Frequently asked questions about DORA

Use this DORA FAQ to find the rules that apply to your financial entity.

Disclaimer

This page gives general information. It is not legal advice.

What is DORA?

DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554 of 14 December 2022 “on digital operational resilience for the financial sector”. DORA “lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities” (Article 1(1)). DORA gives obligations to financial entities, and it gives the rules of the Oversight Framework for critical ICT third-party service providers. DORA applies from 17 January 2025, and it is “binding in its entirety and directly applicable in all Member States” (Article 64). Eight Commission Regulations supplement DORA. See Dates and status of DORA and Article 1.

Who must comply with DORA?

DORA applies to the financial entities in Article 2(1), points (a) to (t) (Article 2(2)). Examples are credit institutions, payment institutions, investment firms, and insurance undertakings. Article 2(3) excludes six types of entity, and Article 2(4) lets a Member State exclude some entities (Article 2).

ICT third-party service providers (point (u)) are in scope. They are also financial entities if Article 2(1), points (a) to (t), apply to them (Article 2(2)). The Oversight Framework applies to critical ICT third-party service providers that the ESAs designate (Who DORA applies to). Articles 5 to 15 do not apply to the entities in Article 16(1) (Article 16). Many obligations do not apply to microenterprises (Article 3).

When does DORA apply?

DORA applies from 17 January 2025 (Article 64). DORA entered into force on 16 January 2023, “the twentieth day following” its publication in the Official Journal on 27 December 2022. Each of the eight Commission Regulations that supplement DORA enters into force on “the twentieth day following” its publication. None gives a different date from which it applies.

The ESAs Joint Guidelines JC 2024 34 apply from 19 May 2025. The Digital Omnibus, COM(2025) 837 of 19 November 2025, is a proposal to change DORA Article 19, and as of October 2026 it is not law. See Dates and status of DORA.

What are DORA's main pillars?

The primary obligations of DORA are in five parts in Chapters II to V. The first three parts are ICT risk management (Articles 5 to 16), ICT-related incidents (Articles 17 to 23), and digital operational resilience testing (Articles 24 to 27). The last two parts are ICT third-party risk (Articles 28 to 30) and the Oversight Framework for critical ICT third-party service providers (Articles 31 to 44). In Chapter II, the frameworks of Articles 5 to 15 and of Article 16 are alternatives (Two alternative regimes). Chapter VI (Article 45) adds information-sharing arrangements with a duty to notify (Article 45). See DORA structure.

What is the DORA register of information?

DORA Article 28(3) tells financial entities to “maintain and update” a register of information for all contractual arrangements on ICT services from ICT third-party service providers. They keep it “at entity level, and at sub-consolidated and consolidated levels”. Records must show which contractual arrangements include ICT services supporting critical or important functions and which do not. Implementing Regulation (EU) 2024/2956 gives the templates.

Article 28(3) also tells financial entities to:

• Report to competent authorities “at least yearly”.
• Give the competent authority access to the register of information and information for “effective supervision”, “upon its request”.
• Notify the competent authority “in a timely manner” of “any planned contractual arrangement” on ICT services supporting critical or important functions. Also notify it “in a timely manner” when a function becomes “critical or important”.

For Article 16(1) entities, check with the competent authority how this applies. See Article 28(3).

Who can use the DORA simplified ICT risk management framework?

DORA Article 16(1) applies directly to these financial entities:

• Small and non-interconnected investment firms.
• Exempted payment institutions and exempted electronic money institutions.
• Institutions exempted through Directive 2013/36/EU where the Member State does not use DORA Article 2(4).
• Small institutions for occupational retirement provision with 16–99 members across their pension schemes. DORA excludes those with 15 or less (Articles 2(3)(c), 3(53)).

Articles 5 to 15 do not apply. Chapters III to VI apply with their conditions and exceptions, with exclusions from Article 26(1) TLPT and the Article 28(2) ICT third-party risk strategy duty. Check with the competent authority how Article 24 applies to such an entity that is not a microenterprise, and how Articles 28(1) and 28(3) apply. Microenterprise status is a different test (Article 3(60)). See Article 16.

How does DORA relate to NIS2?

