Does DORA apply to us?

Yes, if you are a financial entity, and indirectly if you supply ICT services to one. DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), applies from 17 January 2025 to financial entities such as banks, insurers, investment firms and payment institutions, and to critical ICT third-party providers designated under it. Article 19 requires financial entities to report major ICT-related incidents to their competent authority, with an initial notification, an intermediate report and a final report; the time limits are set in technical standards adopted under Article 20. If you are a financial entity, DORA's rules on ICT incidents take precedence over NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.'s general ones for you. If you supply ICT services to a financial entity, DORA reaches you through your contract: Article 30 lists provisions such contracts must contain, including assistance during incidents, audit rights and exit plans. Expect detailed questions and contract clauses from financial customers.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics