DORA

European Union Cybersecurity

Status

Applies since 17 January 2025.✓Sources: eiopa.europa.eu, oeil.europarl.europa.eu

Who it applies to

20 types of EU financial entities (banks, insurers, investment firms, payment/e-money institutions, crypto-asset service providers, etc.) and the ICT third-party service providers that serve them; critical ICT providers face direct EU oversight.✓Sources: eiopa.europa.eu, eur-lex.europa.eu, eiopa.europa.eu

Size thresholds

None: applies to in-scope financial entities regardless of size, applied proportionately (Art 4). Small and non-interconnected investment firms, exempted payment and e-money institutions and small occupational pension funds use a simplified ICT risk framework (Art 16).✓Sources: eur-lex.europa.eu, esma.europa.eu, springlex.eu

Regulator

National financial supervisors; European Supervisory Authorities (EBA, EIOPA, ESMA) oversee critical ICT third-party providers✓Sources: eiopa.europa.eu, eiopa.europa.eu

Breach or incident reporting

Major ICT incidents: initial notice within 4h of classifying as major and no later than 24h after awareness; intermediate report within 72h of initial notice; final report within 1 month of the latest intermediate report.✓Sources: eur-lex.europa.eu, advisera.com

Data protection officer

No named officer; the management body bears ultimate responsibility for ICT risk management.✓Sources: eur-lex.europa.eu, oeil.europarl.europa.eu

Local representative

No EU representative duty, but EU financial entities may only use a non-EU critical ICT third-party provider if it sets up an EU subsidiary within 12 months of designation (Art 31(12)).✓Sources: eba.europa.eu, springlex.eu

Maximum penalty

Set by Member States for financial entities. Critical ICT providers: periodic penalty payments up to 1% of average daily worldwide turnover.

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Maintain a board-approved ICT risk management framework.
• Classify ICT incidents and report major ones within 4h/24h, 72h and 1 month.
• Keep a register of all ICT third-party contracts and include DORA-mandated contract terms.
• Test digital resilience regularly; firms selected by supervisors (e.g. systemically important banks, large insurers and payment firms) run threat-led penetration tests.
• Plan exit strategies for critical ICT providers.

Recent changes

Incident-reporting RTS (Delegated Regulation 2025/301) and register-of-information rules apply; ESAs began designating critical ICT third-party providers in 2025.✓

Sources

• Primary source: https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en
• Second source: https://advisera.com/cdr-2025-301/time-limits-for-the-initial-notification-and-for-the-intermediate-and-final-reports/
• Regulator: National financial supervisors; European Supervisory Authorities (EBA, EIOPA, ESMA) oversee critical ICT third-party providers

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.