For financial entities “identified as essential or important entities pursuant to national rules transposing Article 3” of NIS2, DORA is a sector-specific Union legal act for NIS2 Article 4 (DORA Article 1(2)). Then “the relevant provisions” of NIS2, with supervision and enforcement in NIS2 Chapter VII, do not apply to these entities if the DORA requirements are “at least equivalent in effect” (NIS2 Article 4(1)).

NIS2 continues to apply to the entities in its scope that DORA does not include (NIS2 Article 4(1)). NIS2 excludes entities that a Member State excludes through DORA Article 2(4) (NIS2 Article 2(10)). A Member State can tell financial entities to send DORA incident reports also to NIS2 authorities (Reports to NIS2 authorities). See Article 1(2) — DORA and NIS2 and NIS2 and DORA compared.

What are the DORA Level 2 acts?

Eight Commission Regulations supplement DORA and give more information on the obligations of financial entities:

• Delegated Regulation (EU) 2024/1772: classification of incidents and cyber threats
• Delegated Regulation (EU) 2024/1773: the policy on ICT services supporting critical or important functions
• Delegated Regulation (EU) 2024/1774: ICT risk management and the simplified ICT risk management framework
• Delegated Regulation (EU) 2025/301: contents and time limits of incident reports
• Delegated Regulation (EU) 2025/532: subcontracting
• Delegated Regulation (EU) 2025/1190: threat-led penetration testing
• Implementing Regulation (EU) 2024/2956: templates for the register of information
• Implementing Regulation (EU) 2025/302: forms for incident reports.

Each of them is binding and directly applicable. Delegated acts for the Oversight Framework (for example Articles 31(6), 41, and 43(2)) are not part of the eight. The ESAs Joint Guidelines JC 2024 34 are also not part of the eight. See The eight Commission Regulations.

What are the penalties under DORA?

Member State law sets the administrative penalties and remedial measures for breaches of DORA (Article 50(3)). They must be “effective, proportionate and dissuasive”. Article 50(5) adds liability for members of the management body and other “individuals who under national law are responsible for the breach”, on the conditions of national law. Article 52(1) lets Member States have no administrative penalties for breaches with criminal penalties in national law.

The Lead Overseer imposes a periodic penalty payment on a critical ICT third-party service provider that does not fully comply with the measures of Article 35(1), points (a), (b) and (c). The decision comes “after the expiry of a period of at least 30 calendar days” from the notification of the measures (Article 35(6)). The periodic penalty payment is “imposed on a daily basis until compliance is achieved and for no more than a period of six months following the notification of the decision” (Article 35(7)). It is “up to 1 % of the average daily worldwide turnover” in the “preceding business year” (Article 35(8)). See Penalties and enforcement.

What is a critical ICT third-party service provider under DORA?

A critical ICT third-party service provider is one that the ESAs designate through DORA Article 31. All four Article 31(2) criteria apply, with Article 31(8) exclusions, for example ICT intra-group service providers. The ESAs’ list of 18 November 2025 has 19 critical ICT third-party service providers. Article 31(9) tells the ESAs to “establish, publish and update yearly” the list.

For the obligations of financial entities, see Obligations of financial entities in the Oversight Framework. See Designated critical ICT third-party service providers.

What are the DORA incident reporting deadlines?

DORA Article 19(4) gives three reports. Delegated Regulation (EU) 2025/301 Article 5(1) sets the time limits:

• Initial notification: “as early as possible, but in any case, within four hours” from classification as a major ICT-related incident, and “no later than 24 hours from the moment the financial entity has become aware” of the incident.
• Intermediate report: “at the latest within 72 hours from the submission of the initial notification”, also if no change occurs. Before that time, if a change occurs: “as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available” (DORA Article 19(4), point (b)).
• Final report: “one month” after the intermediate report or “the latest updated intermediate report”.

Delegated Regulation (EU) 2025/301 Article 5 also has rules for an “updated intermediate report” (5(1)(b)) and for classification after “24 hours” (5(2)). It has rules for entities that cannot report in time (5(3)). It gives more time on a “weekend day or a bank holiday”, with exceptions (5(4) to (6)). DORA Article 19(3) adds information for clients. See Time limits.

