Docs

Appearance

DORA — Digital Operational Resilience Act ​

DORA illustration

The Digital Operational Resilience Act (DORA) is Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 “on digital operational resilience for the financial sector”. DORA sets requirements for “the security of network and information systems supporting the business processes of financial entities” (Article 1).

This page gives the dates, status, and structure of DORA, and the entities that DORA applies to. It also gives the penalties, the Modulos Frameworks, and how DORA, NIS2, and the EU AI Act apply together. Five more pages give more information:

Dates and status of DORA ​

Regulation (EU) 2022/2554 is in the Official Journal of the European Union, OJ L 333, 27.12.2022, p. 1. Its full name is “Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011”.

DORA entered into force on 16 January 2023, the twentieth day after its publication in the Official Journal on 27 December 2022. DORA applies from 17 January 2025 (Article 64). DORA is “binding in its entirety and directly applicable in all Member States” (Article 64). The recitals of DORA help you to read its Articles, but they do not set obligations.

DORA and the other sources do not have the same status. This list gives their status and the page for each source:

  • The eight Commission Regulations — each Regulation that supplements DORA is “binding in its entirety and directly applicable in all Member States”. See The eight Commission Regulations.
  • Joint Guidelines JC 2024 34 — guidelines of the European Supervisory Authorities (ESAs), with which competent authorities and financial institutions “must make every effort to comply”. See Joint Guidelines JC 2024 34.
  • ESAs statement JC 2026 25 — a statement of 31 July 2026 on ICT risks from frontier AI models. The statement is not law, and its Annex “does not establish additional requirements”. See DORA and the EU AI Act.
  • Digital Omnibus, COM(2025) 837 — the proposal of 19 November 2025 for Article 19 reports and voluntary notifications through a single-entry point is not law as of October 2026.

DORA and digital operational resilience ​

DORA Article 1(1) starts: “In order to achieve a high common level of digital operational resilience”.

The recitals of DORA show the problem before DORA:

  • Recital 10 tells you that “there are gaps or overlaps in important areas”, because of “the ICT risk related provisions being only partially addressed at Union level”.
  • Recital 9 tells you that “Legislative disparities and uneven national regulatory or supervisory approaches with regard to ICT risk trigger obstacles to the functioning of the internal market in financial services”.
  • Recital 12 tells you that DORA “aims to consolidate and upgrade ICT risk requirements as part of the operational risk requirements that have, up to this point, been addressed separately in various Union legal acts”. Recital 12 also tells you that “all provisions addressing digital risk in the financial sector should for the first time be brought together in a consistent manner in one single legislative act”.

DORA structure ​

Regulation (EU) 2022/2554 (DORA)
Chapter I — General provisionsArticles 1 to 4: subject matter, scope, definitions, and the proportionality principle
Chapter II — ICT risk managementArticles 5 to 16: governance and organization (Article 5), the ICT risk management framework (Articles 6 to 14), the mandate for technical standards (Article 15), and the simplified ICT risk management framework (Article 16)
Chapter III — ICT-related incident management, classification and reportingArticles 17 to 23: incident management process, classification, reports and voluntary notifications, reporting content and templates, centralization of reports, supervisory feedback, and payment-related incidents
Chapter IV — Digital operational resilience testingArticles 24 to 27: general requirements, tests of ICT tools and systems, threat-led penetration testing (TLPT), and requirements for TLPT testers
Chapter V, Section I — Key principles for a sound management of ICT third-party riskArticles 28 to 30: general principles and the register of information (Article 28), ICT concentration risk (Article 29), and key contractual provisions (Article 30)
Chapter V, Section II — Oversight Framework of critical ICT third-party service providersArticles 31 to 44: designation, the Oversight Forum, the Lead Overseer and its powers, periodic penalty payments, and follow-up by competent authorities
Chapter VI — Information-sharing arrangementsArticle 45: exchange of cyber threat information and intelligence between financial entities
Chapter VII — Competent authoritiesArticles 46 to 56: competent authorities, cooperation, administrative and criminal penalties, publication of penalties, professional secrecy, and data protection
Chapter VIII — Delegated actsArticle 57: exercise of the delegation
Chapter IX — Transitional and final provisionsArticles 58 to 64: review clause, amendments to five Regulations, and entry into force and application (Article 64)

DORA has nine chapters with obligations for financial entities and an Oversight Framework for critical ICT third-party service providers. Chapters II to V contain five primary parts, with two sections in Chapter V:

DORA Chapter VI (Article 45) gives the rules on information-sharing arrangements between financial entities. See DORA Information Sharing and Level 2 Acts. For Chapter VII, see Penalties and enforcement.

