DORA (Digital Operational Resilience Act)
The EU regulation requiring banks, insurers and other financial entities to manage their technology risks and their ICT providers.
DORA is Regulation (EU) 2022/2554, applicable since 17 January 2025. It covers almost the entire financial sector: banks, insurers, asset managers, payment institutions, crypto-asset providers and others.
It requires five blocks: an ICT risk management framework approved by management; classification and reporting of major incidents; resilience testing (including advanced penetration testing for the largest entities); management of ICT third-party risk, with contracts and a register of providers; and threat information sharing.
It is very relevant to AI: a cloud AI service used by a financial entity is one more ICT provider and must appear in its register, with its contract and exit plan.
Reference: Reglamento (UE) 2022/2554
Related terms
Take the free assessment and find out in a few minutes which obligations your company has and where to start.
← Back to the glossaryUpdated: October 2026 · Informational content, not legal advice.