ICT third-party provider?
No. The EU supervisors' first list of critical ICT third-party providers, of 18 November 2025, names 19 large providers. ZealiD is an ICT third-party provider whose service may support a critical or important function at your firm.
What does the DORA Addendum cover?
Audit and inspection rights, a 24-hour incident notification, and subcontracting and service locations. Exit terms and service level targets are agreed in each contract.
Where is data stored?
Documents are stored in Stockholm, Sweden, inside the EU.
How fast does ZealiD report incidents?
To PTS, within 24 hours for significant incidents, under NIS2 and eIDAS. To your firm, as set in the DORA Addendum: within 24 hours.
Can we send our own security questionnaire?
Yes. Send it through our contact page and we'll answer it. Contact us.