DORA: digital operational resilience, who it affects and what it covers

What DORA is

DORA stands for Digital Operational Resilience Act. Think of a building with evacuation rules: it does not prevent the fire but requires you to be ready. DORA does not stop technology failures; it requires you to be prepared for them.

Who it affects

• EU financial entities of various types.
• ICT service providers to those entities, through contracts and, for providers designated as critical, European-level oversight. The European authorities have published a list of critical providers.

The five areas

1. ICT risk management: framework, owners and controls.
2. Incidents: classify and report them to the authority within set deadlines.
3. Resilience testing: periodic exercises.
4. ICT third parties: contracts with minimum requirements and a register of providers.
5. Information sharing on threats.

Link to the AI Act

If you use AI systems in financial processes, DORA asks you to manage their technology risk and their providers, while the AI Act adds its own classification and documentation duties. A single inventory of systems and providers serves both.

Where to start

1. Check whether you are a financial entity or a provider to one.
2. Inventory your ICT systems and providers.
3. Review contracts with key providers.
4. Consult a professional about the deadlines and requirements for your case.

Frequently asked questions

Who does DORA affect?

EU financial entities and their ICT providers.

Since when does it apply?

Since 17 January 2025.

Informational content, not legal advice. DORA has supporting technical standards; check the official text and consult a professional.