Docs

Appearance

DORA Information Sharing and Level 2 Acts — Article 45 + 8 Commission Regulations ​

Chapter VI of DORA (Regulation (EU) 2022/2554) has one Article, Article 45. Article 45 lets financial entities use information-sharing arrangements for cyber threat information and intelligence. It also tells them to notify the competent authorities. The next part gives eight Commission Regulations with rules for DORA obligations. DORA tells the ESAs to write the draft regulatory technical standards or draft implementing technical standards, and the Commission adopted them as Regulations. The last part is about the ESAs Joint Guidelines JC 2024 34 on the costs and losses of major ICT-related incidents.

Article 45 — information-sharing arrangements ​

DORA Article 45(1) lets financial entities “exchange amongst themselves cyber threat information and intelligence”. Article 45(1) gives these examples: “indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools”. Article 45(1) lets financial entities do this only “to the extent that” the information sharing agrees with all of these conditions:

  • (a) It “aims to enhance the digital operational resilience of financial entities, in particular through raising awareness in relation to cyber threats, limiting or impeding the cyber threats’ ability to spread, supporting defence capabilities, threat detection techniques, mitigation strategies or response and recovery stages”.
  • (b) It occurs “within trusted communities of financial entities”.
  • (c) It “is implemented through information-sharing arrangements that protect the potentially sensitive nature of the information shared, and that are governed by rules of conduct in full respect of business confidentiality, protection of personal data in accordance with Regulation (EU) 2016/679 and guidelines on competition policy”.

Point (c) is a condition for the information-sharing arrangements. Article 45 gives no other rule about personal data.

Article 45(2) applies “for the purpose of paragraph 1, point (c)”. In Article 45(2), the information-sharing arrangements “shall define the conditions for participation”. “Where appropriate”, the information-sharing arrangements “shall set out the details” on these items:

  • “the involvement of public authorities and the capacity in which they may be associated to the information-sharing arrangements”
  • “the involvement of ICT third-party service providers”
  • “operational elements, including the use of dedicated IT platforms”.

Article 45(3) gives the obligation of financial entities. In Article 45(3), financial entities “shall notify competent authorities” of these two facts:

  • “of their participation in the information-sharing arrangements referred to in paragraph 1, upon validation of their membership”
  • “or, as applicable, of the cessation of their membership, once it takes effect”.

Article 45(1) uses “may”. Thus it is optional for a financial entity to use information-sharing arrangements. If a financial entity uses them, the conditions of Article 45(1) and (2) apply to its information sharing. Article 45(3) then tells it to notify.

The eight Commission Regulations ​

DORA tells the ESAs to write draft regulatory technical standards or draft implementing technical standards. The Commission adopts the regulatory technical standards as Delegated Regulations that supplement DORA. The Commission adopts the implementing technical standards as Implementing Regulations “for the application of Regulation (EU) 2022/2554”. The eight Commission Regulations below give rules for obligations of financial entities. Each of them is “binding in its entirety and directly applicable in all Member States”.

Each Regulation entered into force “on the twentieth day following” its publication in the Official Journal of the European Union. None of the eight Regulations gives a different date from which it applies. For the date from which DORA applies, see Dates and status of DORA. The Commission adopted six of the eight Regulations in 2024 and two in 2025. The publication of four Regulations occurred in 2024, and the publication of the other four occurred in 2025.