Who DORA applies to ​

DORA applies to the entities in Article 2(1), with the exclusions in Article 2(3) and those that a Member State applies through Article 2(4). See Article 2 for the entity types and exclusions.

The entities in Article 16(1) apply the simplified ICT risk management framework. Articles 5 to 15 do not apply to these entities. Some DORA duties also exclude microenterprises.

An ICT third-party service provider (DORA Article 2(1)(u)) is also a financial entity if Article 2(1), points (a) to (t), apply to it. Article 31(8)(i) excludes financial entities that supply ICT services to other financial entities from designation as critical ICT third-party service providers. See DORA Testing and Third-Party Risk.

The ESAs’ list of 18 November 2025 names 19 designated critical ICT third-party service providers. For the ESAs’ duty to “update yearly” the list (Article 31(9)), see Designated critical ICT third-party service providers.

Article 1(2) — DORA and NIS2 ​

For financial entities identified as essential or important entities by “national rules” that transpose NIS2 Article 3, DORA is a sector-specific Union legal act (Article 1(2)). Where DORA's requirements for cybersecurity risk-management measures or incident notifications are “at least equivalent in effect” to the NIS2 obligations, the “relevant provisions” of NIS2 do not apply (NIS2 Article 4(1)).

For the test in NIS2 Article 4(2), see Article 1(2) and NIS2 and DORA compared.

DORA and the EU AI Act ​

DORA has no provision on AI as such. The ESAs statement JC 2026 25 of 31 July 2026, “Toward a consistent and risk-based approach for ICT risks from frontier AI models”, tells financial entities that DORA and the AI Act “provide a solid foundation” for these risks. The statement is not law, and it sets no new obligation. See The ESAs statement on ICT risks from frontier AI models.

The EU AI Act, Regulation (EU) 2024/1689, is a different Regulation. For how DORA and the EU AI Act apply together, see EU AI Act and DORA compared and EU AI Act.

Penalties and enforcement ​

DORA Chapter VII (Articles 46 to 56) gives the rules on competent authorities and penalties. Article 46 gives the competent authorities that make sure of compliance with DORA “in accordance with the powers granted by the respective legal acts”. This rule applies “Without prejudice to the provisions on the Oversight Framework for critical ICT third-party service providers”. For each type of financial entity, Article 46 refers to a competent authority designated in a different Union law.

For example, for credit institutions, Article 46(a) refers to “the competent authority designated in accordance with Article 4 of that Directive”, Directive 2013/36/EU. For credit institutions “classified as significant”, it refers to the European Central Bank (ECB). For each critical ICT third-party service provider, the ESAs appoint a Lead Overseer (Article 31(1), point (b)).

DORA Chapter VII also gives rules on “cooperation” with the structures and authorities of NIS2 (Article 47) and between authorities (Article 48). It also gives rules on the publication of administrative penalties (Article 54) and on “Professional secrecy” (Article 55).

Administrative penalties and remedial measures ​

DORA does not set the penalties for financial entities. The national law of each Member State sets them, with these minimum rules of DORA Articles 50 and 52:

  • Competent authorities have “all supervisory, investigatory and sanctioning powers necessary to fulfil their duties under this Regulation” (Article 50(1)). As a minimum, these powers include access to “any document or data held in any form that the competent authority considers relevant for the performance of its duties” (Article 50(2)(a)). They also include the power to “carry out on-site inspections or investigations” and to “require corrective and remedial measures for breaches of the requirements of this Regulation” (Article 50(2)(b) and (c)).
  • Member States set rules on “appropriate administrative penalties and remedial measures for breaches of this Regulation”, and they “shall ensure their effective implementation” (Article 50(3)). “Those penalties and measures shall be effective, proportionate and dissuasive.”
  • As a minimum, Member States give competent authorities the powers of Article 50(4). An example is the power to “issue an order requiring the natural or legal person to cease conduct that is in breach of this Regulation and to desist from a repetition of that conduct” (point (a)). A different example is the power to “issue public notices, including public statements indicating the identity of the natural or legal person and the nature of the breach” (point (e)).
  • If Article 50(2), point (c), and Article 50(4) apply to legal persons, Member States give competent authorities the power to apply the penalties and measures also “to members of the management body, and to other individuals who under national law are responsible for the breach”. This power applies on the conditions of national law (Article 50(5)).
  • Each decision that imposes administrative penalties or remedial measures of Article 50(2), point (c), “is properly reasoned and is subject to a right of appeal” (Article 50(6)).
  • “Member States may decide not to lay down rules for administrative penalties or remedial measures for breaches that are subject to criminal penalties under their national law” (Article 52(1)).