Does DORA apply to AI systems?

DORA has no provision on AI as such. Many of its duties refer to ICT assets and ICT services. In Article 3(7), an ICT asset is “a software or hardware asset in the network and information systems used by the financial entity”. Article 3(21) gives the definition of ICT services.

In statement JC 2026 25 of 31 July 2026, on ICT risks from frontier AI models, the ESAs write that “The requirements set out in DORA remain highly relevant” for risks “stemming from the release of highly capable AI models”, and that “the regulatory framework remains technology-neutral” (paragraph 5).

The ESAs “encourage financial entities” to adjust their ICT risk management (paragraph 6). The statement is not law, and its Annex “does not establish additional requirements”. See The ESAs statement and the EU AI Act.

Which Modulos Frameworks cover DORA?

Modulos gives DORA as two Frameworks with the name DORA: OFF-16 for the Organization, and MFF-16 for each AI System that the organization examines against DORA, for example a “service or application” (a Modulos name, not a DORA name). You add OFF-16 to your organization AI System, and if you do not have an organization AI System, you contact Modulos support.

DORA gives its obligations to the financial entity, not to an AI System. The MFF-16 Requirements are a Modulos method that examines how that “service or application” helps the financial entity. Each AI System gets all Requirements of the Framework that you add. You set a Requirement to Out of scope only when no provision in it applies to the financial entity. See The two DORA Frameworks.

What is the Article 16 simplified ICT risk management framework?

DORA Article 16 gives financial entities in Article 16(1) an alternative to Articles 5 to 15. Its eight obligations include a “sound and documented ICT risk management framework”, business continuity plans, and tests.

Article 16(2) tells these entities to keep a “documented” framework and review it “periodically” and after major ICT-related incidents, in compliance with supervisory instructions. These financial entities must keep the framework “continuously improved” from “lessons derived from implementation and monitoring”. They must send a review report to the competent authority “upon its request”. Delegated Regulation (EU) 2024/1774 Title III adds rules.

Articles 26(1) and 28(2) do not apply. DORA does not make clear if Article 24 applies to these entities when they are not microenterprises: check with the competent authority. See Article 16 and Article 24.

What does Article 5 require of the management body?

In DORA Article 5(2), the management body “shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1)”. Points (a) to (i) give it nine obligations, for example “the ultimate responsibility” for ICT risk and the digital operational resilience strategy. Its members keep their “knowledge and skills” up to date (Article 5(4)).

Financial entities other than microenterprises must “establish a role” to monitor contractual arrangements on ICT services with ICT third-party service providers. Or they must designate a member of senior management to oversee the related risk exposure and “relevant documentation” (Article 5(3)). Article 5 does not apply to the entities in Article 16(1) (Article 16). See Article 5.

What is the relationship between Article 6 and Article 16?

DORA Articles 6 and 16 give financial entities two alternative ICT risk management regimes. The ICT risk management framework of Article 6(1), with the obligations of Articles 5 to 15, applies to each financial entity that is not in Article 16(1). The simplified ICT risk management framework of Article 16 applies to the entities in Article 16(1). Article 16(1) applies directly to its entities, thus an entity does not select its regime.

Delegated Regulation (EU) 2024/1774 gives the regulatory technical standards: Title II for the full regime and Title III for the simplified framework. See Two alternative regimes.

Is DORA proportionate to entity size?

Yes, but proportionality does not remove an obligation. Financial entities must apply the rules of Chapter II “in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations” (Article 4(1)). For Chapters III, IV and V, Section I, proportionality applies only “as specifically provided for in the relevant rules of those Chapters” (Article 4(2)). DORA also has rules for small entities: the microenterprise rules (Article 3), the simplified framework of Article 16(1) (Article 16), and Article 2(3), points (c) and (e) (Entity scope). See Article 4.

How does DORA scope compare to NIS2 scope?

DORA applies by type of entity. NIS2 applies by type of entity and with a “size-cap rule” (DORA recital 15). DORA Article 2(1) has no general limit of this type. But two exclusions in Article 2(3) use limits of this type, and the other four refer to other Directives. Point (c) excludes institutions for occupational retirement provision with pension schemes that together have not more than 15 members. Point (e) excludes “insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries” that are “microenterprises or small or medium-sized enterprises”.