RegulationAdopted onPublication in the Official JournalEntry into forceDORA Article for the standards
Delegated Regulation (EU) 2024/177213.3.2024OJ L, 2024/1772, 25.6.202415.7.2024Article 18(3)
Delegated Regulation (EU) 2024/177313.3.2024OJ L, 2024/1773, 25.6.202415.7.2024Article 28(10)
Delegated Regulation (EU) 2024/177413.3.2024OJ L, 2024/1774, 25.6.202415.7.2024Articles 15 and 16(3)
Implementing Regulation (EU) 2024/295629.11.2024OJ L, 2024/2956, 2.12.202422.12.2024Article 28(9)
Delegated Regulation (EU) 2025/30123.10.2024OJ L, 2025/301, 20.2.202512.3.2025Article 20, first paragraph, point (a)
Implementing Regulation (EU) 2025/30223.10.2024OJ L, 2025/302, 20.2.202512.3.2025Article 20, first paragraph, point (b)
Delegated Regulation (EU) 2025/53224.3.2025OJ L, 2025/532, 2.7.202522.7.2025Article 30(5)
Delegated Regulation (EU) 2025/119013.2.2025OJ L, 2025/1190, 18.6.20258.7.2025Article 26(11)

DORA also lets the Commission adopt delegated acts and regulatory technical standards for the Oversight Framework of critical ICT third-party service providers. Articles 31(6), 41, and 43(2) are examples. This section does not include them.

  • Name: “Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents”.
  • DORA Article for the standards: Article 18(3) tells the ESAs to write the draft regulatory technical standards through the Joint Committee. The Regulation gives Article 18(4), third subparagraph, as its legal basis.
  • DORA obligation: the classification of ICT-related incidents and cyber threats in DORA Article 18. See Article 18 in DORA ICT Risk and Resilience Operations.
  • Source: EUR-Lex.

Delegated Regulation (EU) 2024/1773 — policy on ICT services supporting critical or important functions ​

  • Name: “Commission Delegated Regulation (EU) 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers”.
  • DORA Article for the standards: Article 28(10) tells the ESAs to write the draft regulatory technical standards through the Joint Committee. The Regulation gives Article 28(10), third subparagraph, as its legal basis.
  • DORA obligation: the policy is part of the strategy on ICT third-party risk in DORA Article 28(2). Article 28(2) applies to financial entities “other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises”. See Article 28(2) in DORA Testing and Third-Party Risk.
  • Source: EUR-Lex.

Delegated Regulation (EU) 2024/1774 — the ICT risk management framework and the simplified ICT risk management framework ​

  • Name: “Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework”.
  • DORA Article for the standards: Articles 15 and 16(3) tell the ESAs to write the draft regulatory technical standards through the Joint Committee. The Regulation gives Article 15, fourth subparagraph, and Article 16(3), fourth subparagraph, as its legal basis.
  • DORA obligation: in the Regulation, Title II is about the points of DORA Article 15. In the Regulation, Title III gives the simplified ICT risk management framework for the financial entities in DORA Article 16(1). See Articles 15 and 16(3) in DORA ICT Risk and Resilience Operations. See also Article 16 in DORA Applicability and Governance.
  • Source: EUR-Lex.

Implementing Regulation (EU) 2024/2956 — templates for the register of information ​

  • Name: “Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to standard templates for the register of information”.
  • DORA Article for the standards: Article 28(9) tells the ESAs to write the draft implementing technical standards through the Joint Committee. The Regulation gives Article 28(9), second subparagraph, as its legal basis.
  • DORA obligation: the register of information in DORA Article 28(3). See Article 28(3) in DORA Testing and Third-Party Risk.
  • Source: EUR-Lex.

Delegated Regulation (EU) 2025/301 — content and time limits of incident reports and notifications ​

  • Name: “Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats”.
  • DORA Article for the standards: Article 20, first paragraph, point (a), tells the ESAs to write the draft regulatory technical standards through the Joint Committee. The Regulation gives Article 20, third subparagraph, as its legal basis.
  • DORA obligation: the reports on major ICT-related incidents and the voluntary notification of significant cyber threats in DORA Article 19. See the time limits for the reports in DORA ICT Risk and Resilience Operations.
  • Source: EUR-Lex.

