# Does DORA apply to us?

Yes, if you are a financial entity, and indirectly if you supply ICT services to one. DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), applies from 17 January 2025 to financial entities such as banks, insurers, investment firms and payment institutions, and to critical ICT third-party providers designated under it. Article 19 requires financial entities to report major ICT-related incidents to their competent authority, with an initial notification, an intermediate report and a final report; the time limits are set in technical standards adopted under Article 20. If you are a financial entity, DORA's rules on ICT incidents take precedence over NIS2's general ones for you. If you supply ICT services to a financial entity, DORA reaches you through your contract: Article 30 lists provisions such contracts must contain, including assistance during incidents, audit rights and exit plans. Expect detailed questions and contract clauses from financial customers.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/does-dora-apply-to-us

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What counts as a significant incident under NIS2?](https://netsenx.com/en/faq/what-counts-as-a-significant-incident-under-nis2)
- [Is a failed or blocked attack reportable under NIS2?](https://netsenx.com/en/faq/is-a-blocked-attack-reportable-under-nis2)
- [How can a small team meet the NIS2 24-hour early-warning deadline?](https://netsenx.com/en/faq/how-can-a-small-team-meet-the-nis2-24-hour-deadline)
- [What should we have ready before the NIS2 24-hour deadline arrives?](https://netsenx.com/en/faq/what-should-we-have-ready-before-the-nis2-24-hour-deadline)
- [Do we have to tell our own customers about a NIS2 incident?](https://netsenx.com/en/faq/do-we-have-to-tell-customers-about-a-nis2-incident)