How to set up DORA in Modulos

The information here is for a financial entity that uses Modulos for the Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554. DORA gives its duties to the financial entity. Before you add the Frameworks, find out if DORA applies to the financial entity and which of its provisions apply. For the scope of DORA, see Applicability and governance.

The two DORA Frameworks

Modulos has two Frameworks for DORA, and each has the name DORA:

• OFF-16 is at the Organization level. Its Requirements are for the DORA duties of the financial entity: governance, the ICT risk management framework, incidents, tests, ICT third-party risk, and information-sharing arrangements.
• MFF-16 is at the AI System level. Its Requirements are a Modulos method. They examine how a “service or application” (a Modulos name, not a DORA name) helps the financial entity to do its DORA duties.

DORA gives the duties to the financial entity, not to a “service or application”. Examples are Articles 5(1), 6(1), and 28(1). MFF-16 does not move a duty to an AI System. Add MFF-16 to one AI System for each “service or application” that you assess against DORA.

Where Article 28(3) applies, the financial entity keeps the register of information "at entity level, and at sub-consolidated and consolidated levels". For Article 16(1) entities, speak to the competent authority about how it applies. See Article 28.

The DORA Frameworks do not select Requirements for an AI System. When you add a Framework to an AI System, the AI System gets all Requirements of that Framework. A Requirement can contain provisions for different groups of financial entities. Set a Requirement to Out of scope only when no provision in it applies to the financial entity. In a comment on the Requirement, write the facts that show this.

Each DORA Requirement also has tags for the area of DORA, for the regime, and for the financial entities that its provisions apply to. Many Requirements have the tags of the two regimes, thus the regime tags do not tell which regime applies to the financial entity. Modulos marks the regime tags and the entity tags for scope decisions, and the area tags for groups only. Modulos can use these tags in a subsequent release to set Requirements to Out of scope automatically. At this time, the tags do not set, remove, or select Requirements.

Organization AI Systems

Frameworks at the Organization level, for example OFF-16, attach to your organization AI System. You cannot make a new organization AI System. If your organization does not have one, contact Modulos support before you add OFF-16.

Decisions before you add the Frameworks

Each DORA duty applies to the financial entities that its provision names. Modulos recommends that the financial entity makes these decisions before it adds the DORA Frameworks. DORA does not give a sequence for them.

1. Is the organization a financial entity? Check the entity types, excluded entities, and the Member State power to exclude entities in Article 2.
2. Is it a microenterprise? Apply the definition in Article 3(60).
3. Is it of a type in Article 16(1)? Check if the simplified framework applies by law (Article 16).
4. Is it one of the "essential or important entities" of NIS2? Assess if the DORA requirements are "at least equivalent in effect" to NIS2 obligations (NIS2 Article 4) (DORA and NIS2).
5. Does Article 23 apply? Check if the financial entity is one of the four institution types in Article 23.
6. Did the competent authority identify it for TLPT? Check the excluded entities and identification by the competent authority in Articles 26–27.
7. For an Article 16(1) entity: which provisions for tests and ICT third-party risk apply? Speak to the competent authority about how the provisions apply (tests, ICT third-party risk).

Article 2 gives the scope of DORA, but DORA does not tell financial entities to record these decisions. Modulos recommends that you record them in ORF-361 and ORF-362.

Steps that Modulos recommends

DORA does not give a sequence of work. Modulos recommends the steps below. Each step gives its Requirements and the law. In these steps, "you" is the financial entity.

