LegislationDigital, technology and crypto

DORA · Digital Operational Resilience Act

Regulation (EU) 2022/2554 · Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011

BOE / DOUE →EUR-Lex →

Legal status

In force since

16 January 2023 art. 64 (vigésimo día siguiente a la publicación); BOE, análisis de DOUE-L-2022-81962: 'Fecha de entrada en vigor: 16/01/2023'

Applies from

17 January 2025 art. 64, párrafo segundo ('Será aplicable a partir del 17 de enero de 2025')

Reforms in progress

Proposed 'Digital Omnibus' Regulation (simplification of the digital legislative framework, COM(2025) 837), which among other acts amends Regulation (EU) 2022/2554. The exact scope of the change to DORA is still to be checked against the official text of the proposal. Commission proposal (19/11/2025), procedure 2025/0360(COD). According to the European Parliament Legislative Observatory, checked on 12/11/2026: 'Awaiting committee decision' (latest event: amendments tabled in committee on 27/07/2026). Not adopted., 19 November 2025 →

Legal status reviewed on 12 November 2026 by The Neural Herald · Publications included up to 13 October 2026

What it is

Professional

DORA sets a uniform digital operational resilience framework for twenty categories of EU financial entities, applicable since 17 January 2025 (Art. 64). It requires an ICT risk management framework under the responsibility of the management body, classification and reporting of major incidents within deadlines set by RTS, a testing programme that includes TLPT at least every three years for identified entities, and management of ICT third-party risk through a register of information and minimum contractual clauses. It applies proportionately (Art. 4), with a simplified framework for certain entities (Art. 16). It also creates a direct oversight framework by the ESAs for critical ICT third-party service providers, whose first list was published on 18 November 2025.

Plain-language

DORA is an EU law that requires banks, insurers, fund managers, investment firms and other financial entities to be prepared for IT failures and cyberattacks. Since 17 January 2025 they must have plans to protect their systems, alert their supervisor within hours when they suffer a major incident and inform customers whose money is affected. Entities that are not microenterprises must test their systems regularly, and some, identified by the supervisor, must simulate real attacks at least every three years. They must also keep control over the technology companies that serve them, and the most important of these (such as large cloud providers) are now overseen directly by European supervisors. The obligations are scaled to each entity's size and risk, and some small entities follow a simpler regime.

Who it applies to

credit institutions
payment institutions, including those exempted under Directive (EU) 2015/2366
account information service providers
electronic money institutions, including those exempted under Directive 2009/110/EC
investment firms
crypto-asset service providers authorised under the Markets in Crypto-Assets Regulation, and issuers of asset-referenced tokens
central securities depositories
central counterparties
trading venues
trade repositories
managers of alternative investment funds
management companies
data reporting service providers
insurance and reinsurance undertakings
insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries
institutions for occupational retirement provision
credit rating agencies
administrators of critical benchmarks
crowdfunding service providers
securitisation repositories
ICT third-party service providers (not 'financial entities'; mainly concerned by Chapter V)

Exclusions:

managers of alternative investment funds referred to in Art. 3(2) of Directive 2011/61/EU
insurance and reinsurance undertakings referred to in Art. 4 of Directive 2009/138/EC
institutions for occupational retirement provision operating pension schemes with no more than 15 members in total
persons exempted under Arts. 2 and 3 of Directive 2014/65/EU
insurance, reinsurance and ancillary insurance intermediaries that are microenterprises or small or medium-sized enterprises
post office giro institutions referred to in Art. 2(5), point (3), of Directive 2013/36/EU
Member States may exclude entities referred to in Art. 2(5), points (4) to (23), of Directive 2013/36/EU located in their territory (Art. 2(4))

art. 2 (apartados 1, 3 y 4); proporcionalidad: art. 4; marco simplificado: art. 16