Article 16(1) also names small entities, but it does not remove them from DORA. Articles 5 to 15 “shall not apply to small and non-interconnected investment firms” and the other entities in Article 16(1). These entities apply the simplified ICT risk management framework of Article 16.

NIS2 Article 2(1) applies to entities of a type in its Annex I or II that “qualify as medium-sized enterprises” or “exceed the ceilings for medium-sized enterprises”, and NIS2 Article 2(2) to (4) add entities “regardless of their size”. For essential or important entities, DORA Article 1(2) and NIS2 Article 4(1) apply (Article 1(2)). NIS2 does not apply to the entities that a Member State excludes with DORA Article 2(4) (NIS2 Article 2(10)). See Entity scope and the scope of DORA.

What does Article 7 require for ICT systems, protocols, and tools?

DORA Article 7 tells financial entities to use and keep “updated ICT systems, protocols and tools”. These must be “appropriate to the magnitude of operations supporting the conduct of their activities”, “reliable”, and “technologically resilient”. Their capacity must be sufficient, also for “peak orders, message or transaction volumes”. Article 7 does not apply to the entities of Article 16(1): for these entities, Article 16(1), point (c), gives the obligation. See Article 7.

What is Article 8 ICT asset identification?

DORA Article 8, “Identification”, tells financial entities to “identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk”, and to review this “at least yearly” (Article 8(1)). Article 8(2) to (6) add the sources of ICT risk, the information assets and ICT assets, “all processes that are dependent on ICT third-party service providers”, and inventories. Financial entities other than microenterprises also do risk assessments (Article 8(3) and (7)). Article 8 does not apply to Article 16(1) entities, and Article 16(1), point (e), applies to them. See Article 8.

How does Article 17 incident management work?

DORA Article 17(1) tells financial entities to “define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents”. They record all ICT-related incidents and significant cyber threats, and their procedures make sure “that root causes are identified, documented and addressed” (Article 17(2)). Article 17(3) gives six parts of the ICT-related incident management process. Examples are early warning indicators, classification with the criteria of Article 18(1), and “ICT-related incident response procedures”. Articles 17 to 19 also apply to the entities of Article 16(1) and to microenterprises.

See Article 17.

What is the Article 18 classification test?

DORA Article 18(1) tells financial entities to classify ICT-related incidents with 6 criteria. The criteria are the clients and financial counterparts, “the amount or number of transactions affected”, and the reputational impact (point (a)). The other criteria are the “duration of the ICT-related incident” (point (b)) and four more criteria (points (c) to (f)). These are geographical spread, data losses, criticality of services, and economic impact.

In Delegated Regulation (EU) 2024/1772 Article 8(1), an incident is a major ICT-related incident if it “has affected critical services” (Article 6) and if the “materiality threshold” in Article 9(5)(b) or “two or more of the other materiality thresholds” “are met”. Article 8(2) gives a rule for recurring incidents that does not apply to microenterprises or to Article 16(1) entities. DORA Article 18(2) gives 3 criteria to “classify cyber threats as significant”. See Article 18.

What does Article 19 incident reporting require?

DORA Article 19(1) tells financial entities to report major ICT-related incidents to the “relevant competent authority” of Article 46. Article 19(4) gives three reports: an initial notification, an intermediate report, and a final report. Delegated Regulation (EU) 2025/301 gives their contents and time limits, and Implementing Regulation (EU) 2025/302 gives the forms.

Article 19 adds these rules:

• One reporting authority if there is more than one national competent authority (19(1)).
• A different rule for credit institutions “classified as significant”, and alternative means if technical impossibility prevents initial notification with the template (19(1)).
• Voluntary notifications of significant cyber threats (19(2)) and information for clients (19(3)).
• Outsourcing “in accordance with Union and national sectoral law”, while the financial entity stays “fully responsible” for incident reporting (19(5)).
• More reporting to NIS2 competent authorities or CSIRTs if the Member State makes this an obligation for the financial entity (19(1)).

The Digital Omnibus proposal can change reporting, but as of October 2026 it is not law. See Article 19.