Implementing Regulation (EU) 2025/302 — templates and procedures for incident reports and notifications ​

  • Name: “Commission Implementing Regulation (EU) 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat”.
  • DORA Article for the standards: Article 20, first paragraph, point (b), tells the ESAs to write the draft implementing technical standards through the Joint Committee. The Regulation gives Article 20, fourth paragraph, as its legal basis.
  • DORA obligation: reports on major ICT-related incidents in DORA Article 19(1), and the voluntary notification of significant cyber threats in Article 19(2). See Article 20 in DORA ICT Risk and Resilience Operations.
  • Source: EUR-Lex.

Delegated Regulation (EU) 2025/532 — subcontracting of ICT services supporting critical or important functions ​

  • Name: “Commission Delegated Regulation (EU) 2025/532 of 24 March 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions”.
  • DORA Article for the standards: Article 30(5) tells the ESAs to write the draft regulatory technical standards through the Joint Committee. The standards “specify further the elements referred to in paragraph 2, point (a), which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions”. The Regulation gives Article 30(5), fourth subparagraph, as its legal basis.
  • DORA obligation: subcontracting of ICT services supporting critical or important functions. See Article 30(5) in DORA Testing and Third-Party Risk.
  • Source: EUR-Lex.

Delegated Regulation (EU) 2025/1190 — threat-led penetration testing ​

  • Name: “Commission Delegated Regulation (EU) 2025/1190 of 13 February 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria used for identifying financial entities required to perform threat-led penetration testing, the requirements and standards governing the use of internal testers, the requirements in relation to the scope, testing methodology and approach for each phase of the testing, results, closure and remediation stages and the type of supervisory and other relevant cooperation needed for the implementation of TLPT and for the facilitation of mutual recognition”.
  • DORA Article for the standards: Article 26(11) tells the ESAs to write the draft regulatory technical standards “in agreement with the ECB” and “in accordance with the TIBER-EU framework”. The Regulation gives Article 26(11), fourth subparagraph, as its legal basis.
  • DORA obligation: threat-led penetration testing in DORA Articles 26 and 27. See Articles 26 and 27 in DORA Testing and Third-Party Risk.
  • Source: EUR-Lex.

The ESAs (EBA, EIOPA, and ESMA) gave the “Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554” (JC 2024 34). The Final Report has the date 5 June 2024. DORA Article 11(11) told the ESAs to write “common guidelines on the estimation of aggregated annual costs and losses referred to in paragraph 10” “by 17 July 2024”.

Financial entities other than microenterprises and Article 16(1) entities must report the estimate to the competent authorities “upon their request” (DORA Article 11(10)).

The guidelines are not a Commission Regulation. Their legal basis is Article 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010, and (EU) No 1095/2010. Thus “competent authorities and financial institutions must make every effort to comply with the Guidelines” (Article 16(3) of those Regulations). These dates apply:

  • The guidelines “apply from 19.05.2025”.
  • The guidelines tell competent authorities that they “must notify the respective ESA whether they comply or intend to comply with these Joint Guidelines/Recommendations, or otherwise with reasons for non-compliance, by 19.05.2025”. If a competent authority did not notify by that date, it “will be considered by the respective ESA to be non-compliant”.

The guidelines are for the competent authorities of DORA Article 46. They are also for the financial institutions of Article 4(1) of each of those three Regulations. Paragraphs 5 to 11 of the guidelines tell financial entities how they “should” make the estimate. For example:

  • The estimate adds the costs and losses of the major ICT-related incidents in the reference year “for which the competent authority requested the estimation”.

  • For the reference year, the financial entity selects one of these periods:

    • The “completed calendar year”.
    • Its “completed accounting year”, for which it “has finalised its financial statements”.

    It uses the same selection for subsequent estimates. It can change the selection if it sends a notification to the competent authority, and the competent authority does not object “within two months of receiving the notification”.

  • The estimate includes the ICT-related incidents that “were classified as major” with Delegated Regulation (EU) 2024/1772, in one of these conditions:

    • The financial entity sent the final report of DORA Article 19(4), point (c), in the reference year.
    • The financial entity sent that final report in a previous reference year, and the incident “had a quantifiable financial impact on the financial entity in the relevant reference year”.