1. Make the decisions. Use Decisions before you add the Frameworks. Record the decisions in ORF-361 and ORF-362.
2. Add the Frameworks. Add OFF-16 to your organization AI System. For each “service or application” (the Modulos name) that you assess against DORA, add MFF-16 to one AI System.
3. Apply the governance and framework duties (ORF-363 to ORF-366, MRF-293).
   • If Articles 5 to 15 apply to you, do these tasks:
     • Implement the governance duties of Article 5.
     • Record the ICT risk management framework of Article 6.
     • Maintain the framework.
     • Include the digital operational resilience strategy of Article 6(8).
     • If you are not a microenterprise, do one of these tasks:
       • As one alternative, "establish a role" as specified in Article 5(3).
       • As an alternative, "designate a member of senior management" as specified in Article 5(3).
   • If you are an Article 16(1) entity:
     • Establish the simplified ICT risk management framework of Article 16.
     • Maintain the framework.
   • See Article 5, Article 6, and Article 16.
4. Implement the ICT risk management duties (ORF-367 to ORF-375, MRF-294 to MRF-301).
   • If Articles 5 to 15 apply to you, implement the duties of Articles 7 to 14.
   • If you are an Article 16(1) entity, implement the duties of Article 16(1), points (a) to (h).
   • For the estimate, if you are not a microenterprise and not an Article 16(1) entity:
     • Prepare the estimate of Article 11(10) (ORF-380).
     • Send the estimate to the competent authorities "upon their request".
   • See Articles 7 to 14.
5. Do the incident work (ORF-376 to ORF-379, MRF-302 to MRF-304).
   • Do the duties of Articles 17 to 19.
   • Classify incidents with Delegated Regulation (EU) 2024/1772.
   • For the contents and time limits of the reports, use Delegated Regulation (EU) 2025/301.
   • For the templates, use Implementing Regulation (EU) 2025/302.
   • If you are one of these entities, apply Article 23 (ORF-381):
     • A credit institution.
     • A payment institution.
     • An account information service provider.
     • An electronic money institution.
   • Before a major ICT-related incident occurs, Modulos recommends a test of the three reports of Article 19(4). In the test, use the templates and the time limits.
   • See Article 19.
6. Do the tests (ORF-382, MRF-305).
   • If you are not a microenterprise and not an Article 16(1) entity, do these tasks:
     • Establish the testing program of Articles 24 and 25.
     • Maintain the testing program.
     • Review the testing program.
   • If you are a microenterprise, do the tests of Article 25(3).
   • If you are an Article 16(1) entity and not a microenterprise, see The testing program and the financial entities of Article 16(1).
   • Do TLPT only if the competent authority identifies you for TLPT (Article 26(8)) (ORF-383, MRF-306).
7. Do the work on ICT third-party risk (ORF-384 to ORF-387, ORF-393, MRF-307 to MRF-310).
   • Apply Article 28(1), Article 28(4) to (8), and Article 29 (ORF-384, MRF-307).
   • Apply the duties of the financial entity in Articles 31(12) and 42 (ORF-384).
   • If you are not a microenterprise and not an Article 16(1) entity:
     • Adopt the strategy on ICT third-party risk of Article 28(2) (ORF-393).
     • Review the strategy on ICT third-party risk at regular intervals.
   • Put the provisions of Article 30 in your contractual arrangements (ORF-385, MRF-308).
   • Keep the register of information of Article 28(3) (ORF-386, MRF-309).
   • Send the report of Article 28(3) to the competent authorities "at least yearly" (ORF-386, MRF-309).
   • For subcontracting of ICT services supporting critical or important functions, apply Delegated Regulation (EU) 2025/532 (ORF-387, MRF-310).
   • For Article 16(1) entities, speak to your competent authority about how Articles 28(1) and 28(3) apply.
   • Modulos recommends that you start this step at the same time as step 3.
   • See Article 28 and Article 30.
8. Notify the competent authority about information-sharing arrangements (ORF-388).
   • On "validation" of your membership in an information-sharing arrangement, notify the competent authority of your participation.
   • When your membership in an information-sharing arrangement ends, notify the competent authority.
   • See Article 45.
9. Set Out of scope where no provision applies to you. Set the Requirement to Out of scope. In a comment, write the facts that show this.

Article 6(1) puts the ICT risk management framework in the "overall risk management system" of the financial entity. But for financial entities to which Articles 5 to 15 apply, Article 6 also gives more parts. For example, Article 6(4) gives the control function, for financial entities that are not microenterprises. Article 6(8) gives the digital operational resilience strategy. Chapter II also has other duties, for example in Articles 5(2), 11(6), and 12. Thus, the DORA work is more than the reports, the register of information, and the tests.

Reviews in Modulos

For DORA work in Modulos, a person changes a Control status directly and must add a comment. Modulos records the comment, and no other person must give approval. When all Controls of a Requirement have a final status, its Review can start. The Requirement Owner examines the completed Controls and marks the Requirement as Fulfilled. Assets have a different Review procedure. See Reviews & Statuses.

Records that DORA names

DORA gives duties, but it does not give a full set of records. Some provisions of DORA and of the Commission Regulations that supplement it name records. Each record applies only to the financial entities that its provision names. Before you make a record, make sure that its provision applies to the financial entity.