What it requires and what to review

Obligation	Who	From	Basis
The management body defines, approves and oversees the ICT risk management framework and is accountable for its implementation.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 5
Maintain a documented ICT risk management framework (identification, protection, detection, response and recovery, backup, learning, communication) and review it at least once a year (periodically for microenterprises).	Financial entities (Art. 2(1)(a)-(t)), except those in Art. 16(1)	17 January 2025	↗" target="_blank" rel="noopener">arts. 6-15; desarrollo: Reglamento Delegado (UE) 2024/1774
Apply a simplified ICT risk management framework instead of Arts. 5 to 15.	Small and non-interconnected investment firms, exempted payment and e-money institutions, entities exempted under Directive 2013/36/EU not excluded by their Member State, and small IORPs	17 January 2025	↗" target="_blank" rel="noopener">art. 16; desarrollo: Reglamento Delegado (UE) 2024/1774
Set up an ICT-related incident management process, record all ICT-related incidents and significant cyber threats and classify them using the RTS criteria.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">arts. 17-18; desarrollo: Reglamento Delegado (UE) 2024/1772
Report major ICT-related incidents to the competent authority: initial notification (within 4 hours of classification as major and no later than 24 hours after becoming aware), intermediate report (no later than 72 hours after the initial notification) and final report (no later than one month after the latest intermediate report), using standard templates.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 19.1 y 19.4; plazos: art. 5 del Reglamento Delegado (UE) 2025/301; plantillas: Reglamento de Ejecución (UE) 2025/302
Inform clients without undue delay of a major incident affecting their financial interests and of the measures taken.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 19.3
Voluntary notification of significant cyber threats to the competent authority.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 19.2
Maintain a risk-based digital operational resilience testing programme, carried out by independent (internal or external) parties, and remediate the weaknesses found.	Financial entities other than microenterprises	17 January 2025	↗" target="_blank" rel="noopener">arts. 24-25
Carry out threat-led penetration testing (TLPT) at least every three years on live production systems supporting critical or important functions; the competent authority may change the frequency.	Financial entities identified by competent authorities (Art. 26(8), third subparagraph), other than those in Art. 16(1) and microenterprises	17 January 2025	↗" target="_blank" rel="noopener">arts. 26-27; desarrollo: Reglamento Delegado (UE) 2025/1190
Adopt and periodically review a strategy on ICT third-party risk, including a policy on ICT services supporting critical or important functions.	Financial entities other than those in Art. 16(1) and microenterprises	17 January 2025	↗" target="_blank" rel="noopener">art. 28.2; desarrollo: Reglamento Delegado (UE) 2024/1773
Maintain a register of information on all contractual arrangements for ICT services with third parties (entity, sub-consolidated and consolidated level), make it available to the competent authority on request and report at least once a year on new arrangements.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 28.3; plantillas: Reglamento de Ejecución (UE) 2024/2956
Assess risks before contracting ICT services, including concentration risk, and have exit strategies for services supporting critical or important functions.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">arts. 28.4, 28.8 y 29
Include the required minimum clauses in ICT service contracts, with additional requirements where they support critical or important functions, and assess subcontracting of such services.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 30; subcontratación: Reglamento Delegado (UE) 2025/532
Use a critical ICT third-party service provider established in a third country only if it has set up a subsidiary in the Union within 12 months of its designation.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 31.12
Report to the competent authority, on request, an estimate of aggregated annual costs and losses caused by major ICT-related incidents.	Financial entities other than microenterprises	17 January 2025	↗" target="_blank" rel="noopener">art. 11.10; Directrices conjuntas JC 2024/34 (aplicables desde el 19/05/2025)
Notify competent authorities when joining, or leaving, cyber threat information-sharing arrangements.	Financial entities (Art. 2(1)(a)-(t))	17 January 2025	↗" target="_blank" rel="noopener">art. 45.3
Be subject to the EU oversight framework (information requests, investigations, inspections, recommendations) and pay oversight fees.	Critical ICT third-party service providers designated by the ESAs	17 January 2025	↗" target="_blank" rel="noopener">arts. 31-43; criterios: Reglamento Delegado (UE) 2024/1502; tasas: Reglamento Delegado (UE) 2024/1505

General guidance based on the official text. Not legal advice or a compliance assessment.

Upcoming milestones

17 January 2028Deadline for the Commission's review of DORA (designation criteria for critical providers, voluntary reporting of cyber threats, regime for third-country providers, among others), with a report and, where appropriate, a legislative proposal. art. 58.1

Recent milestones

29 March 2026End of the window for entities requested by the CNMV to submit their register of information (reference date 31/12/2025; corrections until 22/04/2026). ↗

17 January 2026Deadline for the Commission to report on whether to strengthen digital operational resilience requirements for statutory auditors and audit firms. art. 58.3

18 November 2025The ESAs (EBA, EIOPA and ESMA) publish the first list of critical ICT third-party service providers (19 providers). ↗

17 January 2025DORA becomes applicable. art. 64

Map of texts

The legal act

Implementing rules (technical standards and delegated acts)

Guidelines and Q&As (non-binding)

Authorities

EBA, EIOPA y ESMA (AES): Designate critical ICT third-party service providers through the Joint Committee, publish and update their list annually and act as Lead Overseer for each of them (Arts. 31-44); draft RTS/ITS, guidelines and Q&As.
Comisión Europea: Adopts the delegated and implementing acts supplementing DORA and carries out the reviews provided for in Art. 58.
BCE: Competent authority for significant credit institutions (Art. 46(a)); receives, via the national authority, those institutions' major incident reports (Art. 19(1)).
Autoridades competentes nacionales: Ensure compliance by financial entities according to the sectoral allocation in Art. 46, receive incident reports and registers of information and may impose penalties and remedial measures (Arts. 50-51).
CNMV: Requests and receives the ICT provider register of information from the entities it supervises and has adopted the Joint Guidelines on oversight cooperation (operational guides of 20/02/2025 and 12/02/2026).

