regulation
DORA
ICT resilience for finance, applying directly since 17 January 2025. If you sell software to a bank, it arrives on your desk as contract terms.
- what it is
- A regulation. It applies directly, with no national act in between.
- who it covers
- 20 types of financial entity, plus their ICT third-party providers.
- the size line
- None for coming into scope. The work scales with size and risk.
- fine ceilings
- No EU figure. Member states set them.
- who answers
- The management body bears ultimate responsibility for ICT risk.
- status
- Applying. A proposal would change how incidents are filed, and is still in committee.
basis DORA Art. 2(1), 4(1), 5(2), 50(3), 64
two ways in
You are a financial entity. Banks, payment and e-money institutions, investment firms, insurers and intermediaries, crypto-asset service providers, fund managers and others. A few very small schemes are excluded, so read the list before you assume.
You sell ICT services to one. For a software company this usually arrives as contract changes from a bank customer, because the regulation lists what those contracts must contain.
how DORA reaches a software company
- mandatory contract terms
- locations, data return, security
- help in an incident
- conditions on subcontracting
basis DORA Art. 2(1), 28(1), 28(3), 30(2)
Finance sits in NIS2 too, but NIS2 steps aside where a sector law is at least equivalent, and DORA is that law for the entities it covers.
basis DORA Art. 2(1), 2(3), 30(2); NIS2 Art. 4(1)
what it asks for
Five groups of duty: a documented ICT risk framework with an asset inventory; incident classification and three stages of reporting; a resilience testing programme, unless you are a microenterprise; a register of all ICT contracts with mandatory terms; and a management body that defines, approves, funds and oversees all of it.
The reporting clocks are the tightest on this site.
one event, three clocks
basis NIS2 Art. 23(4); RTS 2025/301 Art. 5(1); GDPR Art. 33(1), 34(1); KSC Art. 11
basis DORA Art. 5(2), 6(1), 8(1), 17(1), 19(1), 24(1), 28(3), 30(2)
where small firms get room
Proportionality is the rule across the risk management chapter. A named set of firms, including small and non-interconnected investment firms and exempted payment and e-money institutions, get a simplified framework. Check you are on the list before relying on it. Your supervisor reads this with you, and it is worth asking early.
basis DORA Art. 4(1), 16(1)
where it overlaps
Most of this is the work NIS2 and GDPR ask for: the map shows it row by row. One breach of ICT systems holding personal data can start the DORA clock and the GDPR clock from the same event.
basis DORA Art. 19(1); GDPR Art. 33(1)
what may change
The Digital Omnibus, proposed in November 2025, lists DORA among the acts it would amend, mainly around where incidents are reported. It awaits a committee decision in Parliament, and your duty to report has not changed.
basis procedure 2025/0360(COD)
the work under DORA
- incident reportingOne event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.
- supplier riskYour suppliers' failures count as yours. Three rules ask for the same thing: know who they are, look at them in proportion, and put security in the contract.
- the board's partSecurity decisions now need a director's signature. A board does not have to understand firewall rules. It has to see risks, cost and choice, decide, and be able to show that it did.
- access controlWho can get in, who said so, and when someone last checked. Every rule asks the same thing in slightly different words, which makes this the most reusable work on the site.
- risk assessmentEvery rule says appropriate to the risk. Without a written assessment you cannot show that anything you did was appropriate, and you have no honest way to do less.
- backups and recoveryA backup counts once you have restored from it. One timed restore tells you more than a plan, and it leaves a record that shows the control runs.
- trainingThree rules ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
- patching and checking it worksPatch on a schedule you wrote down, handle the reports that come in, and test once a year whether the rest of your controls run. Companies skip the last part because nothing breaks when they do.
check it yourself
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Commission Delegated Regulation (EU) 2025/301 (DORA incident reporting time limits) (EUR-Lex)
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Poland: Act of 23 January 2026 amending the national cybersecurity system act, Dz.U. 2026 poz. 252 (Dziennik Ustaw)
- European Parliament, Legislative Observatory: procedure 2025/0360(COD), Digital Omnibus
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Open your list of ICT contracts and mark which ones support a critical or important function.