  • The guidelines recommend that the financial entity estimate gross costs and losses and financial recoveries for each incident. The guidelines recommend two totals for all the incidents: one for gross costs and losses, and one for financial recoveries.

  • The financial entity uses the template in the Annex of the guidelines to send the estimate to the competent authority.

Article 45 and the Commission Regulations in Modulos ​

Modulos has two DORA Frameworks: OFF-16 at the Organization level and MFF-16 at the AI System level. Requirement ORF-388 is the Requirement for DORA Article 45 at the Organization level. Requirements of the two Frameworks refer to the Commission Regulations. For the provisions of each Requirement, see Requirements of the DORA Frameworks.

Where to go next ​

DORA overview

The structure and dates of DORA, the competent authorities, and the penalties

Applicability and governance

Articles 1, 2, 4, 5, 6, 16: who DORA applies to, the management body, and the two frameworks for ICT risk

ICT risk and resilience operations

Articles 7–23: the parts of the ICT risk management framework, and the rules for incidents

Testing and third-party risk

Articles 24–30 and the Oversight Framework of Articles 31–44: digital operational resilience testing, ICT third-party risk, and the register of information

Operationalizing DORA in Modulos

The two DORA Frameworks, the decisions before you add them, the steps, and the Requirements

Sources ​

  • DORA — Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 “on digital operational resilience for the financial sector”. OJ L 333, 27.12.2022, p. 1. Articles 11(10) and (11), 15, 16(1) and (3), 18(3) and (4), 19(4), and 20. Articles 26(11), 28(2), (3), (9), and (10), 30(2) and (5), 31(6), 41, 43(2), 45, 46, and 64. EUR-Lex.
  • Delegated Regulation (EU) 2024/1772 of the Commission of 13 March 2024. OJ L, 2024/1772, 25.6.2024. Name, legal basis, and last Article. EUR-Lex.
  • Delegated Regulation (EU) 2024/1773 of the Commission of 13 March 2024. OJ L, 2024/1773, 25.6.2024. Name, legal basis, and last Article. EUR-Lex.
  • Delegated Regulation (EU) 2024/1774 of the Commission of 13 March 2024. OJ L, 2024/1774, 25.6.2024. Name, legal basis, Titles II and III, and last Article. EUR-Lex.
  • Implementing Regulation (EU) 2024/2956 of the Commission of 29 November 2024. OJ L, 2024/2956, 2.12.2024. Name, legal basis, and last Article. EUR-Lex.
  • Delegated Regulation (EU) 2025/301 of the Commission of 23 October 2024. OJ L, 2025/301, 20.2.2025. Name, legal basis, and last Article. EUR-Lex.
  • Implementing Regulation (EU) 2025/302 of the Commission of 23 October 2024. OJ L, 2025/302, 20.2.2025. Name, legal basis, and last Article. EUR-Lex.
  • Delegated Regulation (EU) 2025/532 of the Commission of 24 March 2025. OJ L, 2025/532, 2.7.2025. Name, legal basis, and last Article. EUR-Lex.
  • Delegated Regulation (EU) 2025/1190 of the Commission of 13 February 2025. OJ L, 2025/1190, 18.6.2025. Name, legal basis, and last Article. EUR-Lex.
  • ESAs Joint Guidelines JC 2024 34 — “Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554”, Final Report of 5 June 2024. The parts “Status of these Joint Guidelines” and “Reporting Requirements”, and paragraphs 1 to 11. EBA.

Disclaimer

This information is general. It does not tell you how the law applies to you. DORA and each of these eight Commission Regulations is “binding in its entirety and directly applicable in all Member States”. The Joint Guidelines JC 2024 34 are not a Regulation: competent authorities and financial institutions “must make every effort to comply” with them. The competent authorities in DORA Article 46 make sure of compliance with DORA.

Before you make a decision, read DORA and the Commission Regulations on EUR-Lex. Speak to a lawyer who can help you.