Supervisor publications on this rule

Collected automatically from the CNMV, Bank of Spain, ECB, ESMA, EBA and EIOPA since January 2025. Partial coverage: it does not include everything published before 2025.

13 October 2026ESMAJoint Committee Annual Work Programme 2027Report · mentions it
13 October 2026ESMAEuropean Supervisory Authorities set priorities for 2027Noticia · mentions it
13 October 2026EBAEuropean Supervisory Authorities set priorities for 2027Press Release · mentions it
13 October 2026EIOPAEuropean Supervisory Authorities set priorities for 2027News article · mentions it
18 September 2026EBAThe EBA publishes its final Guidelines on the management of third-party risk, delivering a more proportionate and consistent framework aligned with DORAPress Release · about the rule
16 September 2026EBADORA incident reporting - Operational InstructionsDocumento · about the rule
8 July 2026ESMAESMA launches Common Supervisory Action on CASPs’ digital operational resilience for custodyNoticia · about the rule
16 June 2026EBAThe EBA publishes its 2025 Annual Report outlining key achievementsPress Release · mentions it
3 June 2026ESMAESAs publish the first report on DORA major ICT-related incidentsNoticia · about the rule
3 June 2026EBAESAs publish the first report on DORA major ICT-related incidentsPress Release · about the rule
3 June 2026EIOPAESAs publish the first report on DORA major ICT-related incidentsNews article · about the rule
24 April 2026ESMAJoint Committee annual report highlights digitalisation, cyber resilience and sustainable finance as key priorities of 2025Noticia · mentions it
24 April 2026EBAThe ESA’s Joint Committee highlights digitalisation, cyber resilience and sustainable finance as key priorities of 2025Press Release · mentions it
23 February 2026EBAThe EBA publishes follow-up Report on ICT risk assessment under the Supervisory Review and Evaluation ProcessPress Release · mentions it
12 February 2026CNMVLa CNMV publica preguntas frecuentes sobre el Reglamento de resiliencia operativa digital (DORA)Nota de prensa · about the rule
16 January 2026ESMADecision of the Board of Supervisors delegating to the Chair of ESMA the adoption of non-controversial Q&As under DORADecision · about the rule
16 January 2026EIOPABoS Decision on the Delegation of certain DORA Q&As to the ChairpersonGeneral publications · about the rule
14 January 2026ESMAThe European Supervisory Authorities and UK financial regulators sign Memorandum of Understanding on oversight of critical ICT third-party service providers under DORANoticia · about the rule
14 January 2026EBAMemorandum of Understanding on DORA oversight of critical ICT third-party service providers in EU and UKOther publication · about the rule
14 January 2026EBAESAs targeted equivalence assessment of DORA confidentiality and professional secrecy regimesOther publication · about the rule
14 January 2026EBAThe European Supervisory Authorities and UK financial regulators sign Memorandum of Understanding on oversight of critical ICT third-party service providers under DORAPress Release · about the rule
14 January 2026EIOPAEuropean Supervisory Authorities and UK financial regulators sign Memorandum of Understanding on oversight of critical ICT third-party service providers under DORANews article · about the rule
17 December 2025ESMAJoint ESAs Report in response to the European Commission consultation pursuant to Article 58(3) of Regulation (EU) 2022/2554 (DORA)Report · about the rule
17 December 2025EBAJoint ESAs Report on Consultation pursuant to Article 58 of DORAReport · about the rule
17 December 2025EIOPAJoint ESAs Report in response to the European Commission consultation pursuant to Article 58(3) of Regulation (EU) 2022/2554 (DORA)Report · about the rule
21 November 2025ECBTIBER-EU guide - How to implement the TIBER-EU framework for the DORA TLPT of significant institutionsGuia supervisora · about the rule
18 November 2025ESMAThe European Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience ActNoticia · about the rule
18 November 2025EBAThe European Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience ActPress Release · about the rule
18 November 2025EIOPAEuropean Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience ActNews article · about the rule
16 October 2025EBAESAs’ Joint Committee publishes Work Programme for 2026Press Release · mentions it
16 October 2025EIOPAESAs’ Joint Committee publishes Work Programme for 2026News article · mentions it
14 October 2025EBAJoint General Privacy statement - DORA OversightDocumento · about the rule
7 August 2025EBAThe EBA consults on revised Guidelines on internal governancePress Release · mentions it
15 July 2025EBAESAs publish guide on DORA Oversight activitiesPress Release · about the rule