Does the Article 16 simplified framework change DORA incident reporting?

No for the incident duties: Article 16(1) removes only Articles 5 to 15, thus Articles 17 to 19 also apply to Article 16(1) entities. These entities have an ICT-related incident management process, classify ICT-related incidents, and report major ICT-related incidents in the time limits of Delegated Regulation (EU) 2025/301.

Two points are different. The rule on recurring incidents in Article 8(2) of Delegated Regulation (EU) 2024/1772 does not apply to these entities or to microenterprises. Their business continuity, backup, and restoration obligations come from Article 16(1), point (f), and Title III of Delegated Regulation (EU) 2024/1774, not from Articles 11 and 12.

See Article 16(1) entities and the incident rules.

How does DORA incident reporting interact with NIS2 Article 23 reporting?

For financial entities that are essential or important entities of NIS2, DORA is a “sector-specific Union legal act for the purposes of Article 4” of NIS2 (DORA Article 1(2)). “The relevant provisions” of NIS2, for example the incident notification of NIS2 Article 23, do not apply to these entities if the DORA requirements are “at least equivalent in effect” (NIS2 Article 4(1)). If they are not equivalent, these NIS2 provisions continue to apply.

A Member State can tell some or all financial entities to send the initial notification and each report also to the NIS2 competent authorities or CSIRTs (DORA Article 19(1), sixth subparagraph). It can let entities that notify a significant cyber threat “on a voluntary basis” send that notification also to the CSIRTs (Article 19(2), third subparagraph). For some financial entities, the initial notification and the intermediate report get no more time on a weekend day or a bank holiday. Essential or important entities of NIS2 are in this group (Delegated Regulation (EU) 2025/301, Article 5(5)). See Reports to NIS2 authorities.

What does the ESAs statement on frontier AI models mean for DORA?

The ESA Statement JC 2026 25 of 31 July 2026 adds no DORA obligation. It is not law, it is not a Commission Regulation that supplements DORA, and its Annex “does not establish additional requirements”. The ESAs “encourage financial entities, taking into account the expectations of their supervisory authorities, to adjust ICT risk management processes, procedures and controls” with 3 risk mitigation strategies: “prevention”, “detection”, and “management”. The ESAs also tell financial entities: “It is expected that financial entities implement measures in a proportionate manner”. See The ESAs statement on ICT risks from frontier AI models.

What does DORA require for resilience testing?

Financial entities, other than microenterprises, must “establish, maintain and review a sound and comprehensive digital operational resilience testing programme” (Article 24(1)). They also make sure that “appropriate tests” occur “at least yearly” on “all ICT systems and applications supporting critical or important functions” (Article 24(6)). Article 25(2) adds rules for central securities depositories and central counterparties. Article 25(3) applies to microenterprises, and Article 16(1), point (g), to Article 16(1) entities.

For Article 16(1) entities that are not microenterprises, check with the competent authority how DORA Article 24 applies (Article 24). Threat-led penetration testing applies only to the financial entities that the competent authority identifies (Articles 26–27). See Articles 24–25.

What is threat-led penetration testing (TLPT) under DORA and who must perform it?

DORA Article 3(17) gives this definition of TLPT: “a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems”. A financial entity must do TLPT only if all these conditions apply:

• It is not an Article 16(1) entity.
• It is not a microenterprise.
• The competent authority identifies it through Article 26(8), third subparagraph.

An identified financial entity does TLPT “at least every 3 years”, and the competent authority “may, where necessary, request the financial entity to reduce or increase this frequency” (Article 26(1)). Article 2 of Delegated Regulation (EU) 2025/1190 gives the criteria for the identification, and Article 27 gives the requirements for testers. See Articles 26–27.

What is the DORA strategy on ICT third-party risk (Article 28(2))?

Financial entities, other than the entities of Article 16(1), first subparagraph, and other than microenterprises, must “adopt, and regularly review, a strategy on ICT third-party risk” (Article 28(2)). The ICT third-party risk strategy includes a policy on the use of ICT services supporting critical or important functions from ICT third-party service providers. The ICT third-party risk strategy “shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis”. The management body examines the risks of the contractual arrangements for critical or important functions at regular intervals. Delegated Regulation (EU) 2024/1773 gives “the detailed content of the policy”. See Article 28(2).