Periodic penalty payments on critical ICT third-party service providers ​

The Lead Overseer can impose periodic penalty payments on a critical ICT third-party service provider (Article 35):

  • The Lead Overseer must make a decision that imposes a periodic penalty payment “In the event of whole or partial non-compliance with the measures required to be taken pursuant to the exercise of the powers under paragraph 1, points (a), (b) and (c)”. The decision comes “after the expiry of a period of at least 30 calendar days from the date on which the critical ICT third-party service provider received notification of the respective measures” (Article 35(6)).
  • The periodic penalty payment is “imposed on a daily basis until compliance is achieved and for no more than a period of six months following the notification of the decision” (Article 35(7)).
  • The periodic penalty payment is “up to 1 % of the average daily worldwide turnover of the critical ICT third-party service provider in the preceding business year” (Article 35(8)).
  • The Lead Overseer must “disclose to the public every periodic penalty payment that has been imposed, unless such disclosure would seriously jeopardise the financial markets or cause disproportionate damage to the parties involved” (Article 35(10)).

DORA in Modulos ​

Modulos has two Frameworks with the name “DORA”: OFF-16 at the Organization level and MFF-16 at the AI System level. The MFF-16 Requirements are a Modulos assessment practice: they assess how a “service or application” (a Modulos name, not a DORA name) helps a financial entity with its DORA duties. The financial entity has these duties (Articles 5(1), 6(1), and 28(1)). See How to set up DORA in Modulos for the decisions, steps, and Requirements.

Where to go next ​

DORA Applicability and Governance

Articles 1, 2, 4, 5, 6, and 16: scope, how DORA and NIS2 apply together, the management body, and the two frameworks.

DORA ICT Risk and Resilience Operations

Articles 7 to 23: ICT risk management, reports of incidents, and their time limits.

DORA Testing and Third-Party Risk

Articles 24 to 44: tests, TLPT, ICT third-party risk, the register of information, and the Oversight Framework.

DORA Information Sharing and Level 2 Acts

Article 45 and the eight Commission Regulations.

How to set up DORA in Modulos

The Frameworks, the decisions, the steps, and the Requirements.

NIS2 and DORA compared

How NIS2 and DORA apply together.

EU AI Act and DORA compared

How the EU AI Act and DORA apply together.

Frequently asked questions about DORA ​

For more information about DORA, see Frequently asked questions about DORA.

Sources of this page ​

  • DORA, Regulation (EU) 2022/2554, OJ L 333, 27.12.2022, p. 1 (EUR-Lex): Articles 1, 2, 3(60), 16(1), 19, 23, 28(1), and 31. Also Articles 35(6) to (8), 35(10), 45, 46 to 52, 54, 55, and 64, and recitals 9, 10, and 12.
  • The eight Commission Regulations that supplement DORA: Delegated Regulations (EU) 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/532, and 2025/1190, and Implementing Regulations (EU) 2024/2956 and 2025/302. For the full name and the dates of each Regulation, see The eight Commission Regulations.
  • NIS2 Directive, Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80: Article 4(1) and (2) (EUR-Lex).
  • ESAs Joint Guidelines JC 2024 34, “Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents”, 5 June 2024: the status of the Guidelines and the date from which they apply (EBA).
  • ESAs press release of 18 November 2025, “The European Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience Act” (ESMA).
  • ESAs list of designated critical ICT third-party service providers, Article 31(9) (ESMA).
  • ESAs statement JC 2026 25 of 31 July 2026, “Toward a consistent and risk-based approach for ICT risks from frontier AI models”: paragraph 5 and the Annex (ESMA).
  • COM(2025) 837, the Digital Omnibus proposal of the European Commission of 19 November 2025: Article 8 (EUR-Lex).
  • Procedure 2025/0360(COD), Legislative Observatory of the European Parliament, status in October 2026 (European Parliament).

Disclaimer

This page gives general information. It is not legal advice. DORA applies directly in all Member States. The obligations come from DORA and from the Commission Regulations that supplement it. The competent authorities in Article 46 make sure of compliance. Before you make a decision, read DORA on EUR-Lex and speak to a lawyer.