Record	Provision	Financial entities to which the provision applies
The approval and oversight by the management body of "all arrangements related to the ICT risk management framework"	Article 5(2)	Financial entities to which Articles 5 to 15 apply
The "role" that monitors the contractual arrangements with ICT third-party service providers, or the person of senior management for this work	Article 5(3)	Financial entities to which Articles 5 to 15 apply, other than microenterprises
The digital operational resilience strategy	Article 6(8)	Financial entities to which Articles 5 to 15 apply
A "report on the review of the ICT risk management framework", for the competent authority "upon its request"	Article 6(5)	Financial entities to which Articles 5 to 15 apply
The simplified ICT risk management framework, and a "report on the review" of it for the competent authority "upon its request"	Article 16(1), point (a), and Article 16(2)	Article 16(1) entities
The "relevant inventories" for Article 8(1), (4), and (5). The financial entity must "update them periodically and every time any major change as referred to in paragraph 3 occurs"	Article 8(6)	Financial entities to which Articles 5 to 15 apply
The estimate of "aggregated annual costs and losses caused by major ICT-related incidents", for the competent authorities "upon their request"	Article 11(10)	Financial entities to which Articles 5 to 15 apply, other than microenterprises
The classification of ICT-related incidents	Article 18, and Delegated Regulation (EU) 2024/1772	All financial entities
The initial notification, the intermediate report, and the final report on each major ICT-related incident	Article 19(4), Delegated Regulation (EU) 2025/301 (contents and time limits), and Implementing Regulation (EU) 2025/302 (templates)	All financial entities
The same notification and reports on major operational or security payment-related incidents	Article 23	Credit institutions, payment institutions, account information service providers, and electronic money institutions
The digital operational resilience testing program	Article 24(1)	Financial entities other than microenterprises. For Article 16(1) entities that are not microenterprises, see The testing program and the financial entities of Article 16(1)
Tests "at least yearly" on "all ICT systems and applications supporting critical or important functions"	Article 24(6)	Financial entities other than microenterprises. For Article 16(1) entities that are not microenterprises, see The testing program and the financial entities of Article 16(1)
The assessment of the critical or important functions that the TLPT must include, "validated by the competent authorities"	Article 26(2)	Financial entities that the competent authority identifies for TLPT (Article 26(8))
Records that show that testers comply with Article 27(1), with conditions for internal testers and contracts with external testers where applicable	Articles 26(8) and 27, and Delegated Regulation (EU) 2025/1190, Article 9(11)	Financial entities that the competent authority identifies for TLPT (Article 26(8))
The remediation plans and the other information of Article 26(6), for the TLPT authority and, if different, for the competent authority	Delegated Regulation (EU) 2025/1190, Article 13(1): "Within 8 weeks from the notification referred to in Article 12(7)"	Financial entities that the competent authority identifies for TLPT (Article 26(8))
The strategy on ICT third-party risk, with its policy on ICT services supporting critical or important functions	Article 28(2), and Delegated Regulation (EU) 2024/1773	Financial entities other than Article 16(1) entities and microenterprises
Contractual arrangements with the provisions of Article 30(2), and also of Article 30(3) for ICT services supporting critical or important functions	Article 30	Financial entities. For Article 16(1) entities, see step 7 of Steps that Modulos recommends
The register of information, "at entity level, and at sub-consolidated and consolidated levels"	Article 28(3), and Implementing Regulation (EU) 2024/2956 (templates)	Financial entities. For Article 16(1) entities, see step 7
A report to the competent authorities "at least yearly" on "the number of new arrangements on the use of ICT services", "the categories of ICT third-party service providers", the type of contractual arrangements, and the ICT services and functions	Article 28(3), third subparagraph	Financial entities. For Article 16(1) entities, see step 7
The assessment, before the contractual arrangement, of the conditions for subcontracting of ICT services supporting critical or important functions	Delegated Regulation (EU) 2025/532, Article 3	Financial entities that use ICT services supporting critical or important functions
The notification when the financial entity starts or stops to be in an information-sharing arrangement	Article 45(3)	Financial entities that are in information-sharing arrangements

Requirements of the DORA Frameworks

The financial entity uses OFF-16 and MFF-16 for DORA and the Commission Regulations that supplement it. Below, a number such as 2024/1774 is one of these Commission Regulations. For each of them, see The eight Commission Regulations. JC 2024 34 is the Joint Guidelines of the ESAs on costs and losses.

