DORA: the EU Digital Operational Resilience Act, explained

DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554 — an EU regulation that requires banks, insurers, investment firms and a long list of other financial entities to manage information and communication technology (ICT) risk to one harmonized standard, instead of the patchwork of national rules that existed before it. ESMA's own DORA page states the regulation entered into force on 16 January 2023 and has applied since 17 January 2025. Because it is a Regulation rather than a Directive, DORA takes direct effect in every EU member state without needing separate national transposition laws.

Who it covers

ESMA's page describes DORA's scope as "more than 20 different types of financial entities," noting that 12 of those entity types fall directly under ESMA's own supervisory remit; EIOPA's page similarly describes coverage of "20 different types of financial entities and ICT third-party service providers." The European Parliament's legislative file summary for the proposal (2020/0266(COD)) describes the practical reach as "almost all financial entities," while flagging specific carve-outs: micro, small or medium-sized insurance intermediaries are excluded from the outset, and auditors are not currently in scope but were noted as candidates for inclusion in a future review. Critically, DORA's third-party provisions reach beyond financial entities themselves to their ICT third-party service providers — including the ones designated "critical," which fall under a dedicated EU-level oversight framework.

The six requirement areas

ESMA and EIOPA's own pages describe the same six pillars:

Area	What it covers
ICT risk management	Governance and a risk-management framework for ICT-related risk
ICT third-party risk management	Contractual safeguards and ongoing monitoring of external ICT providers
Digital operational resilience testing	Regular testing, including advanced testing for some entities
ICT-related incident reporting	Notifying competent authorities of major ICT incidents on set timelines
Information and threat-intelligence sharing	Voluntary exchange of cyber threat information across the sector
Oversight of critical ICT providers	A dedicated EU-level framework for providers designated as "critical" to the sector

How the detail is still being filled in

DORA's base text sets the framework; the European Supervisory Authorities (EBA, EIOPA and ESMA, acting jointly) and the European Commission have continued adopting Regulatory and Implementing Technical Standards (RTS/ITS) on top of it well past the January 2025 application date. The Commission's own finance page lists, among others:

Delegated regulation	Date	Subject
(EU) 2025/301	20 February 2025	RTS specifying content and time limits for ICT incident notifications and major-incident reports
(EU) 2025/420	24 March 2025	RTS on joint examination team composition, designation, tasks and procedures
(EU) 2025/532	2 July 2025	RTS on elements for assessing ICT service subcontracting that supports critical or important functions

A financial entity — or a vendor supplying one — should treat the base Regulation as the floor and expect this secondary-legislation layer to keep moving; the Commission's page is the live index of what has been adopted, rejected or amended.

Legislative path

DORA began as Commission proposal 2020/0266(COD); the European Parliament's legislative file records that Parliament adopted its position at first reading on 10 November 2022, with a vote of 556 in favor, 18 against and 38 abstentions. That first-reading agreement became the Regulation that entered into force two months later, on 16 January 2023, ahead of the 17 January 2025 application date noted above.

Where DORA sits next to NIS2

DORA is financial-sector-specific, while the NIS2 Directive sets cross-sector baseline cybersecurity and incident-reporting obligations for a much wider range of "essential" and "important" entities across the EU. Both regimes cover ICT/cyber incident reporting, and DORA's own recitals describe it as taking precedence over general cross-sector rules for the ICT risk of in-scope financial entities — the precise boundary between the two regimes is worth confirming against DORA's full article text and recitals (not independently re-verified against the EUR-Lex full text in this guide) rather than assumed from either regulator's summary page alone.

A workable starting point

1. Confirm which of the 20+ entity types you fall into, since obligations and the "simplified" regime for smaller entities differ by category — ESMA and EIOPA's own pages are a faster first check than the Regulation's full text.
2. Inventory your ICT third-party providers now, including which ones would plausibly be "critical" — the oversight framework and the subcontracting RTS (2025/532) both hinge on that classification.
3. Track the RTS/ITS pipeline, not just the base Regulation — the Commission's finance page shows the technical standards are still being adopted, amended and occasionally rejected well after the January 2025 application date.
4. If you sell ICT services or devices into EU financial entities, expect their DORA third-party due-diligence to ask for documentation (security processes, incident handling, subcontracting chain) you may not have had to produce for other customers.

SoftWSP can help an ICT/device vendor put together the security documentation a DORA-covered financial-entity customer's third-party risk process will ask for: see device and firmware security services.

This guide summarises public ESMA, EIOPA and European Commission pages describing Regulation (EU) 2022/2554; it does not constitute legal or compliance advice.