What contractual provisions does DORA require?

DORA Article 30(1) tells financial entities to record each full ICT contract, with its service level agreements, in one “written document”. Article 30(2) gives nine minimum items, for example ICT service and data locations and termination rights.

For ICT services supporting critical or important functions, Article 30(3) adds six items, for example performance targets, “unrestricted rights of access, inspection and audit”, and exit strategies. The parties can agree “alternative assurance levels if other clients’ rights are affected” (30(3)(e)(ii)). For microenterprises, the last subparagraph of Article 30(3) gives a different rule for these rights. See Article 30.

What does DORA say about subcontracting?

DORA Article 29(2) tells financial entities to “weigh benefits and risks” of permitted subcontracting of ICT services supporting critical or important functions. This includes third-country subcontractors and “potentially long or complex chains of subcontracting”. Article 30(2)(a) tells the parties to record if subcontracting of “an ICT service supporting a critical or important function, or material parts thereof” is permitted, and on which conditions.

Delegated Regulation (EU) 2025/532 adds these rules:

• Article 3: before it signs a contractual arrangement, the financial entity makes a decision if the ICT third-party service provider can subcontract ICT services supporting critical or important functions, or “material parts thereof”. The financial entity signs only after it examines that “all of the following conditions have been complied with” in points (a) to (j). It does the risk assessment of points (f) to (j) again at regular intervals (Article 3(2)).
• Article 5: the ICT third-party service provider makes material changes to subcontracting only after the financial entity “has either approved or not objected to the changes by the end of the notice period”.
• Article 6: the financial entity has the right to include termination provisions in the contract for the “cases” of Article 6.

See Article 29 and Subcontracting.

What is the EU oversight framework for critical ICT third-party service providers?

DORA Articles 31 to 44 give the Oversight Framework for critical ICT third-party service providers. The ESAs designate them and appoint a Lead Overseer for each (Article 31(1)). Article 31(9) tells the ESAs to “establish, publish and update yearly” the list. The powers of the Lead Overseer include a “Request for information”, “General investigations”, “Inspections”, and recommendations (Articles 35 to 39).

For financial entities, the duties of Articles 28 to 30 continue. Article 31(12) adds an EU-subsidiary condition for designated ICT third-party service providers in a third country. Article 42(3) tells the competent authorities to tell financial entities about “the risks identified in the recommendations” of the Lead Overseer to critical ICT third-party service providers. The financial entities must “take into account” these risks in their work on ICT third-party risk. Article 42(4) and (6) let the competent authority impose suspension or termination “as a measure of last resort”. See Articles 31 to 44.

What does Article 45 require?

DORA Article 45 lets financial entities “exchange amongst themselves cyber threat information and intelligence” only on these conditions (Article 45(1)(a)–(c)):

• The information sharing “aims to enhance the digital operational resilience of financial entities”.
• The information sharing occurs in “trusted communities of financial entities”.
• The information-sharing arrangements give protection to “potentially sensitive” information. Their rules of conduct must be “in full respect of business confidentiality”, personal data protection in Regulation (EU) 2016/679, and guidelines on competition policy.

Financial entities can select if they use information-sharing arrangements. Financial entities that use information-sharing arrangements must notify competent authorities “upon validation of their membership” and of “the cessation of their membership, once it takes effect” (Article 45(3)). See Article 45.

Why does DORA need so many Level 2 acts?

DORA tells the ESAs to write draft regulatory technical standards and draft implementing technical standards that “specify further” parts of some obligations. The Commission adopts the standards as Commission Regulations. The Articles that do this are Articles 15, 16(3), 18(3), 20, 26(11), 28(9), 28(10), and 30(5). For example, the Commission Regulations give classification criteria and materiality thresholds for incidents. They give contents, time limits, and templates for incident reports, and templates for the register of information. See The eight Commission Regulations.

Are the Level 2 acts already in force?

Yes. Each of the eight Commission Regulations entered into force “on the twentieth day following” its publication in the Official Journal of the European Union. None gives a different date from which it applies. Delegated Regulations 2024/1772, 2024/1773, and 2024/1774 entered into force on 15 July 2024. Delegated Regulation 2025/532 entered into force on 22 July 2025, as the last of the eight.