15 July 2025EBAGuide on DORA oversight of critical third-party providers activitiesOther publication · about the rule
15 July 2025EIOPAESAs publish guide on DORA Oversight activitiesNews article · about the rule
15 July 2025EIOPADORA Oversight GuideGeneral publications · about the rule
8 July 2025EBAThe EBA launches consultation on its draft Guidelines on third-party risk management with regard to non-ICT related servicesPress Release · mentions it
2 July 2025Bank of SpainReglamento Delegado (UE) 2025/532 de la Comisión de 24 de marzo de 2025 por el que se completa el Reglamento (UE) 2022/2554 del Parlamento Europeo y del Consejo en lo que respecta a las normas técnicas de regulación que especifican los elementos que debe determinar y evaluar una entidad financiera cuando subcontrata servicios de TIC que sustentan funciones esenciales o importantes (Texto pertinente a efectos del EEE) (DOUE de 2 de julio de 2025)Legislación financiera DOUE · about the rule
24 June 2025EIOPADisclosed documents - FSC Meeting on 18.06.2025 - Progress update on the start of ESAs’ DORA oversight activitiesGeneral publications · about the rule
1 April 2025EBAData Model for DORA RoIDocumento · about the rule
18 March 2025EIOPAJoint Guidelines on estimation of aggregated annual costs and losses caused by major ICT-related incidents under DORAGuidelines · about the rule
7 March 2025ESMAESAs Opinion on the rejection of the RTS on subcontracting under DORAOpinion · about the rule
7 March 2025EBAThe ESAs acknowledge the European Commission's amendments to the technical standard on subcontracting under the Digital Operational Resilience ActPress Release · about the rule
7 March 2025EBAESAs Joint Committee Opinion on the rejection of the RTS on subcontracting under DORAOpinion · about the rule
7 March 2025EIOPAThe ESAs acknowledge the European Commission's amendments to the technical standard on subcontracting under the Digital Operational Resilience ActNews article · about the rule
7 March 2025EIOPAESAs' Opinion on the draft Regulatory Technical Standard on subcontracting under DORATechnical standard · about the rule
18 February 2025EBAThe ESAs provide a roadmap towards the designation of CTPPs under DORAPress Release · about the rule
18 February 2025EBARoadmap towards the designation of CTPPs under DORAOther publication · about the rule
18 February 2025EIOPAThe ESAs provide a roadmap towards the designation of CTPPs under DORANews article · about the rule
13 February 2025Bank of SpainReglamento Delegado (UE) 2025/1190 de la Comisión, de 13 de febrero de 2025, por el que se completa el Reglamento (UE) 2022/2554 del Parlamento Europeo y del Consejo en lo que respecta a las normas técnicas de regulación que especifican los criterios utilizados para determinar qué entidades financieras están obligadas a realizar pruebas de penetración basadas en amenazas, los requisitos y normas que rigen el uso de probadores internos, los requisitos en relación con el alcance, la metodología y el enfoque de realización de pruebas en las fases de prueba, resultados, conclusión y adopción de medidas correctoras, y el tipo de cooperación en materia de supervisión y otros tipos de cooperación pertinente necesarios para la realización de las pruebas de penetración basadas en amenazas y para facilitar el reconocimiento mutuo (Texto pertinente a efectos del EEE) (DOUE de 18 de junio)Legislación financiera DOUE · about the rule
11 February 2025ECBTIBER-EU Framework updated to align with DORANoticia de infraestructuras de mercado · about the rule
11 February 2025EBAThe EBA amends its Guidelines on ICT and security risk management measures in the context of DORA applicationPress Release · about the rule
17 January 2025EBAPreparing Plain csv reporting package for DORADocumento · about the rule
17 January 2025EIOPAJoint Committee Report on the feasibility for further centralisation of reporting of major ICT-related incidents under DORAReport · about the rule
17 January 2025ESMAESAs publish study on feasibility of further centralisation of major ICT-related incident reporting by financial entitiesNoticia · mentions it
17 January 2025EBAESAs publish study on feasibility of further centralisation of major ICT-related incident reporting by financial entitiesPress Release · mentions it
17 January 2025EBAThe EBA repeals the Guidelines on major incident reporting under the revised Payment Services DirectivePress Release · mentions it

Related rules

NIS2

Fact sheet history

12 November 2026: Ficha creada (borrador)
12 November 2026: Ficha revisada y aprobada para su publicacion

Fact sheet drafted with the help of artificial intelligence from the linked official texts and reviewed by the editorial team. It is general information, not legal advice: always check the rule as published in the Official Journal.