Requirement	Level	DORA provisions	Commission Regulations and guidelines	Law
ORF-361 DORA Scope and Entity Category Applicability	Organization	Articles 1 to 3, 16(1) first subparagraph	None	Article 2
ORF-362 Proportionality and Simplified ICT Risk-Management Eligibility	Organization	Articles 4, 16(1), 16(3)	2024/1774	Article 4, Article 16
ORF-363 Management Body ICT Accountability and Oversight	Organization	Article 5(1)–(3)	2024/1774	Article 5
ORF-364 Management Body ICT Training	Organization	Articles 5(4), 5(2)(g)	2024/1774 Article 19	Article 5
ORF-365 ICT Risk-Management Framework and Resilience Strategy Governance	Organization	Articles 6(1)–(3), 6(8)–(10), 9(2)	2024/1774	Article 6
ORF-366 ICT Control-Function Independence, Audit, and Review Governance	Organization	Article 6(4)–(7)	2024/1774	Article 6
ORF-367 ICT Systems Capacity, Availability, and Resilience Governance	Organization	Article 7	2024/1774	Article 7
ORF-368 ICT Asset, Function, Data, and Dependency Inventory Governance	Organization	Articles 8(1), 8(4)–(7), 16(1)(a), 16(1)(e), 16(3)(a)	2024/1774 Articles 4, 5, 30	Article 8
ORF-369 Continuous ICT Risk Identification, Assessment, and Vulnerability Governance	Organization	Article 8(2)–(3)	2024/1774	Article 8
ORF-370 ICT Protection and Prevention Governance	Organization	Article 9(1)–(4)	2024/1774 Articles 6–8, 11, 13–21, 32–35, 37, 38	Article 9
ORF-371 ICT Detection and Alert Governance	Organization	Article 10	2024/1774 Articles 12, 23, 31(4), 34(g)–(h)	Article 10
ORF-372 ICT Response, Recovery, and Crisis-Management Governance	Organization	Articles 11(1)–(9), 16(1)(f), 16(3)	2024/1774 Articles 24–26, 28(2)(d), 39(1)	Article 11
ORF-373 Backup, Restoration, Recovery Objectives, and Continuity Methods Governance	Organization	Article 12(1)–(7)	2024/1774	Article 12
ORF-374 Post-Incident Review, Learning, Resilience Training, and Technology-Monitoring Governance	Organization	Article 13(1)–(7)	2024/1774	Article 13
ORF-375 Crisis Communication, Client Disclosure, and Public Communication Governance	Organization	Articles 14(1)–(3), 17(3)(d), 19(3)	2024/1774	Article 14
ORF-376 ICT-Related Incident Management Process Governance	Organization	Article 17(1)–(3)	2024/1774 Article 22	Article 17
ORF-377 Major Incident Classification and Materiality Assessment Governance	Organization	Article 18(1)–(2)	2024/1772 Articles 1–10	Article 18
ORF-378 Major ICT-Related Incident Reporting Governance	Organization	Articles 19(1), 19(4)–(7), 20	2025/301 Articles 1–5, 2025/302 Articles 1–7 and Annexes I and II, 2024/1772	Article 19
ORF-379 Significant Cyber Threat Voluntary Notification Governance	Organization	Articles 19(2), 20	2025/301 Article 6, 2025/302 Article 8 and Annexes III and IV	Article 19
ORF-380 Aggregated Annual Major-Incident Costs and Losses Estimation and Reporting Governance	Organization	Article 11(10)–(11)	JC 2024 34	Article 11, JC 2024 34
ORF-381 Operational or Security Payment-Related Incident Reporting Governance	Organization	Articles 19(1), 20, 23	2024/1772, 2025/301, 2025/302	Article 23
ORF-382 Digital Operational Resilience Testing Program Governance	Organization	Articles 24(1)–(6), 25(1)–(3), 16(1)(g)	2024/1774 Articles 36 and 40, 2025/1190	Articles 24–25
ORF-383 TLPT Governance and Authority-Coordination Readiness	Organization	Articles 26(1)–(8), 27	2025/1190	Articles 26–27