DORA applies from 17 January 2025 (Article 64). See The eight Commission Regulations.

What are the ESAs Joint Guidelines JC 2024 34 on costs and losses?

JC 2024 34 are the “Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554” of the ESAs, with a Final Report of 5 June 2024. The guidelines are not a Commission Regulation: “competent authorities and financial institutions must make every effort to comply with the Guidelines”, and the guidelines “apply from 19.05.2025”. They tell financial entities how they “should” estimate the costs and losses that DORA Article 11(10) tells them to report to the competent authorities, “upon their request”. Article 11(10) does not apply to microenterprises or to the financial entities in Article 16(1). See ESAs Joint Guidelines JC 2024 34.

How does Modulos handle the DORA Level 2 acts?

Requirements of the two DORA Frameworks, OFF-16 at the Organization level and MFF-16 at the AI System level, refer to the Commission Regulations. See Requirements of the DORA Frameworks.

How is DORA applicability handled in Modulos?

You identify which DORA provisions apply to the financial entity. The decisions are about the scope of DORA (Article 2), microenterprises (Article 3, point (60)), Article 16(1), Article 23, and TLPT (Article 26(8)). Each AI System gets all Requirements of the Framework that you add. You set each Requirement with no applicable provision to Out of scope, with a comment that gives the facts. DORA does not tell financial entities to record these decisions, but Modulos recommends that you record them in ORF-361 and ORF-362.

Modulos can use the DORA tags for scope decisions in a subsequent release. At this time the tags do not set a Requirement to Out of scope. See Decisions before you add the Frameworks.

What's the typical rollout sequence?

DORA does not give a sequence of work, but Modulos recommends nine steps. First, make the scope decisions and add OFF-16 and MFF-16. Then do the governance, the ICT risk management framework or the simplified ICT risk management framework, and the incident work. Then do the tests, the work on ICT third-party risk, and the Article 45 notification. Last, set each Requirement with no applicable provision to Out of scope.

In each step, do only the provisions that apply to the financial entity. Article 16(1) entities speak to the competent authority about Article 24 (if they are not microenterprises) and Articles 28(1) and 28(3). For an essential or important entity of NIS2, first do the test of NIS2 Article 4 (Other Frameworks on the same AI Systems). See Steps that Modulos recommends.

What evidence is typically needed for a DORA audit?

DORA does not give a full set of records for an audit. Some provisions of DORA and of its Commission Regulations name records, and each record applies only to the financial entities that its provision names. Examples are the digital operational resilience strategy (Article 6(8), full regime) and the inventories (Article 8(6), full regime). The 3 incident reports are also an example (Article 19(4), all financial entities). Other examples are the testing program (Article 24(1), not microenterprises) and the register of information (Article 28(3)). The strategy on ICT third-party risk is also an example (Article 28(2), not microenterprises or Article 16(1) entities).

For Article 16(1) entities, DORA does not make clear how Articles 28(1) and 28(3) apply, or if Article 24 applies to those that are not microenterprises (The testing program, Article 28). See Records that DORA names.

Does Modulos handle the designation of critical ICT third-party service providers?

No. The ESAs designate critical ICT third-party service providers (Article 31), and a Lead Overseer does the oversight of each of them. The designation does not change the duties of the financial entity in Articles 28 to 30. The financial entity stays “fully responsible” (Article 28(1), point (a)).

Articles 31(12) and 42 add duties for the financial entity, and the Requirement ORF-384 includes them. See Obligations of financial entities in the Oversight Framework.

How does DORA execution coordinate with an existing NIS2 program?

Do the test of NIS2 Article 4 first. For financial entities that are essential or important entities of NIS2, “the relevant provisions” of NIS2 do not apply where the DORA requirements are “at least equivalent in effect” (NIS2 Article 4(1), DORA Article 1(2)). Then add OFF-15 (NIS2) to the same organization AI System only for the NIS2 duties that continue to apply.

See Article 1(2) — DORA and NIS2, Other Frameworks on the same AI Systems, and Control overlap.