ORF-384 ICT Third-Party Risk Lifecycle Governance	Organization	Articles 28(1), 28(4)–(8), 29, 31(12), 42(3)–(4), 42(6), 42(8)	None	Article 28, Articles 31 to 44
ORF-385 ICT Third-Party Contractual Baseline Governance	Organization	Article 30(1)–(4)	2024/1773	Article 30
ORF-386 Register of Information Governance and Reporting Readiness	Organization	Articles 28(3), 28(9)	2024/2956 Articles 1–6	Article 28(3)
ORF-387 Subcontracting of ICT Services Supporting Critical or Important Functions Governance	Organization	Articles 29(2), 30(2)(a), 30(5)	2025/532 Articles 1–6	Article 30(5)
ORF-388 Cyber-Threat Information-Sharing Arrangement Governance	Organization	Article 45(1)–(3)	None	Article 45
ORF-393 ICT Third-Party Risk Strategy Governance	Organization	Articles 28(2), 28(10)	2024/1773	Article 28(2)
MRF-293 ICT Risk-Management Framework Implementation	AI System	Articles 6(1)–(2), 9(2), 15, 16(1)(a)–(c), 16(3)	2024/1774	Article 6, Article 16
MRF-294 ICT Capacity, Availability, and Resilience Execution	AI System	Articles 7, 9(2)	2024/1774 Article 9	Article 7
MRF-295 ICT Asset, Function, Data, and Dependency Mapping Execution	AI System	Articles 8(1), 8(4)–(7), 16(1)(a), 16(1)(e), 16(3)	2024/1774 Articles 4, 5, 30	Article 8
MRF-296 Continuous ICT Risk and Vulnerability Assessment Execution	AI System	Articles 8(2)–(3), 28(4)(c), 29, 16(1)(a), 16(1)(c), 16(3)	2024/1774 Article 31(1)(b), (e), 31(2)–(3)	Article 8
MRF-297 ICT Protection and Prevention Control Execution	AI System	Articles 9, 16(1)(c), 16(3)	2024/1774 Articles 6–8, 11, 13–21, 32–35, 37–38	Article 9
MRF-298 ICT Detection and Alert-Threshold Execution	AI System	Articles 10, 16(1)(d), 16(3)	2024/1774 Articles 12, 23, 31(4)	Article 10
MRF-299 ICT Response, Recovery, and Crisis-Operations Execution	AI System	Articles 11(1)–(9), 16(1)(f), 16(3)	2024/1774 Articles 24(1)(a)–(b), 25(1)–(5), 26(1)–(4), 28(2)(d)(i), 39(1)	Article 11
MRF-300 ICT Backup, Restoration, and Recovery Execution	AI System	Article 12(1)–(7)	2024/1774 Article 26	Article 12
MRF-301 Post-Incident Learning and Resilience-Improvement Execution	AI System	Articles 13(1)–(3), 17(2)	2024/1774 Articles 24(1)(b), 25(5), 26(2)	Article 13
MRF-302 ICT-Related Incident Logging and Evidence-Handling Execution	AI System	Articles 17(1), 17(2), 17(3)(b)	2024/1774, 2024/1772	Article 17
MRF-303 Major Incident Classification and Materiality Assessment Execution	AI System	Articles 17(2), 18(1)–(2), 19(2)	2024/1772 Articles 1–10, 2025/302 Article 8	Article 18
MRF-304 Major ICT-Related Incident Reporting Preparation Execution	AI System	Articles 19(1), 19(3), 19(4)(a)–(c), 19(5), 20	2025/301, 2025/302, 2024/1772	Article 19
MRF-305 Digital Operational Resilience Testing Execution	AI System	Articles 24(1)–(6), 25(1)–(3), 16(1)(g)	2024/1774 Articles 36 and 40, 2025/1190	Articles 24–25
MRF-306 TLPT Participation, Tester-Assurance, and Remediation Execution	AI System	Articles 26(1), 26(2), 26(6)–(8), 27	2025/1190	Articles 26–27
MRF-307 ICT Third-Party Due Diligence and Concentration-Risk Execution	AI System	Articles 8(2), 28(1), 28(4), 29	None	Article 28
MRF-308 ICT Third-Party Contractual Safeguards and Exit-Support Execution	AI System	Articles 28(8), 30(1)–(4)	2024/1773	Article 30
MRF-309 Register-of-Information Evidence Workflow Execution	AI System	Articles 28(3), 28(9)	2024/2956 Articles 1–6	Article 28(3)
MRF-310 Subcontracting Assessment and Flow-Down Execution	AI System	Articles 30(2)(a), 30(5)	2025/532	Article 30(5)

For the Controls that are in OFF-16 or MFF-16 and also in other Frameworks, see Control overlap.

Work that the Frameworks do not contain

The financial entity, authorities, or other persons do the DORA work below, which OFF-16 and MFF-16 do not contain.

• The work of the authorities on incident reports. The Frameworks do not contain authority-side reporting steps or "Supervisory feedback" (Articles 19(6)–(8) and 22). See Incident reports and feedback.
• The Oversight Framework. The ESAs designate critical ICT third-party service providers, and a Lead Overseer does the oversight of each of them (Articles 31 to 44). The duties of the financial entity in Articles 31(12) and 42 are in ORF-384. See Articles 31 to 44.
• The law of each Member State. Examples are the decision in Article 2(4), the competent authorities of Article 46, and the penalty rules of Articles 50 and 52. A Member State can also tell financial entities to send the incident reports to NIS2 authorities or CSIRTs (Article 19(1), sixth subparagraph). See Penalties and enforcement.
• The NIS2 test. The test of NIS2 Article 4 is not in the DORA Frameworks. OFF-15 is a different Framework. See Other Frameworks on the same AI Systems.
• The Digital Omnibus proposal and the ESAs statement. The Digital Omnibus proposal, COM(2025) 837 of 19 November 2025 is about DORA Article 19(1)–(2) and is not law as of October 2026. The ESAs statement JC 2026 25 is about ICT risks from frontier AI models, and its Annex "does not establish additional requirements". See The ESAs statement.

Other Frameworks on the same AI Systems

For financial entities that DORA Article 1(2) names, NIS2 Article 4(1) makes "the relevant provisions" of NIS2 not apply only where DORA requirements are "at least equivalent in effect" to the NIS2 obligations. See DORA and NIS2.

• Do this test before you add OFF-15 (NIS2).
• Add OFF-15 to the same organization AI System only for the NIS2 duties that continue to apply.
• To compare DORA and NIS2, see DORA and NIS2.
• For the Controls that are also in other Frameworks, see Control overlap.

Where to go next

DORA overview

DORA, its dates, its sources, and its penalties

Applicability and governance

Articles 1, 2, 4, 5, 6, and 16: scope, the management body, and the two frameworks

ICT risk and resilience operations

Articles 7 to 23: the parts of the framework, and incident reports

Testing and third-party risk

Articles 24 to 44: tests, TLPT, contractual arrangements, the register of information, and oversight

Information sharing and Level 2 acts

Article 45 and the eight Commission Regulations

NIS2 vs DORA

How DORA and NIS2 apply to the same financial entity

Sources

• Regulation (EU) 2022/2554 (DORA), OJ L 333, 27.12.2022. Articles 1–30, 31(12), 42, 45, 46, 50 and 52. EUR-Lex
• Commission Delegated Regulation (EU) 2024/1772, OJ L, 2024/1772, 25.6.2024. Articles 1–10. EUR-Lex
• Commission Delegated Regulation (EU) 2024/1773, OJ L, 2024/1773, 25.6.2024. Articles 1–10. EUR-Lex
• Commission Delegated Regulation (EU) 2024/1774, OJ L, 2024/1774, 25.6.2024. Titles II and III. EUR-Lex
• Commission Implementing Regulation (EU) 2024/2956, OJ L, 2024/2956, 2.12.2024. Articles 1–6 and Annexes I–IV. EUR-Lex
• Commission Delegated Regulation (EU) 2025/301, OJ L, 2025/301, 20.2.2025. Articles 1–6. EUR-Lex
• Commission Implementing Regulation (EU) 2025/302, OJ L, 2025/302, 20.2.2025. Articles 1–8 and Annexes I–IV. EUR-Lex
• Commission Delegated Regulation (EU) 2025/532, OJ L, 2025/532, 2.7.2025. Articles 1–6. EUR-Lex
• Commission Delegated Regulation (EU) 2025/1190, OJ L, 2025/1190, 18.6.2025. Articles 9(11) and 13(1). EUR-Lex
• ESAs Joint Guidelines JC 2024 34, Final Report of 5 June 2024. Guidelines on the "estimation of aggregated annual costs and losses caused by major ICT-related incidents". EBA
• Directive (EU) 2022/2555 (NIS2), OJ L 333, 27.12.2022. Article 4. EUR-Lex
• ESAs, 18 November 2025: the critical ICT third-party service providers that the ESAs designated (Article 31(9)), and the press release. PDF, press release
• Commission proposal COM(2025) 837 of 19 November 2025 (Digital Omnibus), Article 8. It is a proposal, not law. EUR-Lex
• ESAs statement JC 2026 25 of 31 July 2026, on ICT risks from frontier AI models. ESMA

Disclaimer

The information here is general. It is not legal advice. DORA applies directly in all Member States. The duties come from DORA and from the Commission Regulations that supplement it. The competent authorities of Article 46 make sure that financial entities obey DORA.